Quick answer: Ask for a code with any number or email and the screen responds identically whether it exists or not. Attackers can’t harvest your member list by probing identifiers — a small design choice that protects the entire roster.
How it works
Silent no-ops on unknown identifiers are deliberate, not an error-message oversight.
The same principle guards invite resolution and password-less flows end to end.
Members with typos still get clear guidance: check with your admin what’s on file.
Frequently asked questions
Doesn't this confuse members?
The message says a code was sent if the identifier is registered — honest and safe.
What else is enumeration-protected?
Sign-in, invites and search visibility all refuse to confirm hidden existence.