I did something like this for a client application a long time ago.
If you are using Access User Level Security this is not possible because
the login form appears before ANY VBA code runs in the database. If,
however, you create your own login "system" then yes, you can do this.
It sounds like you have done this.

I could post all the code behind the login button on the form, but it may
be a little confusing with all the other stuff it is doing. There are many,
many ways to do this, but here is what I did:

1. Made a hidden textbox on the form called CheckAttempts with a
default value of 1. When the form opens it has a value of 1.

2. Ran my code to verify their User Name/Password.

3. If there was no match in the tblUsers then I did a Select Case on
the value of CheckAttempts. Something along these lines:

Select Case Me.CheckAttempts
   Case 1
      ' Gave them a message here
      ' Increment the value
       Me.CheckAttempts = 2
   Case 2
      ' Gave them another message here
      ' Increment the value again
       Me.CheckAttempts = 3
   Case 3
       ' Third and final attempt. You're outta here now buddy
       ' Last message
       DoCmd.Quit
   Case Else
       ' Should not get here
End Select

Just modify something like the above to suit your needs.

Hope that helps,