I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g.
An OTP has been sent to your registered mobile number would be displayed to the user. When a user has failed to supply valid username/password, an error message informing user that the
either username or password is incorrect is displayed and so it would not even reach the OTP stage.
My understanding is that such implementation can be abused. Assuming that attacker has managed to get the list of username or password and then combines it with automated brute force or password spraying attacks, he would be able to arrive at valid username/password pairs.
Assuming that my assessment is correct, what steps can be taken to minimize this risk?