Data Validation – Positioning

I have discovered that users are struggling with signing into our site due to data validation.

Currently, the system has this logic:

• Wrong email/ID = display error
• Wrong password = display error
• Wrong email/ID/password = display error

This error is the same for all instances and displays underneath the email input box regardless of what is causing the error.

My question is, should I split out the error box to say 'Incorrect Password' and display this under the password input in the instance the user has entered the wrong password (to make it clear this is what the user has to correct before continuing)?

I had a secondary thought which was if someone is trying to log into someone elses' account, they would have confirmation that the email they guessed is correct but the password is wrong or vice versa.

Do the positives of solving user struggle outweigh the potential issues around fraudulent behavior?

(Basically asking the question as I predict stakeholders will ask!)