Stop benefit-account takeover
and stolen-identity signups
Benefits, tax refunds, permits, voter registration: every public portal with money or identity behind it is worked with leaked passwords, residential proxies and fake browsers. Maskbreak tells the endpoint who is really connecting, in under 150 ms — and public bodies get it with no hourly cap.
What public services face in 2026
Benefit and refund redirection
A taken-over claimant account is worth nothing until the bank details change. The login is stuffed through residential proxies, the contact email is changed so the notice never arrives, and the next payment goes to a mule account.
Stolen identities at scale
Relief and unemployment schemes are drained by bulk applications with stolen identities, each one arriving from a fresh residential address on a fresh fake-browser profile, each one passing the identity check because the identity is real — it just is not the applicant’s.
Appointment and permit scalping
Passport, visa and licensing slots are booked by automation within seconds of release and resold. Citizens see a calendar that is always full; a headless browser sees an inventory.
Participation platforms flooded
Consultations, petitions and registration drives are swamped by fake citizens during exactly the window they matter, and an election period compresses a year of abuse into a fortnight.
What Maskbreak does for you
- See the network behind every login, application and bank-detail change — residential proxy, VPN, cloud server or Tor — with the service named when known
- Detect fake browsers and automation on application and booking forms before a slot is held or a claim is filed
- Link one device to the many accounts it created — the shape of a stolen-identity batch, invisible to any check that looks at one application at a time
- Catch the new-device, proxy and automation combination on an established claimant account and hold the change instead of applying it
- Return the reasons behind every verdict, so a held payment can be explained to the citizen and the auditor, and a VPN alone is never grounds for refusal
Public bodies: no hourly cap
Every Maskbreak key starts at 1,000 visitor checks an hour, which a benefits portal reaches on the morning of payday and an election office reaches once every few years for the hours that matter. National, regional and local government, election authorities and emergency services qualify for the public-interest program, which removes that cap from the key you already have. Government domains such as .gov, .gov.uk and .gouv.fr are fast-tracked, everyone else is verified by registry and website within a business day, and a body under attack gets the cap lifted first and verified afterwards.
[ See who qualifies and apply ]
hand over an account, and login is only the first. Password reset, MFA enrolment, bank-detail and contact changes, session refresh and token creation are where a takeover actually cashes out. The endpoint-by-endpoint guide gives the rule for each, including the one that matters most here: hold the change, tell the old address, never lock a citizen out on a VPN alone.
[ Read the guide ]Where the check goes
The call site that pays first on a public portal is not login but the bank-detail or contact change, because that is the moment a takeover turns into a payment. Evaluate there and hold on review rather than refusing. Then login and password reset, then the application form itself, where passing accountId is what exposes one device behind a batch of stolen identities.
// Bank-detail change on a benefits account: the moment a takeover cashes out const verdictRes = await fetch('https://maskbreak.com/v1/evaluate', { method: 'POST', headers: { 'Authorization': 'Bearer ' + process.env.SENTINEL_KEY, 'Content-Type': 'application/json' }, body: JSON.stringify({ token: req.body.monocle, fingerprintEventId: req.body.sentinel_fp, accountId: claimant.id }) }); const risk = await verdictRes.json(); if (risk.decision === 'block') return refuseAndNotifyOldAddress(claimant, res); // 'review' or a first-seen device: accept the change into a 24-hour hold and // tell the OLD address and phone, with a cancel link. Nobody is locked out. if (risk.decision === 'review' || risk.device?.times_seen === 1) return holdChange(claimant, req.body, res); applyChange(claimant, req.body, res);
The signals that matter for public services
Network context on every application. Stolen-identity batches and stuffing runs rent rotating residential proxies so that every application arrives on a clean home address in the right country. Maskbreak classifies the network behind each request — residential proxy, VPN, cloud server, Tor — so a batch reads as hundreds of never-seen devices arriving through rotating residential exits, not hundreds of citizens.
One device, many identities. The identities in a relief-fraud batch are real, which is why identity verification passes them. What is not real is the claim that they are different people: the same hardware, the same fake-browser profile family, the same rhythm. Device linking is keyed per customer and hash-only, so it ties one machine to the accounts it created on your portal and nowhere else.
The takeover shape on an established account. A claimant who has signed in from the same laptop for a year suddenly authenticates from a first-seen device, over a proxy, and changes bank details within minutes. Any one signal is survivable; the combination on an established account is the pattern worth holding for a day and telling the old address about.
Reasons an auditor can read. Every verdict carries its reasons, retention is published, IP addresses are hashed after seven days, and the API identifies connections and devices, never people. That is the property a public body should demand of any fraud control, and the one that makes a held payment explainable to the citizen it affected.
Common questions
review, never block, and your code decides what review means. For a public service the honest options are a step-up such as a one-time code, or allow-with-logging; refusing on a VPN alone is neither necessary nor recommended.Protect the portal before payday
Free: 1,000 checks an hour, no card, no expiry. Public bodies, election authorities and emergency services can apply to have the cap removed.