diff --git a/login.php b/login.php
index 27a62c4f..794a8816 100644
--- a/login.php
+++ b/login.php
@@ -160,25 +160,28 @@ function _addAnchor($url, $type, $vars, $url_anchor = null)
     // TODO: Factor out into login handler class
     // First check if we need to validate the second factor.
     $authUser = Horde_Util::getPost('horde_user') ?? '';
-    $passSecondFactor = true;
+    $errorSecondFactor = false;
     if ($loginHandler->secondFactorSupported) {
+        $message = null;
         try {
             $authSecondFactor = (string) Horde_Util::getPost('horde_secondfactor');
-            $errorSecondFactor = $registry->call('secondfactor/blockLogin', [
+            $message = $registry->call('secondfactor/blockLogin', [
                 $authUser,
                 $authSecondFactor,
             ]);
+            if ($message) {
+                $errorSecondFactor = Horde_Auth::REASON_MESSAGE;
+            }
         } catch (Horde_Exception $e) {
             $errorSecondFactor = Horde_Auth::REASON_BADLOGIN;
         }
 
         if ($errorSecondFactor) {
-            $passSecondFactor = false;
-            $auth->setError($errorSecondFactor);
+            $auth->setError($errorSecondFactor, $message);
         }
     }
 
-    if ($passSecondFactor && $auth->authenticate($authUser, $auth_params)) {
+    if (!$errorSecondFactor && $auth->authenticate($authUser, $auth_params)) {
         Horde::log(
             sprintf(
                 'Login success for %s to %s (%s)%s',
diff --git a/src/Login.php b/src/Login.php
index d548c210..7df660fa 100644
--- a/src/Login.php
+++ b/src/Login.php
@@ -40,7 +40,8 @@ public function buildLoginParams(): array
             $loginparams['horde_secondfactor'] = [
                 'label' => _("Second Factor"),
                 'type' => 'password',
-                'value' => $this->vars->horde_secondfactor,
+                // 'value' => $this->vars->horde_secondfactor,
+                'extra' => [ 'autocomplete' => 'off' ],
             ];
         }
         return $loginparams;