diff --git a/src/users.js b/src/users.js
index 3f0a18c10..41ac4df23 100644
--- a/src/users.js
+++ b/src/users.js
@@ -267,6 +267,8 @@ async function setGhost(user, password, expiresAt) {
     assert.strictEqual(typeof password, 'string');
     assert.strictEqual(typeof expiresAt, 'number');
 
+    if (!user.username) throw new BoxError(BoxError.BAD_STATE, 'user has no username yet');
+
     expiresAt = expiresAt || (Date.now() + DEFAULT_GHOST_LIFETIME);
 
     debug(`setGhost: ${user.username} expiresAt ${expiresAt}`);