Generic error messages prevent account enumeration by hiding whether a username exists, blocking brute-force attacks that rely on distinguishing invalid users from wrong passwords.