[plextoria]

Thanks for your answer! Makes me curious how do you defend against people simply bruteforcing or guessing the account numbers.

[BrunoBernardino]

Rate limiting when it's invalid (and high entropy to generate new ones)! It's in the FAQ :)