Detecting multi-accounting

Find people who open many accounts to abuse promotions, referral bonuses, free trials or ban evasion.

The problem#

One person creating dozens of accounts distorts your metrics and drains incentives. They rotate emails and usernames, but they often reuse a phone number, an IP range, a device or an email domain.

Signals to combine#

• IP reputation and IP lookup: hosting, VPN and proxy networks are favoured for mass sign-up.
• Email scoring: disposable providers and role-based mailboxes.
• Phone validation: invalid, disposable and virtual numbers.
• ASN lookup to group sign-ups by network.
• Your own data: count accounts per phone, per device ID and per IP in a time window.

Gurdx scores individual values. The grouping logic ("how many accounts share this phone?") lives in your database.

Integration flow#

1. At sign-up, call email scoring and phone validation. Pass userID once you have an ID, or the email itself.
2. Call IP reputation for the sign-up IP.
3. Query your own tables for accounts sharing the same phone, device or IP in the last 24 hours.
4. Combine both views and decide: create, create but withhold bonuses, or require verification.
5. When you confirm an abuser, add their email domain, phone and IP to blacklists.

<?php
function gurdx(string $path, array $query): array {
    $url = 'https://gurdx.cretip.com/api/' . $path . '?' . http_build_query($query);
    $ctx = stream_context_create(['http' => [
        'header' => 'Authorization: Bearer ' . getenv('GURDX_KEY'),
        'timeout' => 5,
    ]]);
    return json_decode(file_get_contents($url, false, $ctx), true);
}

$email = gurdx('scoring/email', ['email' => $email, 'userID' => $email]);
$phone = gurdx('scoring/phone', ['phone' => $phone, 'countryCode' => 'SA']);

$sharedPhones = Account::where('phone_hash', hash('sha256', $phone))->count();

$flag = ($email['data']['isDisposable'] ?? false)
     || ($phone['data']['isValid'] ?? true) === false
     || $sharedPhones >= 3;

Suggested actions#

Warning: Households, offices and mobile carriers share IPs and sometimes phones. Prefer withholding rewards over deleting accounts, and offer a way to appeal.

Use custom rules to turn recurring patterns, such as a specific email domain, into automatic flags. Related: Fake account detection.