Why the wall arrives at about five
A limit has to sit above the number of honest mistakes a real person makes and below the number of guesses that would make guessing worth anybody's while. Honest mistakes cluster at one or two, usually a password from a different site or a capital letter left switched on. Five leaves room for that and still reduces an automated attempt to nothing useful.
That reasoning is why the figure is not arbitrary. It is also why it is not a fact. The same reasoning produces four on one market and eight on another, and neither publishes which.
attempt 5 a captcha, or a few seconds of delay
attempt 6 onward the delay doubles, or the account locks for an hour
Which of the three you meet is the operator's choice. A captcha costs an attacker time. A growing delay costs them far more. A lockout costs the legitimate owner as well, which is why it tends to be the least popular of the three.
What five attempts buy you
Nothing at all, if you were relying on memory. That is the whole use of the number. Five goes at a password you half remember is not a search, it is a coin toss you lose. Five goes at a password you have stored is four more than anybody needs.
So the figure argues for a stored random password over a memorable one, and against reusing anything you type elsewhere. A stored string costs one paste. A memorable one can burn the entire budget on the first morning you cannot recall which variation you used here.
It also puts a floor under how much the login page is worth attacking. With five tries and a wall behind them, guessing is not how anybody gets in. They get in by persuading you to type the password somewhere else, which is why comparing the address properly and checking a fingerprint both matter more than password strength ever will.
What people do wrong when the five runs out
They carry on. An attempt made after the wall is up does not test the password, it feeds the wall, and against a doubling delay it feeds it quickly. The correct response to a lockout is to stop for as long as the lockout lasts and then return once.
The second error is reading the wall as evidence of a fake. A captcha after several failures is an ordinary defence doing an ordinary job and says nothing whatever about where you are. A convincing copy will show you one too, since reproducing a login flow is the easy half of building a copy.
The third is blaming the limit for a problem it did not create. If the password is being rejected on a site you reached through an address of unclear origin, the setting is not the interesting question. The origin of the address is.
What moves the five up or down
The operator moves it whenever they like and nothing announces the change. Under attack it usually moves down, sometimes to a captcha shown on the first attempt to everybody, because a service being hammered with stolen credential lists will trade convenience for survival every time.
Load moves it too. Some designs tighten limits while the service is busy, for the same reason a queue page turns up at a busy moment. What you actually meet is a setting combined with a moment, not a constant you can plan around.
Questions people ask
Is five the real limit on this market?
Unknown. It is where these limits usually sit. Nobody here holds an account and this site tests nothing, so treat the figure as a planning number rather than a rule.
I am locked out. Is the account gone?
A wall in this shape is time based and clears on its own. Repeated attempts while it is up can extend it, so the cheapest move is to leave it alone until it expires.