We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to log in unsuccessfully a number of times (also configurable, but the default setting will probably be around 5 times).
I am now trying to figure out how best to present this to the user.
Option A: Count down the number of attempts left every time the users makes an unsuccessful attempt to log in. E.g. "You have 3 login attempts left", "You have 2 login attempts left" etc. The problem with this approach, as I see it, is that it adds an unnecessary and possibly stressful component to the login process. On the other hand people will probably be less sloppy when entering their passwords if they are informed immediately after the first error that they only have so many attempts before the account is locked.
Option B: Only present a warning before the final attempt. E.g. "For security reasons your user account will be locked for X minutes if you enter the wrong credentials again." This approach avoids unnecessary information until the user actually needs it and I am leaning towards this option.
What are your thoughts? Is there another, better way?