Whatever you do, DON'T follow this advice. It's utterly wrong.
Here's the professional way to do this:
"An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to the status of an existing account."
Here's the professional way to do this:
"An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to the status of an existing account."
https://www.owasp.org/index.php/Authentication_Cheat_Sheet