My website allows medical professionals to sign up for an account. After they sign up and provide basic information about their credentials and their practice, we tell them that we need to manually verify their credentials before their account is activated.
My question is: What do I tell the user if he or she tries to log in before we've enabled the account?
My inclination is to politely tell the user that their account has not yet been enabled after they've successfully logged in (via username + password + MFA).
Is there a security problem with this scenario? It seems to me that this is no different than most MFA implementations, which ask for the additional factor after the user has successfully entered a valid username/password combination. In both cases, the user knows that the username/password combination worked because the "next thing" happened.