Can ChatGPT Detect Fake Accounts?

You pasted a signup into ChatGPT.

Name, email, maybe the user agent, and a question: is this account fake? On the clumsy ones the answer comes back useful. A keyboard-mashed name is a keyboard-mashed name.

A pasted record is one moment in one chat. The signups that burn a trial, collect a promo, and come back next week are a pattern, and a pattern needs the other accounts and the later events.

That is the gap in using a chat prompt as AI fraud detection. Dregs is one judgment layer that keeps a score on the identity as activity arrives. You can still ask the model what the score means.

What a Single Prompt Can Catch

A single prompt is a fair smell test, and it would be silly to pretend otherwise. Hand a model a name assembled by mashing the keyboard, a bio that reads like a template, and an inbox on a disposable domain that was famous when the model was trained, and the reply will usually say the account looks fake. For a handful of suspicious accounts you are already staring at, that is a reasonable use of a chat window.

The reply is a paragraph about the fields you pasted. It has read the string. It has not watched the account, and it has not met the accounts next to it. Treat the paragraph as a first impression of one form, the way you would treat a colleague glancing at a row in the user table.

Where a Single Prompt Falls Short

One-shot AI scoring, a single prompt per signup, is where the impression stops being a method. Seven limits show up together: the wait, the bill once you keep asking, a verdict that moves, a blind spot for every account you did not paste, a world that changed since training, fields the account holder wrote, and nothing that learns from the last verdict.

Cost and latency at signup

A short prompt is cheap. At OpenAI's published standard rates on October 12, 2026, GPT-5 mini is $0.25 per million input tokens and $2 per million output tokens. GPT-5 is $1.25 and $10 on the same units. A signup plus a short instruction is about 1,000 input tokens, and a short answer is about 150 output tokens. The table uses those two counts exactly, at the list prices above, with no cached input and no batch discount. That is $0.00055 on mini and $0.00275 on GPT-5.

The third column is an illustration, not a measurement of your product: twenty later events means twenty-one calls if every event gets its own prompt. Pasting into the ChatGPT app is a different purchase again, a subscription and a person, and it does not run on the signup form.

The cost that actually bites is the wait, and the bill once the prompt grows up. The call has to finish before the form can answer. That is a round trip of a second or more for a model you would trust with a judgment, and it gets worse when the provider is busy. A wave of bots is exactly when you can least afford a slow, rate-limited call on every signup.

Asking the model to go and look is a different price. Miguel Ríos Berríos describes that job in AgentRun: a harness for repetitive knowledge work (Grep.ai, September 18, 2026). Grep builds a harness for repetitive knowledge work, and the measurements below are from AML alert review. On 100 fresh alerts, a frontier-model agent cost $2.89 and a structured workflow cost $0.25. Over 100,000 alerts, with fallback and a retro every 1,000 included, the workflow cost $26K. The same alerts on the frontier model he names, Opus 5, would have cost $290K. His line on the expensive instrument is the one worth keeping: "The model that can figure anything out is the most expensive thing in the building."

A label, and a moving one

Berríos is describing a constrained model call, the same shape as a prompt that must answer fake or not, when he writes that it "answers with a label and no calibrated sense of how sure it is." He defines the missing property in plain terms: a calibrated 0.7 "is right about seven times in ten," so "the threshold is a number in code, not a feeling." A chat reply gives you the feeling. Run it again tomorrow, or after the model updates, and the same signup can come back with a different verdict. There is no stable number to put in a rule, and no record of which version of the prompt produced the block.

Reviewers eventually ask a harder question than "did the model say fake." Berríos puts it as what a model-risk team asks: "which model made it, on what inputs, under which version of the policy, and can you show me." A page of chat prose has to be reconstructed from memory. A score you can open, tied to a rule you wrote down, can be shown.

One record, and the accounts around it

Consider this fellow. Monday's signup burns the trial. Wednesday's signup has a tidier name, a fresh address, and a prompt that never saw Monday, so Wednesday looks like growth. The more ambitious and enterprising of these pests keeps a little family of accounts on one device and one network, the same inbox wearing a plus address or a few extra dots. Each form, read alone, passes a glance. Read together, it's a crowd of one.

A prompt containing one signup holds none of that crowd. A returning ban, a second trial, and a promo collected across twenty inboxes that all resolve to one person sit outside the paste. By the time the pattern is obvious to a human reading the user table, this blister has already had the free tier.

