Detect Duplicate Accounts at Signup
One person, five accounts, all opened at your registration form. The same fellow is gaming your referral program, padding a vote count, stacking free resources, and strolling back through a ban you handed out last week. This blot on your user table is serenely confident that nobody will ever think to check. Multiple account abuse is one of the hardest patterns to catch because each signup looks perfectly normal on its own.
Dregs connects the five accounts back to the one person automatically, linking shared devices, sessions, and behavior. The Uniqueness score drops as soon as a duplicate registers, and custom rules and lists (a pipeline of AI-assisted analyzers) decide what happens next.
What Is Multi-Account Fraud at Signup?
Multi-account fraud at signup is one person registering several accounts on a SaaS product that expects one account per customer, usually with a fresh email each time. Your referral program gets gamed when the same person plays both introducer and introduced, your community features lose credibility when one enthusiast controls a dozen votes, and your per-user resource limits get bypassed by the simple expedient of becoming more users.
The core challenge is that each individual account looks legitimate. A real email address, a plausible name, an ordinary week of activity — the multi-accounter intends to be believed in all five parts. The problem only becomes visible when you zoom out and look across accounts, and most systems don't do that.
The conventional defenses like bot prevention aren't equipped for this.
| The Traditional Defense | Why It Often Fails |
|---|---|
| Phone verification | VoIP services hand out phone numbers by the dozen for pennies apiece, so a phone check proves only that the applicant can spare a few cents. As a uniqueness test it filters out almost nobody. |
| Email verification | Plus addressing, aliases, and free providers let anyone mint fresh addresses all afternoon. Every one of them verifies beautifully. |
| IP restrictions | Shared networks, VPNs, and mobile carriers mean an IP address identifies a general location and a provider, not a person. Block one and you've blocked a coffee shop. |
| Identity verification | Requiring government ID is out of the question for most platforms. The duplicate account problem is real, but rarely so real that it justifies cratering your signup conversion to solve it. |
| Manual detection | Finding duplicates by hand is a needle-in-a-haystack exercise, and the haystack grows faster than the team does. Every pair you catch suggests several you didn't. |
Multiple account abusers are typically real people making real use of your product, and these pests pass every check designed to stop bots and throwaway signups, once per account. The pattern only appears when you look across accounts for the person behind them — at which point the standing ovation turns out to be one pair of hands.
What Duplicate Accounts Cost Your Business
Multiple account creation doesn't just waste resources. It actively degrades the experience for your legitimate users and undermines the features you've built.
Distorted metrics
Your user counts, engagement stats, and growth numbers are padded by the same few people under different names. Product decisions made on those figures lead you astray.Abused programs
Per-user resource caps, referral bonuses, promotional credits, and free-tier limits all break down when one person can arrive as six and collect six times.Eroded brand trust
When users discover that reviews are manipulated, leaderboards are gamed, or votes are stuffed, they lose trust in your platform. The honest majority leaves.How to Detect Multi-Account Fraud During Signup
Detection starts with linking the new registration to accounts you already have, not with inspecting the signup in isolation. Dregs does that from several angles at once, with custom rules and lists implemented as a pipeline of AI-assisted analyzers. A fraudster can disguise one signal. Disguising device details, identity relationships, and behavior simultaneously is considerably harder.
Uniqueness Score
Device fingerprint sharing is the single strongest signal for duplicate accounts. When two accounts use the same device, the Uniqueness score for each drops sharply. Dregs does this automatically: no cookies required, just persistent hardware and browser characteristics that survive incognito mode, cache clearing, and new logins.
Identity Relationships
Dregs automatically discovers relationships between identities that share devices, IP addresses, sessions, or behavioral patterns. A second account links to the first moments after the new activity arrives, and by the fifth you have the cluster mapped. Households and shared office machines overlap for good reasons, so each link records its evidence, not a verdict.
Authenticity Score
People are creatures of habit, even when taking pains not to be. The Authenticity score detects similar name patterns, email structures, and identity data across accounts. Five accounts sharing a naming convention and an email shape are a pattern Dregs picks up on, as are randomized or keyboard-mashed entries.
Behavior Score
Duplicate accounts controlled by the same person tend to behave the same way: the same active hours, similar navigation patterns, and the same features used in the same order. The Behavior score looks at these overlapping patterns even when the accounts use different devices, filling in gaps where fingerprinting alone falls short.
