The idea to "improve" security is as follows - the service will reply with a failure code even if supplied credentials are correct, but then on a second (third/whatever configured) attempt it will return a success and provide an auth token.
The rationale behind it is that even if there was a leak of some hashes/passwords - then the service will return a failure code to the "hackers" making them think that the password/hash they've stolen isn't valid.
One obvious flaw here as I see it is the overall increase in communication time due to retries, but the service in question isn't the one under high load, so that probably can be ignored.
Are there indeed any benefits here? Or is there any harm in this approach?