Glossary of Online Fraud
The dregs of internet society — scammers, spammers, freeloaders, bad bots, and other abusers — employ a whole arsenal of dirty tricks to exploit your free trials, wreck your metrics, harm your legitimate users, ratchet up your costs, and generally cause trouble on your site.
This glossary defines some of the tricks and techniques favored by these lowlifes, plus some ways to defend against them. Each entry explains the term, why it matters when you run an online product or community, and how to detect and combat the problem.
Account Takeover
An attacker gains control of a legitimate user's account. How Dregs spots the change in device, location, credentials, and behavior.
Anti-Detect Browser
A browser that gives every profile a different, convincing device fingerprint, and the clues it still leaves behind.
Ban Evasion
Returning after being shown the door. Why email and IP bans don't hold, and how to recognize the same user under a new account.
Behavioral Analytics
Reading patterns across an account's activity rather than judging one event in isolation. How Dregs finds suspicious changes and repeated behavior.
Bot Detection
Separating useful automation from bots that create accounts, scrape content, test credentials, or abuse your product.
Bot Farm
A pool of automated accounts run as one resource. How it differs from a botnet, and what gives the coordination away.
CAPTCHA Alternatives
Identifying automation without forcing every legitimate user to solve a puzzle. How the Humanity score evaluates activity continuously.
CAPTCHA Solver Farm
A service that answers CAPTCHAs by the thousand for a few dollars, and why that makes CAPTCHA a toll rather than a barrier.
Credential Stuffing
Attackers test stolen username and password pairs against your login page at scale. How Dregs catches the campaign and the accounts it compromises.
Device Fingerprinting
Recognizing a browser and device from the characteristics they reveal. How Dregs uses fingerprints alongside network, identity, and behavior.
Disposable Email Address
A temporary inbox that lasts just long enough to receive a confirmation link, and what it means for your signup form.
Duplicate Accounts
One person operating several accounts to multiply a benefit or evade a restriction. How Dregs connects accounts that are trying to look unrelated.
Fake Signups
Fabricated profiles and junk registrations that pollute your user table and distort growth metrics. How Dregs evaluates each signup.
Fraud Detection
Finding suspicious accounts and activity before abuse becomes expensive. How Dregs combines identity, device, network, and behavioral evidence.
Fraud Scoring
Turning many abuse signals into scores your application can act on. How Dregs scores Humanity, Authenticity, Uniqueness, and Behavior separately.
Free Trial Abuse
The same person repeatedly claiming a trial under fresh accounts. How Dregs links the new signup to the trials that came before it.
Headless Browser
A browser controlled through code rather than by a person clicking through a visible interface. How Dregs detects the automation it leaves behind.
Identity Graph
A map of accounts and the evidence connecting them. How Dregs exposes duplicate accounts, fraud rings, and other coordinated activity.
Identity Stitching
Connecting fragments that belong to one operator, even when the accounts are trying to look unrelated. How Dregs finds the evidence between them.
Impossible Travel
One account, two places, and not enough time to get between them. What the signal catches and why VPNs make it noisy.
Multi-Accounting
Operating several accounts at once to stack rewards, trials, votes, or other benefits. How Dregs detects the shared operator behind them.
Phone Farm
A rack of real handsets operated together, so one party's activity looks like the activity of a great many people.
Plus Addressing
One inbox, unlimited addresses. Why blocking the feature backfires, and how to handle the duplicates instead.
Referral Fraud
Fraudsters refer their own fake accounts to collect rewards from both sides. How Dregs connects the referrer to the fictional friends being referred.
Sock Puppet Account
A second or third identity posing as a different person, so one voice can sound like a consensus or to lend false credibility.
Trialmaxxing
The practice of never letting a free trial end: how the trialmaxxing pattern works and how SaaS teams can stop the freeloading.
UEBA and UBA
Using behavior to find activity that does not fit an account's history or its peers. How Dregs applies the approach to your external users.
User Risk Scoring
Measuring the risk attached to each user rather than one transaction or IP address. How Dregs produces four scores with the evidence behind them.
Velocity Checks
Counting how often something happens, and why a threshold on its own isn't enough to keep repeat abuse in check.