Disclosing the existence of a user increases the success rate of certain attacks. Say I've got a leaked password database for foo.com and know that the user bo

Disclosing the existence of a user increases the success rate of certain attacks. Say I've got a leaked password database for foo.com and know that the user bob@gmail.com uses the password "tomato1". If I try using his credentials to log into bar.com and get the message "username or password is incorrect", I'm just going to try the next user on the list. If I get the message "incorrect password", it makes sense for me to try "tomato2", "tomato3" etc. If I know that your password policy requires eight characters and a capital letter, I'm going to try "Tomato11". This is obviously trivial to automate. You can't protect your users against credential-stuffing attacks if they use the same password everywhere, but you can offer them a small layer of protection if they use the same password with minor variations. As others have pointed out, mere disclosure of the existence of an account could be a serious privacy breach in itself.