Your authenticator code is asked for next.
Five failed attempts locks the account for fifteen minutes. Every attempt is recorded with its address.