``A customer is given three chances to log in. If a customer fails to log in three times, his/her account should be locked.''
This is a very vague description, even though it may not seem so. If a customer logs in successfully after two failed attempts, will the next failure lock up the account? It is not clear from the description whether the counter should be reset to 0 every time after a customer logs in successfully.
As a result, informal program specifications written in a natural language should be avoided.