Account enumeration is a weakness in a login, signup, or password-recovery flow that reveals whether a username or email address is valid. The leak can be direct, such as “account not found,” or indirect, such as different response times, status codes, or error wording.
In cyber security, enumeration matters because it helps attackers shortlist real targets before launching phishing, credential stuffing, vishing, or password reset abuse. Once a live identity is confirmed, the attacker can focus social engineering on that person instead of guessing blindly. Defenders reduce this risk by using generic error messages, consistent response behavior, rate limiting, and careful recovery-flow design. In wallet and finance scams, enumeration often appears early in the chain: it identifies victims before the attacker tries to steal a seed phrase, MFA code, or other high-value secret.