A world that moved on

Disposable domains, datacenter and proxy ranges, and the countries used for SMS pumping change every week. A model's training snapshot is a photograph of an earlier week. The domain that meant "throwaway" last quarter may be a legitimate provider now, and the domain registered yesterday is not in the photograph at all. A prompt can sound confident about both.

Fields the account holder wrote

The name, the bio, and the email are chosen by the account you are trying to judge. A model that treats those strings as instructions can be talked into a kinder verdict. You do not need a clever attacker for this to matter. You need a field, and a model that was trained to be helpful. Device, history, and a rule you control do not take orders from a bio.

Nothing learns the next verdict

A chat window ends when you close it. There is no queue for the cases a person should see, no custom rules and lists that apply the same way on the next signup, and no revision you can point to when someone asks why a user was limited. The next prompt starts from zero, with whatever the model remembers from training and whatever you remember to paste.

What Continuous Identity Scoring Adds

Continuous identity scoring keeps four scores on the account and recomputes them as events arrive. Humanity asks whether a person is behind the browser. Authenticity asks whether the profile data looks genuine. Uniqueness asks whether this is the only account. Behavior asks whether later use looks like an ordinary customer. A low score opens into its observations, so you can see exactly why that dimension moved.

The link across accounts is the part a pasted form cannot grow into. A new signup that shares a device with an account you already have is visible on Uniqueness from the first events, and confidence grows as more of the relationship shows up. IP overlap, similar profile data, and sessions that connect accounts are part of the same read. The Wednesday signup is scored with Monday still in view.

Custom rules and lists turn those scores into a label and a next step. A badge names the pattern. An escalation opens a case when a person should look, and can land in email, Slack, or a webhook. The ordinary cases stop requiring a fresh paste into a chat, which is less manual review. The ambiguous ones stay with the team. Berríos describes the same division of work in operations generally: "software automates the ordinary path and people handle the exceptions."

False positives are still possible. A privacy-conscious customer on an unusual network, or a real person with an uncommon name, can look suspicious on a single signal. Four scores keep those signals apart, and the observations are there before anyone is blocked. A graduated response keeps legitimate users in the product when a single signal is weak and the observations are thin.

The scores update moments after new activity. Obvious automation flags almost instantly. Subtler cases accumulate. Either way you are reading a current account, with a history. The form can respond while a model generation is still running somewhere else.

Dregs is priced per active identity per month. On the pricing page, Starter is $17 and includes 100 active identities, then $0.06 each. Growth is $177 and includes 5,000, then $0.05 each. Ten thousand active identities on Growth come to $427 in a month ($177 plus 5,000 at $0.05). A one-time mini prompt over the same ten thousand signups is $5.50. The prompt is the cheaper glance. The subscription is the record that stays current, including the later events, without a new token bill for each of them.

Ask the Model About a Score

The useful place for ChatGPT, Claude, or Cursor is on top of a score, explaining it and helping you work the queue. Dregs is usable entirely through your AI assistant. Connected over MCP, the assistant can read an identity and the observations behind its scores, follow links to related accounts and devices, triage escalations, and tune the badge and escalation rules. Setup for each client is in the AI agents chapter. The investigative and rule-tuning parts of the dashboard are what the assistant can reach. Billing and account settings stay in the dashboard.

That split matches the expensive-instrument point. Use the model where a case is strange enough to need a reading. Leave the ordinary path to a score and a rule. A frontier model stays off the ordinary rows, and the verdict a customer was limited on is one you can open and show.

When You Don't Need Dregs

Plenty of products should not buy this.

Tens of signups a day, and no one abusing the free tier, the trial, or the promos: a disposable-email check and email verification cover it. You will see the bad rows yourself. Spending a subscription to score a quiet waitlist is a solution in search of a mess.

A one-off investigation of a few suspicious accounts is a good job for a model. Paste them in, read the reply, and decide. It is also a good job for an assistant that can see the scores, once you have them. Either way you are researching a handful. Gating every signup is a different job.

Traffic that never becomes an account, the volumetric junk at the edge of the site, belongs with your CDN or WAF. Those tools are built to refuse a flood before your application spends time on it.

Payment fraud and chargebacks belong with the payment stack. Stripe Radar and your dispute process price the charge. Catching fake signups and freeloaders earlier in the funnel can also reduce the payment fraud that leaks downstream. Dregs sits on the account, alongside that payment check.

If what you wanted from the model was a sentence explaining a decision, keep the model. Give it a score to explain.

Frequently Asked Questions

Further Reading