Multi-accounting is a common and expensive abuse pattern for SaaS platforms, marketplaces, and gaming sites. One person creates dozens or hundreds of accounts to exploit free trials, promotions, referral programs, or voting systems.
Why It's Hard to Stop
Traditional approaches fail because fraudsters have evolved:
Email aliases: Gmail's dot trick (j.ohn vs john) and + aliases create unlimited email addresses
Residential proxies: Each account appears to come from a different home IP — clean, no flags
Antidetect browsers: Tools like Kameleo and GoLogin create unique device fingerprints for each account
VPNs: Cheap VPN subscriptions provide thousands of IP addresses
Each control has blind spots on its own: residential proxies weaken IP rules, aliases weaken email deduplication, challenge solvers weaken CAPTCHAs, and antidetect tools target basic fingerprints.
What Actually Works
The solution is layered detection — combining multiple signals that are hard to fake simultaneously:
Device fingerprinting + tampering detection: Detect if the browser fingerprint is spoofed (antidetect browsers leave detectable traces even when spoofing)
Network intelligence: Flag VPNs, proxies, and residential proxy networks
Account velocity: Compare signup timing and reuse patterns in your own application.
Pseudonymous account linking: Pass your own non-identifying accountId to measure distinct accounts associated with a device.
Implementation with Maskbreak
Maskbreak returns network and device signals in one API call; your application can combine them with its own account and behavioural context. When a user signs up:
The Maskbreak SDK collects a security token (invisible to the user)
Your backend sends the token to POST /v1/evaluate
Maskbreak returns whether the connection is suspicious + a persistent visitor ID
You check if that visitor ID has already created an account
Use isSuspicious, reason codes, and linked-account counts to choose between allow, review, or step-up verification. Avoid blocking on one signal without measuring false positives.
Results
Measure the result against a labelled holdout: duplicate-account rate, review rate, false positives, and promotion loss. Layered signals make evasion more expensive, but no detector is perfect and thresholds should be tuned on your own traffic.
Try it free at maskbreak.com — 1,000 requests/hour, no credit card required.
Update: linking is still the counter, and the tool list still does not matter
The main argument here has held up, and the antidetect market since publication makes it stronger. New products keep appearing — Octo Browser, MoreLogin, VMLogin, Hidemyacc — and each arrives with the same claim of undetectability.
Chasing per-tool signatures does not pay off: the category has low barriers to entry, vendors rebrand constantly, and a signature keyed to one build breaks at the next release. What does not break is correlation. An operator's goal is not to look like one convincing user but like two hundred separate ones, so the decisive question is whether forty accounts across forty residential exits trace back to one environment. The second-tier write-up covers the structural weakness the whole category shares.
One constraint worth restating: linking of this kind belongs strictly inside a single business's own data. Correlating device identity across unrelated companies is a privacy boundary, not a feature.
FAQ
Frequently Asked Questions
How do you prevent multi-accounting?
Multi-accounting is best prevented at the device layer. IP blocking is ineffective since users share IPs (NAT, offices) and fraudsters use proxies. Device fingerprinting links multiple accounts to the same device even when different emails, IPs, and browsers are used. Maskbreak provides persistent device identity.
Can someone create multiple accounts using a VPN?
Yes, if only IP-based detection is used. Maskbreak detects VPN and proxy usage directly, and also links accounts by device fingerprint — so even if a user switches IPs, their device identity remains consistent.
What is the best API to detect fake signups?
Maskbreak detects the signals that indicate fake signups: antidetect browsers (used to spoof device identity), residential proxies (used to bypass IP blocks), and bot automation (used for bulk account creation). It catches multi-accounting attempts that bypass email verification.
Does Maskbreak detect the same device across different browsers?
Maskbreak's device fingerprinting uses hardware-level signals that persist across browser sessions. Even when a user switches browsers, clears cookies, or uses incognito mode, consistent hardware signals allow device linking.
Put this into practice with Maskbreak’s IP Reputation API — free tier, no card.