I just received an email from Citi saying "We've locked your access for 24 hours due to multiple failed login attempts." and "If you didn’t attempt these logins, we recommend that you reset your password immediately."
Ignoring the humor of being told to change my password immediately when my access to the password reset has been locked for 24 hours, is there actually value to changing your password when someone fails to login to your account? If the attacker, by fact that the login failed, doesn't have your password, it's not clear to me why the password should be changed. Maybe the assumption is that if you're using a poor password, this would encourage you to change to a better password?