diff --git a/internal/api/ui/login/init_password_handler.go b/internal/api/ui/login/init_password_handler.go
index 17ac13ff3..17690138e 100644
--- a/internal/api/ui/login/init_password_handler.go
+++ b/internal/api/ui/login/init_password_handler.go
@@ -5,6 +5,9 @@ import (
 	"net/http"
 	"net/url"
 
+	"github.com/zitadel/logging"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
 	http_mw "github.com/zitadel/zitadel/internal/api/http/middleware"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/zerrors"
@@ -92,7 +95,8 @@ func (l *Login) checkPWCode(w http.ResponseWriter, r *http.Request, authReq *dom
 	userAgentID, _ := http_mw.UserAgentIDFromCtx(r.Context())
 	_, err := l.command.SetPasswordWithVerifyCode(setContext(r.Context(), userOrg), userOrg, data.UserID, data.Code, data.Password, userAgentID, false)
 	if err != nil {
-		l.renderInitPassword(w, r, authReq, data.UserID, "", err)
+		logging.WithFields("instanceID", authz.GetInstance(r.Context()).InstanceID(), "userID", data.UserID).WithError(err).Warn("error setting initial password")
+		l.renderInitPassword(w, r, authReq, data.UserID, "", zerrors.ThrowInvalidArgument(nil, "LOGIN-as3k2", "Errors.User.Code.Invalid"))
 		return
 	}
 	l.renderInitPasswordDone(w, r, authReq, userOrg)
@@ -108,7 +112,11 @@ func (l *Login) resendPasswordSet(w http.ResponseWriter, r *http.Request, authRe
 		authReqID = authReq.ID
 	}
 	_, err := l.command.RequestSetPassword(setContext(r.Context(), userOrg), userID, userOrg, domain.NotificationTypeEmail, authReqID)
-	l.renderInitPassword(w, r, authReq, userID, "", err)
+	if !zerrors.IsInternal(err) {
+		logging.WithFields("instanceID", authz.GetInstance(r.Context()).InstanceID(), "userID", userID).WithError(err).Warn("error requesting password reset")
+		err = nil // we ignore errors on resend to not leak information
+	}
+	l.renderInitPassword(w, r, authReq, userID, "", nil)
 }
 
 func (l *Login) renderInitPassword(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, userID, code string, err error) {
diff --git a/internal/api/ui/login/init_user_handler.go b/internal/api/ui/login/init_user_handler.go
index fa4854a47..28928754e 100644
--- a/internal/api/ui/login/init_user_handler.go
+++ b/internal/api/ui/login/init_user_handler.go
@@ -6,6 +6,9 @@ import (
 	"net/url"
 	"strconv"
 
+	"github.com/zitadel/logging"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
 	http_mw "github.com/zitadel/zitadel/internal/api/http/middleware"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/zerrors"
@@ -109,7 +112,8 @@ func (l *Login) checkUserInitCode(w http.ResponseWriter, r *http.Request, authRe
 	userAgentID, _ := http_mw.UserAgentIDFromCtx(r.Context())
 	err = l.command.HumanVerifyInitCode(setContext(r.Context(), userOrgID), data.UserID, userOrgID, data.Code, data.Password, userAgentID, initCodeGenerator)
 	if err != nil {
-		l.renderInitUser(w, r, authReq, data.UserID, data.LoginName, "", data.PasswordSet, err)
+		logging.WithFields("instanceID", authz.GetInstance(r.Context()).InstanceID(), "userID", data.UserID).WithError(err).Warn("error verifying initial code")
+		l.renderInitUser(w, r, authReq, data.UserID, data.LoginName, "", data.PasswordSet, zerrors.ThrowInvalidArgument(nil, "LOGIN-lk3os", "Errors.User.Code.Invalid"))
 		return
 	}
 	l.renderInitUserDone(w, r, authReq, userOrgID)
@@ -127,6 +131,10 @@ func (l *Login) resendUserInit(w http.ResponseWriter, r *http.Request, authReq *
 		return
 	}
 	_, err = l.command.ResendInitialMail(setContext(r.Context(), userOrgID), userID, "", userOrgID, initCodeGenerator, authRequestID)
+	if !zerrors.IsInternal(err) {
+		logging.WithFields("instanceID", authz.GetInstance(r.Context()).InstanceID(), "userID", userID).WithError(err).Warn("error requesting init mail")
+		err = nil // we ignore errors on resend to not leak information
+	}
 	l.renderInitUser(w, r, authReq, userID, loginName, "", showPassword, err)
 }
 
diff --git a/internal/api/ui/login/invite_user_handler.go b/internal/api/ui/login/invite_user_handler.go
index 18ba50248..62af04e26 100644
--- a/internal/api/ui/login/invite_user_handler.go
+++ b/internal/api/ui/login/invite_user_handler.go
@@ -5,6 +5,9 @@ import (
 	"net/http"
 	"net/url"
 
