Account Harvesting
Account harvesting is the process of collecting valid user account names or identifiers that can later be used in security attacks.
“The process of obtaining user account information based on trial and error with the intention of using that information in a security attack.”
(Definition reproduced from the ISTQB Glossary. Copyright belongs to ISTQB.)
View the complete ISTQB GlossaryWhat is Account Harvesting?
Attackers use account harvesting to identify valid usernames through public information, system responses, or automated techniques. Security testing verifies that applications do not reveal unnecessary account information.
Common techniques: Login pages, password recovery, and public directories.
Security testing: Testers verify that applications do not disclose whether accounts exist.
Risk reduction: Generic error messages reduce information leakage.
Real World Example
An online banking login flow is being reviewed after fraud analysts report repeated attempts to discover valid customer accounts.
The concern is not whether ordinary login works; it is how the system behaves when someone intentionally misuses it. Account harvesting points testing toward that hostile or risky behavior.
The tester probes rate limits, error messages, audit events, lockout behavior, and monitoring signals to see whether the system gives attackers useful feedback.
The team strengthens the controls because Account harvesting helps them test the product from the perspective of misuse, not only normal customer journeys.
Practice Questions
Question 1
A login page returns 'Invalid username' for unknown accounts and 'Invalid password' for known accounts. Which security issue does this reveal?
Question 2
Which mitigation is MOST effective against automated account harvesting?
Test your knowledge with real ISTQB-style questions
You’ve learned Account Harvesting. Test your understanding with topic-specific questions in our Mock Exams.