Login rejected

One possible cause changes what you should do first, which is why this page is in a specific order.

Then the dull causes, in order

1. The username, character by character. People change a character or the case and then debug the password field for an hour.
2. Your clock. Time based codes fail when a machine has drifted, which happens on systems that were off a while or run isolated. This is a large share of reports that read as rejection.
3. Circuit quality. A slow circuit can push you past the window for a time based code, which reads as a wrong code rather than a timeout.
4. Rate limiting. Several fast attempts trigger it, and it looks identical to refusal. Wait an hour rather than trying harder.
5. A different address. Sessions are shared across the three, so failing at one and working at another points at that address.

If the signature check failed

Treat the credentials as gone and work in this order, because it puts what somebody can act through ahead of what you are most worried about.

1. Get in through an address you verified yourself, not the one you were just using.
2. Change the password to something used nowhere else, and change it anywhere you reused it.
3. Reset the second factor and save the new recovery material before closing the page.
4. Read the message log. A stolen account is most valuable as a way to talk to people who trust it.
5. Check open orders and saved addresses for anything you did not do.
6. Deal with the balance last, which is counterintuitive and correct.

What will not help