Multi-accounting: how websites notice several accounts on one device

Multi-accounting means one person running several accounts on a site that expects one account per person. Sometimes it is harmless, and sometimes it is how free trials, welcome bonuses and referral programs get drained. Sites link such accounts by what they have in common, and the device is usually the strongest link.

Check your browser right now

Checking your browser…

Why people do it

The usual reasons are money and limits: a new-customer discount used again and again, a free trial restarted every month, referral bonuses paid to oneself, betting and casino bonuses, extra votes or reviews, a fresh account after a ban.

There are honest cases too. A family shares one laptop, colleagues use one office computer, a developer tests a shop with several test accounts.

What links accounts together

One signal alone proves little, so sites look for several of them on accounts that should have nothing in common:

The device. The browser fingerprint (canvas, WebGL, audio, fonts, screen, graphics card) stays the same when a person logs out and signs up again.
The network: the same IP address or a small range of addresses, especially outside large mobile networks.
Stored data, cookies and local storage. This is the easiest link and the easiest to clear, so people who abuse a site on purpose start with a private window or a new profile.
Contact and payment details: email addresses that differ only by a +tag or dots, throwaway mail domains, the same card or phone number.
Behavior: accounts created minutes apart, the same steps in the same order, the same delivery address.

Antidetect browsers and changed fingerprints

People who run many accounts on purpose use antidetect browsers, where each profile shows a different screen, set of fonts, graphics card name and time zone. Detection then asks whether the fingerprint adds up. A profile that claims macOS while its fonts and graphics card belong to Windows, or one that adds noise to canvas drawings, stands out even when nobody has seen it before.

Some signals come from the hardware and are hard to replace. SpoofLens draws its own WebGL scene: the real graphics card renders it whatever name the browser shows, so two profiles on one computer can still match.

Limits of device matching

Identical devices look alike. Phones of the same model with the same system version, iPhones in particular, often give the same fingerprint, and so do office computers set up from one image. Chrome and Firefox on one computer, on the other hand, give different fingerprints. A device match is a strong hint, and it needs a second signal before it means one person.

What to do about it

Use the device link to limit what can be abused: one welcome bonus or free trial per device, extra verification from the third account on a device, a manual look before paying out referral bonuses. Automatic bans hit families and shared computers. Say in your privacy policy that you check devices to prevent fraud.

The SpoofLens API returns a device ID and how many accounts used that device in the last 30 days. The ID is computed with a separate salt for each site, so a person cannot be followed from one site to another, and SpoofLens keeps only hashes for 30 days. The WordPress / WooCommerce plugin shows "N accounts on this device" next to users and orders. To compare your own profiles, the comparison matrix in a free account puts up to 10 checks side by side.

Frequently asked questions

Will a family that shares a laptop be flagged?: Their accounts will share a device. Limit bonuses per device or ask for extra verification, and the family can still use the site.
Does a private window look like a new device?: Mostly not. A private window starts without cookies, but in Chrome most of the fingerprint stays the same. Safari and Firefox add some fingerprinting protection in private windows, which changes part of it.
How many accounts on one device are suspicious?: It depends on the site. Two accounts in one household are normal; five new accounts in a day, each taking the welcome bonus, are not. Watch the numbers for a week before you set limits.