Example: Catching a Multi-Accounter
Here's how Dregs would catch a multi-accounter, week by week:
No manual investigation needed... the duplicate is caught and linked almost instantly at signup, with less manual review to do afterwards.
Responding to Duplicate Accounts
Detection is only half the story. How you respond depends on your product and what the multi-accounter is up to. Dregs gives you the data to automate whichever approach fits, and keeps false positives in check: every score opens into its observations, so you can see exactly why two accounts were linked before you act.
Account merging
Use the relationship data from Dregs to link duplicate accounts together in your system. Consolidate activity, revoke duplicate bonuses, and treat the cluster as a single user going forward.
Privilege reduction
Restrict the features being abused (voting, referrals, leaderboard participation) on accounts with low Uniqueness scores, so only the specific abuse vector is shut down.
Access restriction
Block the newer accounts and keep the original. It's direct and effective, but it tells the multi-accounter exactly what got noticed, and the studious sort take that as a free lesson in tradecraft.
Extra verification
Require additional verification steps (phone, payment method, or even government identification) only for the accounts that share devices or have low Uniqueness scores.
All of these strategies work best when they're automatic. With Dregs webhooks, your application knows about duplicate accounts the moment they're detected and can even handle them without human intervention.
Duplicate account abuse often overlaps with free trial abuse, referral fraud, and promo abuse. When the extra account exists to undo a removal, that's ban evasion. Duplicate accounts are a common form of signup abuse. Dregs scores all of these patterns simultaneously, so a single integration covers multiple abuse vectors. See Uniqueness scoring for how the score is computed.
Frequently Asked Questions
Q: How do you detect multi-account fraud during signup?
A: Link the new registration to accounts you already have, rather than inspecting the signup in isolation. The strongest signal is a cookieless device fingerprint that survives incognito mode and cleared cookies. Shared IPs and sessions, similar names and email shapes, and overlapping behavior each add their own evidence. Dregs rolls those into a Uniqueness score per identity, so a second account from the same person shows up as a duplicate at registration rather than as a fresh customer. Every score opens into its observations, so you can see exactly why the accounts were linked.
Q: What is duplicate account detection?
A: Duplicate account detection is finding that several registrations on a SaaS product belong to one person, even when each signup uses a different email, name, or session. It's an operator problem, not a consumer one: the goal is to catch multi-accounting at registration before the extra accounts collect a trial, a referral bonus, or a vote. Each account usually looks legitimate on its own. The abuse is only visible across accounts, which is why per-signup checks like email verification miss it.
Q: What is multi-accounting at registration?
A: Multi-accounting at registration is one person opening extra accounts on a SaaS product that expects one account per customer, usually with a fresh email each time. The extra accounts exist to multiply a benefit (free resources, referrals, votes) or to walk back through a ban. It isn't the same as a person managing several social profiles. Detection has to happen across signups: the new registration is fine; the cluster is the problem.
Q: How do SaaS companies stop multiple account abuse?
A: Detect the cluster at signup, then act before the extra accounts collect anything. Custom rules and lists can badge linked identities, freeze a referral or trial, require extra verification, or send only the suspicious accounts to a review queue. Dregs pushes the verdict by webhook almost as soon as the duplicate registers, so the response needs less manual review than combing the user table by hand. Keep false positives in check by reading the observations before a hard block: households and offices share devices for good reasons.
Q: Will detecting duplicate accounts create false positives?
A: It can, especially when a household, a shared office machine, or a privacy-conscious customer uses the same browser. That's why Uniqueness is a score rather than a verdict, and why the response should be graduated. Dregs scores four dimensions instead of one and opens every score into its observations, so you can confirm a flag isn't a false positive before you merge, restrict, or block. Known-shared devices and trusted identities can be marked as disregarded, which removes them from cross-account analysis.
Pricing the extra accounts. When duplicate accounts are extra free trials, the trial abuse cost calculator estimates the direct cost from your volume, your own abuse rate estimate, and a cost per wasted trial.
Detect multi-account fraud during signup.
Dregs helps you catch duplicate accounts from the first shared device. Install the tracking script and Uniqueness scoring surfaces the cluster automatically.
Schedule a Demo