+	"github.com/zitadel/logging"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
 	http_mw "github.com/zitadel/zitadel/internal/api/http/middleware"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/zerrors"
@@ -98,7 +101,8 @@ func (l *Login) checkUserInviteCode(w http.ResponseWriter, r *http.Request, auth
 	userAgentID, _ := http_mw.UserAgentIDFromCtx(r.Context())
 	_, err := l.command.VerifyInviteCodeSetPassword(setUserContext(r.Context(), data.UserID, userOrgID), data.UserID, data.Code, data.Password, userAgentID)
 	if err != nil {
-		l.renderInviteUser(w, r, authReq, data.UserID, data.OrgID, data.LoginName, "", err)
+		logging.WithFields("instanceID", authz.GetInstance(r.Context()).InstanceID(), "userID", data.UserID).WithError(err).Warn("error verifying initial code")
+		l.renderInviteUser(w, r, authReq, data.UserID, data.OrgID, data.LoginName, "", zerrors.ThrowInvalidArgument(nil, "LOGIN-sjk2o", "Errors.User.Code.Invalid"))
 		return
 	}
 	if authReq == nil {
@@ -115,6 +119,10 @@ func (l *Login) resendUserInvite(w http.ResponseWriter, r *http.Request, authReq
 		authRequestID = authReq.ID
 	}
 	_, err := l.command.ResendInviteCode(setUserContext(r.Context(), userID, userOrgID), userID, userOrgID, authRequestID)
+	if !zerrors.IsInternal(err) {
+		logging.WithFields("instanceID", authz.GetInstance(r.Context()).InstanceID(), "userID", userID).WithError(err).Warn("error requesting invite code")
+		err = nil // we ignore errors on resend to not leak information
+	}
 	l.renderInviteUser(w, r, authReq, userID, orgID, loginName, "", err)
 }
 
diff --git a/internal/api/ui/login/mail_verify_handler.go b/internal/api/ui/login/mail_verify_handler.go
index 071fe6539..ee6d33f5b 100644
--- a/internal/api/ui/login/mail_verify_handler.go
+++ b/internal/api/ui/login/mail_verify_handler.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/zitadel/logging"
 
+	"github.com/zitadel/zitadel/internal/api/authz"
 	http_mw "github.com/zitadel/zitadel/internal/api/http/middleware"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/zerrors"
@@ -121,6 +122,10 @@ func (l *Login) handleMailVerificationCheck(w http.ResponseWriter, r *http.Reque
 		return
 	}
 	_, err = l.command.CreateHumanEmailVerificationCode(setContext(r.Context(), userOrg), data.UserID, userOrg, emailCodeGenerator, authReqID)
+	if !zerrors.IsInternal(err) {
+		logging.WithFields("instanceID", authz.GetInstance(r.Context()).InstanceID(), "userID", data.UserID).WithError(err).Warn("error requesting mail verification")
+		err = nil // we ignore errors on resend to not leak information
+	}
 	l.renderMailVerification(w, r, authReq, data.UserID, "", data.PasswordInit, err)
 }
 
@@ -138,7 +143,8 @@ func (l *Login) checkMailCode(w http.ResponseWriter, r *http.Request, authReq *d
 	userAgentID, _ := http_mw.UserAgentIDFromCtx(r.Context())
 	_, err = l.command.VerifyHumanEmail(setContext(r.Context(), userOrg), userID, code, userOrg, password, userAgentID, emailCodeGenerator)
 	if err != nil {
-		l.renderMailVerification(w, r, authReq, userID, "", password != "", err)
+		logging.WithFields("instanceID", authz.GetInstance(r.Context()).InstanceID(), "userID", userID).WithError(err).Warn("error verifying email code")
+		l.renderMailVerification(w, r, authReq, userID, "", password != "", zerrors.ThrowInvalidArgument(nil, "LOGIN-WSdsg", "Errors.User.Code.Invalid"))
 		return
 	}
 	l.renderMailVerified(w, r, authReq, userOrg)
diff --git a/internal/api/ui/login/password_complexity_policy_handler.go b/internal/api/ui/login/password_complexity_policy_handler.go
index 805194a07..7bb14008f 100644
--- a/internal/api/ui/login/password_complexity_policy_handler.go
+++ b/internal/api/ui/login/password_complexity_policy_handler.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/zitadel/logging"
 
+	"github.com/zitadel/zitadel/internal/api/authz"
 	iam_model "github.com/zitadel/zitadel/internal/iam/model"
 )
 
@@ -22,12 +23,13 @@ func (l *Login) getPasswordComplexityPolicy(r *http.Request, orgID string) *iam_
 }
 
 func (l *Login) getPasswordComplexityPolicyByUserID(r *http.Request, userID string) *iam_model.PasswordComplexityPolicyView {
+	resourceOwner := authz.GetInstance(r.Context()).DefaultOrganisationID()
 	user, err := l.query.GetUserByID(r.Context(), false, userID)
-	if err != nil {
-		logging.WithFields("userID", userID).OnError(err).Error("could not load user for password complexity policy")
-		return nil
+	logging.WithFields("userID", userID).OnError(err).Error("could not load user for password complexity policy")
+	if err == nil {
+		resourceOwner = user.ResourceOwner
 	}
-	policy, err := l.authRepo.GetMyPasswordComplexityPolicy(setContext(r.Context(), user.ResourceOwner))
-	logging.WithFields("orgID", user.ResourceOwner, "userID", userID).OnError(err).Error("could not load password complexity policy")
+	policy, err := l.authRepo.GetMyPasswordComplexityPolicy(setContext(r.Context(), resourceOwner))
+	logging.WithFields("orgID", resourceOwner, "userID", userID).OnError(err).Error("could not load password complexity policy")
 	return policy
 }