Duplicate Accounts and Multi-Accounting: How to Evaluate the Signals

Legitimate multiple accounts versus abusive account creation

Legitimate reasons for multiple accounts include forgotten credentials, shared devices in a household, separate personal and business accounts, and testing by developers or QA teams. Abusive multi-accounting involves creating accounts specifically to exploit policies—claiming multiple signup bonuses, circumventing bans, farming referral rewards, or accumulating accounts for later resale or coordinated use.

The distinction is not always clear from signals alone. A shared IP address or device does not prove abuse—it may reflect a household, a workplace, or a shared network. The combination of signals, the velocity of account creation, and the downstream behavior of the accounts provide more context than any single indicator.

Signals associated with abusive multi-accounting

The following signals, assessed in combination, are associated with coordinated or abusive account creation:

• Repeated contact identifiers. The same email address, phone number, or identity detail appearing across multiple accounts—sometimes with minor variations such as added dots or plus-addressing in email—indicates the same person or system is creating multiple accounts.
• Account creation velocity. Multiple accounts created in a short window from the same IP, device, or with similar contact details suggests automated or coordinated activity rather than organic user growth.
• Shared infrastructure. Multiple accounts originating from the same IP address, IP range, or device profile may indicate coordinated creation. Shared IPs alone do not prove abuse—they are common in households, workplaces, and shared networks—but combined with other signals they add weight to an assessment.
• Device-environment risk signals. Automation indicators, emulator or virtual-environment signals, and manipulated device attributes suggest the account was not created by a genuine human user. These signals can be assessed even on a first-seen device—a device does not need a prior history to show risk indicators.
• Incentive-seeking patterns. Accounts that claim a signup bonus or referral reward and then show no further engagement are a pattern worth monitoring. The absence of downstream activity does not confirm fraud, but it is a signal to investigate.
• Identity consistency. Mismatches between submitted name, address, date of birth, and contact details—or the same identity details appearing across multiple accounts with different email addresses—are observable patterns associated with synthetic or recycled identity use.

Device risk without recognition

Device recognition—linking a current session to a previously observed device—is useful for identifying accounts that share a device. But recognition is not the only device capability relevant to multi-accounting.

Device-risk assessment evaluates the current environment for signs of manipulation, automation, and suspicious configurations. A device that has never been seen before can still show emulator indicators, automation signals, or inconsistent attributes that suggest it is not a genuine user device. This is particularly relevant for new account creation, where there is no prior device history to compare against.

Evaluating both capabilities separately—risk assessment of the current environment, and recognition of returning devices—gives a more complete picture than relying on either alone.

A practical evaluation approach

When evaluating multi-accounting signals, a structured approach helps distinguish patterns that warrant action from those with legitimate explanations:

1. 1Define what counts as a duplicate. Establish clear criteria: same email, same phone, same device, same IP within a time window, or some combination. Document the criteria so that reviews are consistent.
2. 2Assess the combination of signals. A single shared signal—one IP address, one device—may have a legitimate explanation. Multiple shared signals across the same accounts, combined with velocity and incentive-seeking patterns, build a stronger case for investigation.
3. 3Review downstream behavior. Accounts that claim an incentive and then show no further engagement, or that are used in coordinated patterns, provide behavioral evidence to complement signal-based assessment.
4. 4Calibrate thresholds against outcomes. Set review thresholds based on observed outcomes in your environment, not on generic benchmarks. What constitutes a suspicious velocity in one product may be normal in another.