in some environments, if the credentials are rejected due to invalid password, the devices are typically prompted to re-enter their credentials....
For my documentation, I typically have users remove their profile and re-do the entire thing, on iPhones/Androids primarily because I have seen the different OSs use the new credentials once, but not cache those, so next auth is rejected again...
If the users ignore the message, well then then sometimes experience issues, as some devices don't re-prompt....