User authentication is usually done during the login process. To proof your identity (and right to enter the website) you need to have an user account and know a secret password. Because, the server cannot "see" the user, you first have to tell which account you want to use, in other words, you have to enter your user name. User names (instead of number) are used because they are easy to remember. By knowing the secret password you proof, that you are really the one you pretend to be. Only if both, user name and password match, access will be granted.
ATMs work similar: you need to have a bank account and to know the PIN to withdraw money. Also, the ATM cannot see you (even if there is video surveillance), you use your bankcard to tell the ATM which account schould be used. After typing in the proper PIN you get money (if there is sufficient fund :-) ).
Example: Jack the Ripper has a well known and trustworthy user. His user name is "jack" and his secret password is "v3ry-S3(r3t". Of course, Jack is clever and he uses a "strange" characters as well as capital letters in his password. This makes it very hart for samrt guys like Sherlock Holmes and Dr. Watson to guess his password. (Never user your birhtdate, phone-number, your girlfriend's name etc. as password!).
All Jack needs to do to login is to enter his user name "jack" and the secret password. Of course, user name and password are treated case sensitive. Finally he hits the login button and... Voila!
If either user name or password is incorrect, the error message "login failed" will be displayed. The same message will be used if password and user name match, but account is disabled and/or does not have required permissions. In all cases, you will get this fuzzy error message, which may not help much.
Of course, the server knows exaclty what went wrong and would be able to give you a clue. On the other side, displaying detailed error messages will give lots of information to possible intruders. Thus to improve security, error messages about the login process are kept to minimum.