On this page
Multi-accounting is a common and expensive abuse pattern for SaaS platforms, marketplaces, and gaming sites. One person creates dozens or hundreds of accounts to exploit free trials, promotions, referral programs, or voting systems.
Why It's Hard to Stop
Traditional approaches fail because fraudsters have evolved:
- Email aliases: Gmail's dot trick (j.ohn vs john) and + aliases create unlimited email addresses
- Residential proxies: Each account appears to come from a different home IP — clean, no flags
- Antidetect browsers: Tools like Kameleo and GoLogin create unique device fingerprints for each account
- VPNs: Cheap VPN subscriptions provide thousands of IP addresses
Each control has blind spots on its own: residential proxies weaken IP rules, aliases weaken email deduplication, challenge solvers weaken CAPTCHAs, and antidetect tools target basic fingerprints.
What Actually Works
The solution is layered detection — combining multiple signals that are hard to fake simultaneously:
- Device fingerprinting + tampering detection: Detect if the browser fingerprint is spoofed (antidetect browsers leave detectable traces even when spoofing)
- Network intelligence: Flag VPNs, proxies, and residential proxy networks
- Account velocity: Compare signup timing and reuse patterns in your own application.
- Pseudonymous account linking: Pass your own non-identifying
accountIdto measure distinct accounts associated with a device.
Run your own signup or checkout traffic through this: the free scanner returns the same verdict the API does.
Open the scannerImplementation with Maskbreak
Maskbreak returns network and device signals in one API call; your application can combine them with its own account and behavioural context. When a user signs up:
- The Maskbreak SDK collects a security token (invisible to the user)
- Your backend sends the token to
POST /v1/evaluate - Maskbreak returns whether the connection is suspicious + a persistent visitor ID
- You check if that visitor ID has already created an account
Use isSuspicious, reason codes, and linked-account counts to choose between allow, review, or step-up verification. Avoid blocking on one signal without measuring false positives.
Results
Measure the result against a labelled holdout: duplicate-account rate, review rate, false positives, and promotion loss. Layered signals make evasion more expensive, but no detector is perfect and thresholds should be tuned on your own traffic.
Try it free at maskbreak.com — 1,000 requests/hour, no credit card required.
Update: linking is still the counter, and the tool list still does not matter
The main argument here has held up, and the antidetect market since publication makes it stronger. New products keep appearing — Octo Browser, MoreLogin, VMLogin, Hidemyacc — and each arrives with the same claim of undetectability.
Chasing per-tool signatures does not pay off: the category has low barriers to entry, vendors rebrand constantly, and a signature keyed to one build breaks at the next release. What does not break is correlation. An operator's goal is not to look like one convincing user but like two hundred separate ones, so the decisive question is whether forty accounts across forty residential exits trace back to one environment. The second-tier write-up covers the structural weakness the whole category shares.
One constraint worth restating: linking of this kind belongs strictly inside a single business's own data. Correlating device identity across unrelated companies is a privacy boundary, not a feature.
Questions people ask
- How do you prevent multi-accounting?
- Multi-accounting is best prevented at the device layer. IP blocking is ineffective since users share IPs (NAT, offices) and fraudsters use proxies. Device fingerprinting links multiple accounts to the same device even when different emails, IPs, and browsers are used. Maskbreak provides persistent device identity.
- Can someone create multiple accounts using a VPN?
- Yes, if only IP-based detection is used. Maskbreak detects VPN and proxy usage directly, and also links accounts by device fingerprint — so even if a user switches IPs, their device identity remains consistent.
- What is the best API to detect fake signups?
- Maskbreak detects the signals that indicate fake signups: antidetect browsers (used to spoof device identity), residential proxies (used to bypass IP blocks), and bot automation (used for bulk account creation). It catches multi-accounting attempts that bypass email verification.
- Does Maskbreak detect the same device across different browsers?
- Maskbreak's device fingerprinting uses hardware-level signals that persist across browser sessions. Even when a user switches browsers, clears cookies, or uses incognito mode, consistent hardware signals allow device linking.
Put the check where the attack enters
One call before signup, login or checkout returns decision, risk_score and the reasons behind them. The free tier is 1,000 requests an hour, no card required. Start with <a href="/vpn-detection">VPN detection</a> and <a href="/proxy-detection">proxy detection</a>, the network layer most attacks lean on.