Are you using Connect to receive status events? You can have it tell you when there's an Authentication Failure. Here's what comes through when that happens. You're right the Envelope status stays Sent. The Failure is noted lower down. I imagine you'd get the same if you called the API to get envelope status directly.
<EnvelopeStatus>
<RecipientStatuses>
<RecipientStatus>
<Type>Signer</Type>
<Email>XXXXX</Email>
<UserName>John Q Signer</UserName>
<RoutingOrder>1</RoutingOrder>
<Sent>2014-12-30T07:29:45.747</Sent>
<DeclineReason xsi:nil="true" />
<Status>Sent</Status> <!-- STILL SENT -->
<RecipientIPAddress />
<IDCheckInformation />
<RecipientAuthenticationStatus>
<IDQuestionsResult>
<Status>Failed</Status> <!-- HERE IS THE FAILURE -->
<EventTimestamp>2014-12-30T13:30:09.79Z</EventTimestamp>
</IDQuestionsResult>
<IDLookupResult>
<Status>Passed</Status>
<EventTimestamp>2014-12-30T13:30:09.79Z</EventTimestamp>
</IDLookupResult>
</RecipientAuthenticationStatus>