How to detect users with multiple accounts
Referral bonuses, free tiers and per-account limits reward people who open many accounts. The links that connect those accounts, and how to act on a cluster fairly.
Why people open more than one account
Multi-accounting is one person operating several accounts on a service that expects one per person. The motive is almost always that something is given per account:
- Free trials and free tiers — start over when the allowance runs out.
- Referral and signup bonuses — refer yourself, collect both sides.
- Per-account limits — usage caps, one coupon per customer, one vote per user.
- Bans — come back after being banned for abuse.
Not every second account is abuse. People keep work and personal accounts, and families share a laptop. A good detection setup tells these apart instead of treating every link as guilt.
The links that connect accounts
Each account looks clean on its own; what gives multi-accounting away is the connection between accounts. These are the links worth recording at signup, roughly from strongest to weakest:
The same mailbox
Two addresses that deliver to one inbox — Gmail dot and plus variants — are the clearest link there is. See Gmail dots and plus aliases for the normalization.
The same payment card
Payment providers expose a card fingerprint that is stable for the same card number across customers (Stripe calls it card.fingerprint). Two accounts verified with one card are very likely one person.
The same device
A browser that created one account and now creates another is a strong link — unless the device is shared. Recognize it with a script on the signup page rather than by IP address. Cookies alone are weak here, since clearing them or opening a private window is the first thing a multi-accounter does.
The same network
Many accounts from one IP address or subnet in a short time is a pattern, but IPs are shared by offices, universities and mobile carriers. Use network as supporting evidence only.
From links to clusters
Pairwise links are hard to act on. Group them instead: if account A shares a device with B, and B shares a card with C, then A, B and C form one cluster. The size and composition of the cluster tells you much more than any single link:
| Cluster | Likely explanation | Reasonable action |
|---|---|---|
| 2 accounts, same device, different mailboxes and cards | Shared computer, or one person with work and personal accounts | Allow; maybe no second free trial |
| 3–5 accounts, same mailbox variants | One person restarting the trial | Review: ask for a card or point to sign-in |
| 10+ accounts, same device or subnet, throwaway inboxes | Scripted farm | Block new signups from the cluster |
A union-find structure or a simple “cluster id” column that you merge on each new link is enough to keep clusters up to date at signup speed.
Acting fairly on a cluster
- Act on what the incentive is. If the abuse is free trials, the remedy is “no second trial”, not “no account”.
- Give a way out. Ask for a card or a phone number, or offer the paid plan. Don't leave a real person at a dead end because their sister used the same laptop.
- Keep evidence, not just a verdict. Store which links connected the accounts, so support can explain and reverse a decision.
- Respect retention limits. Device and network data is personal data in many jurisdictions; keep it only as long as you need for this purpose, and say so in your privacy policy.
Measure before you enforce
Run detection silently first. After a couple of weeks, look at the largest clusters and at a sample of two-account clusters. The large ones tell you how much abuse there is; the small ones tell you how many honest users you would hurt with each rule. Set thresholds from that.
How Attrelix does it
Every Attrelix check links the new signup to earlier accounts in your project by normalized mailbox, device and, if you send it, card fingerprint. The response includes the number of linked accounts and a cluster id, the dashboard groups them on a clusters page, and links add risk points in steps — one, three and ten linked accounts weigh progressively more. History is kept for the period of your plan.
Summary
- Multi-accounting follows per-account incentives; find those first.
- Record links: mailbox, card, device, network — strongest first.
- Group links into clusters and act on cluster size and shape.
- Match the remedy to the incentive and always leave a way out.