Duplicate Account Detection
One person, five accounts. The same quick-change artist is gaming your referral program, padding a vote count, stacking free resources, and strolling back through a ban you handed out last week, serenely confident that nobody will ever think to check. Multiple account abuse is one of the hardest abuse patterns to catch because each account looks perfectly normal on its own.
Dregs connects the five accounts back to the one person automatically, linking shared devices, sessions, and behavior, with custom rules and lists (a pipeline of AI-assisted analyzers) to decide what happens next.
The Multiple Account Problem
Duplicate accounts crop up in all sorts of applications. Referral programs get gamed when the same person plays both introducer and introduced. Community features lose credibility when one enthusiast controls a dozen votes. Leaderboards stop meaning anything when the top three places are one player in three costumes. Per-user resource limits get bypassed by the simple expedient of becoming more users.
The core challenge is that each individual account looks legitimate. A real email address, a plausible name, an ordinary week of activity — the multi-accounter intends to be believed in all five parts. The problem only becomes visible when you zoom out and look across accounts, and most systems don't do that.
The conventional defenses like bot prevention aren't equipped for this.
| The Traditional Defense | Why It Often Fails |
|---|---|
| Phone verification | VoIP services hand out phone numbers by the dozen for pennies apiece, so a phone check proves only that the applicant can spare a few cents. As a uniqueness test it filters out almost nobody. |
| Email verification | Plus-addressing, aliases, and free providers let anyone mint fresh addresses all afternoon. Every one of them verifies beautifully. |
| IP restrictions | Shared networks, VPNs, and mobile carriers mean an IP address identifies a general location and a provider, not a person. Block one and you've blocked a coffee shop. |
| Identity verification | Requiring government ID is out of the question for most platforms. The duplicate-account problem is real, but rarely so real that it justifies cratering your signup conversion to solve it. |
| Manual detection | Finding duplicates by hand is a needle-in-a-haystack exercise, and the haystack grows faster than the team does. Every pair you catch suggests several you didn't. |
Multiple account abusers are typically real people making real use of your product. They pass every check designed to stop bots and throwaway signups, once per account. The pattern only appears when you look across accounts for the person behind them — at which point the standing ovation turns out to be one pair of hands.
What Duplicate Accounts Cost Your Business
Multiple account creation doesn't just waste resources. It actively degrades the experience for your legitimate users and undermines the features you've built.
Distorted metrics
Your user counts, engagement stats, and growth numbers are padded by the same few people under different names. Product decisions made on those figures lead you astray.Abused programs
Per-user resource caps, referral bonuses, promotional credits, and free-tier limits all break down when one person can arrive as six and collect six times.Eroded brand trust
When users discover that reviews are manipulated, leaderboards are gamed, or votes are stuffed, they lose trust in your platform. The honest majority leaves.How Dregs Detects Duplicate Accounts
Dregs doesn't rely on a single signal. It combines device fingerprinting, cross-account relationship discovery, identity analysis, and behavioral patterns to surface suspicious accounts from several angles at once.
Uniqueness Score
Device fingerprint sharing is the single strongest signal for duplicate accounts. When two accounts use the same device, the Uniqueness score for each drops sharply. Dregs does this automatically: no cookies required, just persistent hardware and browser characteristics that survive incognito mode, cache clearing, and new logins.
Identity Relationships
Dregs automatically discovers relationships between identities that share devices, IP addresses, sessions, or behavioral patterns. A second account links to the first moments after the new activity arrives, and by the fifth you have the cluster mapped. Households and shared office machines overlap for good reasons, so each link records its evidence, not a verdict.
Authenticity Score
People are creatures of habit, even when taking pains not to be. The Authenticity score detects similar name patterns, email structures, and identity data across accounts. Five accounts sharing a naming convention and an email shape are a pattern Dregs picks up on, as are randomized or keyboard-mashed entries.
Behavior Score
Duplicate accounts controlled by the same person tend to behave the same way: the same active hours, similar navigation patterns, and the same features used in the same order. The Behavior score looks at these overlapping patterns even when the accounts use different devices, filling in gaps where fingerprinting alone falls short.
Example: Catching a Multi-Accounter
Here's an example of how Dregs could help you catch an abuser with multiple accounts in your application:
No manual investigation needed... the duplicate is caught and linked almost instantly at signup, with less manual review to do afterwards.
Responding to Duplicate Accounts
Detection is only half the story. How you respond depends on your product and what the multi-accounter is up to. Dregs gives you the data to automate whichever approach fits, and keeps false positives in check: every score opens into its observations, so you can see exactly why two accounts were linked before you act.
Account merging
Use the relationship data from Dregs to link duplicate accounts together in your system. Consolidate activity, revoke duplicate bonuses, and treat the cluster as a single user going forward.
Privilege reduction
Restrict the features being abused (voting, referrals, leaderboard participation) on accounts with low Uniqueness scores. Only the specific abuse vector is shut down.
Access restriction
Block the newer accounts and keep the original. This is direct and effective, but it tells the multi-accounter exactly what got noticed, and the studious sort take that as a free lesson in tradecraft.
Extra verification
Require additional verification steps (phone, payment method, or even government identification) only for the accounts that share devices or have low Uniqueness scores.
All of these strategies work best when they're automatic. With Dregs webhooks, your application knows about duplicate accounts the moment they're detected and can even handle them without human intervention.
Duplicate account abuse often overlaps with free trial abuse and referral fraud. Dregs scores all of these patterns simultaneously, so a single integration covers multiple abuse vectors.
Stop multiple account abuse before it spreads.
Dregs detects duplicate accounts from the first shared device. Install the tracking script and cross-account relationships surface automatically.
Schedule a Demo