Yeahtthis is a classic case of good security policy and back end code, but poor front end design.

If the user is confused or angry but the engineers know what’s going on just fine, it’s bad design.