HUMAN VERIFICATION REQUIRED ASVS 6.3.8 Account-enumeration resistance

Valid users cannot be deduced from failed authentication challenges, such as by basing on error messages, HTTP response codes, or different response times. Registration and forgot password functionality must also have this protection.