What is an Account Enumeration Attack?
Account enumeration is a pre-auth recon attack where an adversary probes your login, signup, or
password-reset flows to discover which identifiers (emails, phones, usernames) exist. No need to break in yet. First
they map the territory—through tiny leaks: distinct error messages, timing gaps, different MFA prompts, “email not
found” vs “check your inbox,” even a “this email is already registered” hint on signup. One bit at a time, they build
a clean list of valid accounts. Then the pain starts: credential stuffing, targeted phishing, SIM-swap attempts,
social engineering, takeover.
It succeeds because UI and backend behavior diverge. Different HTTP codes. Different response sizes. Reset
emails only sent for real users. CAPTCHA shown for some flows, not others. Even a 50–100 ms timing delta can
separate “exists” from “doesn’t.” At scale, bots chew through dictionaries of addresses and phone numbers,
enriching with breach combos and open-source scraps. Quiet. Efficient. Dangerous.
Mitigation is design plus discipline. Return uniform responses across auth endpoints—same text, same status,
same latency padding. Always say “If an account matches, we’ll send instructions.” Don’t confirm existence.
Normalize timing with artificial jitter. Apply velocity limits per IP/device/ASN, add progressive backoff, and
challenge with bot defenses only after thresholds—so your own signals don’t leak. Watch for spray patterns
across many identifiers on one device graph; also the inverse: many devices hammering a single domain. Seed
canary addresses to trip early alerts. Treat password-reset and signup like production APIs, not side
quests—same logging, same abuse rules, same care.
When risk spikes, step up verification for suspicious sessions during user onboarding. Bind accounts to real people with strong identity verification and keep the high-risk stuff (limit increases, payouts, credential changes) behind those guardrails. Enumeration
hunts for weak edges. Close them, and you starve the follow-on attacks before they ever land.
