Direct answer
Account enumeration occurs when a workflow reveals whether an identifier is registered. Compare the externally visible behavior for known and unknown controlled identifiers across login, recovery and registration.
Choose controlled identifiers
Create an authorized test account and reserve a second identifier that is not registered. Agree a small request budget and use an environment where messages and email delivery can be safely inspected. Avoid enumerating real customer addresses.
Reference: OWASP Authentication Cheat Sheet.
Compare observable behavior
Run the same recovery request for each identifier and compare status, visible text, redirects and response size. Observe delivery to the test inbox separately. A uniform message can still be undermined by a distinguishable response body or different API error.
- Repeat under comparable network and server conditions.
- Record only synthetic identifiers in the report.
- Check registration and invitation flows as well as login.
Assess timing with caution
A single slow response proves little. If timing is in scope, use a small agreed sample and record variability, caching and infrastructure load. A consistent difference can warrant implementation review, but it is not evidence of account takeover by itself.
Verify the fix without blocking recovery
After the owner adjusts responses, repeat both identifiers and confirm that a real user still receives the intended recovery instructions through the secure channel. Confirm rate controls and monitoring operate independently of wording.
Assessment limits
A generic message does not prevent enumeration via every channel or side effect. Timing differences need careful statistical interpretation, and legitimate workflows may have additional privacy constraints.
Frequently asked questions
Is account enumeration the same as account takeover?
No. It reveals account existence; takeover requires additional failures or access. Explain the privacy and abuse impact in the actual context.
Can generic messages break account recovery?
The public response can be generic while a legitimate user receives the correct private instructions. Verify both paths after a change.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.