Most abuse that looks like many different users is actually one actor wearing many masks. A single person opening dozens of accounts to farm signup bonuses, evade a ban, stuff a marketplace with fake reviews, or launder stolen cards is the shared shape behind promo abuse, ban evasion, and fake-profile problems. The accounts look independent because each has its own email, name, and password. The devices behind them do not.
Detecting multi-accounting means finding the links that survive across accounts even when the obvious identifiers are fresh. This article covers which links matter, how to assemble them into an identity graph, and how to act on clusters without penalizing legitimate shared devices.
Why per-account checks miss the pattern
Fraud teams instinctively validate each account in isolation: is this email real, is this card valid, does this phone verify. An organized multi-accounter passes all of those checks on every account, because each account is individually plausible. The fraud is not in any single record. It is in the relationship between records.
Consider a bonus-abuse operation:
- Ten accounts, ten distinct emails, ten valid phone numbers from a SMS-verification service.
- Each passes email and phone checks cleanly.
- All ten were created from the same device within an hour, or from the same residential proxy pool with rotating exit IPs.
No per-account rule fires. The only way to see it is to link the accounts through what they share. That is why multi-accounting detection is fundamentally a graph problem, not a validation problem.
The links that survive fresh credentials
The value of a link is how hard it is for the abuser to make unique per account. Emails and names are trivially fresh; deep device and network signals are not.
| Link type | Cost to vary per account | Strength |
|---|---|---|
| Email, name, phone | Very low | Weak |
| IP address | Low, via proxies | Weak to medium |
| Device fingerprint | Medium to high | Strong |
| Payment instrument | High | Strong |
| Behavioral signature | High | Strong |
The anchor is the device fingerprint, which produces a stable visitor ID with a confidence score even when cookies are cleared between signups. When an abuser tries to defeat it with an anti-detect browser, the spoofing itself becomes a signal. Layer on network context: reused ASNs, a shared residential proxy pool, or datacenter IPs that no ordinary consumer signs up from. Then add behavior, where behavioral biometrics reveal that ten accounts share one person’s typing and mouse rhythm.
Building the identity graph
An identity graph treats every account, device, payment method, and network fingerprint as a node, and every observed co-occurrence as an edge. Abuse rings light up as dense clusters.
account_A --device_9f3a--> account_B
account_A --card_last4_8821--> account_C
account_B --device_9f3a--> account_D
=> cluster {A, B, C, D} shares 1 device + 1 card
The interpretation rules that matter:
- Many accounts, few devices is the canonical multi-accounting shape.
- Fan-out from one payment instrument across unrelated accounts suggests stolen-card testing or synthetic identity.
- Bursty creation timing within a cluster separates coordinated rings from coincidental sharing.
- Templated behavior, where accounts move through the product identically, points to a device farm or scripted operation.
Edges should be weighted by the confidence of the underlying match. A high-confidence device ID link is worth far more than a shared IP that a whole apartment building might use.
Acting without punishing shared devices
The failure mode of multi-accounting enforcement is banning a family, a shared office computer, or a public terminal. Avoiding it is a matter of separating coincidental sharing from coordinated abuse.
Distinguishing features of legitimate sharing:
- Behavior is diverse across the accounts, not templated.
- Accounts were created far apart in time, not in a burst.
- Activity looks organic, with varied hours and workflows.
- The device confidence is high but the payment and behavioral links are absent.
Distinguishing features of abuse rings:
- Creation clustered in a short window.
- Identical navigation paths and timing.
- Shared payment instruments or coordinated withdrawals.
- Evasion signals like anti-detect browsers or proxy rotation.
Rather than a hard ban, escalate proportionally: require step-up verification for medium-confidence clusters, hold bonuses or payouts pending review, and reserve blocking for high-confidence rings. Explainability matters here, so attach reason codes to every enforcement action and track your false-positive rate as a first-class metric.
Where multi-accounting hurts most
The economics of the abuse determine how aggressive you should be.
- Promo and bonus abuse in consumer apps, where each fake account extracts a signup credit.
- Bonus abuse in iGaming, where free bets and deposit matches are farmed at scale.
- Marketplace trust and safety, where fake accounts post reviews or evade seller bans.
- Dating app fake profiles, where one operator runs many personas for scams.
Frequently asked questions
How do you detect multiple accounts from one person?
You link accounts through shared device fingerprints, network characteristics, and behavioral patterns rather than any single field. A device that creates many accounts, or accounts that share a stable device ID, forms the core of a multi-accounting signal.
How do you avoid flagging families or shared computers?
Weight device links by confidence and combine them with behavioral and timing signals. Legitimate shared devices show diverse behavior over long periods, while abuse rings show bursty creation, templated behavior, and coordinated activity.
What is an identity graph in fraud detection?
An identity graph connects accounts, devices, payment instruments, and network signals as nodes and edges. Clusters with many accounts sharing few devices or instruments reveal rings that per-account checks miss.
Multi-accounting is invisible to per-account validation and obvious to graph-based linking. Anchor your links on a confident device ID, enrich them with network and behavioral evidence, assemble them into an identity graph, and enforce proportionally so shared devices are not caught in the net. Start with the device fingerprinting foundation, then connect it to your signup fraud and account takeover defenses.
Run it yourself
Prynt is open-source, self-hostable device intelligence — visitor IDs, bot & fraud Smart Signals, and behavioral biometrics you own end to end.