Detect multiple accounts from the same person

Multi-accounting is one person holding several accounts on purpose: to stay inside a free tier, to start another trial, to farm a referral bonus, or to come back after you removed them. Every account looks new, because making an account look new is the easy part.

Where it shows up

Per-seat pricing invites it: five accounts on a free tier cost less than one paid team, so somebody will try. Usage limits invite it harder, because a fresh account is a fresh allowance of whatever you were metering. Referral credit invites it most of all, since the abuser is both the referrer and the friend.

Ban evasion is the version that hurts most. You removed an account for a reason, and a new one appears the same afternoon. Without linking you have no way to know it is the same person, so you remove it again, and again, while they cost you support time on every round.

Why a new email address is not a new person

Most multi-accounting starts with the address, because it is the field you check. Plus tags, inserted dots, a throwaway domain, or a second real mailbox that takes a minute to create. Checked literally, all of those are different strings and all of them pass.

Canonicalizing first changes the answer. Strip the tag, fold the dots where the provider ignores them, lower the case, and a set of addresses that looked unrelated collapses onto the mailbox they all reach. Store the result hashed and keep the raw address encrypted, so linking works without keeping a plain-text list of everyone who ever signed up.

A determined person still gets past the address on its own. They rarely get past the address, the device and the network at once, which is the point of linking on more than one identifier.

What actually links two accounts

Identifiers are not equal, and treating them as equal is how a fraud tool ends up denying a whole university. Some identify a person. Some identify a place. One strong identifier is enough to link; the weak ones need corroboration.

Card fingerprint: The strongest link there is, because a card belongs to a person rather than a place. Read from your own Stripe account, so the number never reaches us. One fingerprint across two accounts is nearly always one person.
Device token: A signed reference held by the browser plus a device hint computed from what the browser will tell you. Survives a cleared cookie jar. Strong, but shared laptops exist, so it is never the whole story.
Canonicalized email: The address with the plus tag removed and the dots folded where the provider ignores them. This is what turns a wall of unique looking addresses back into the one mailbox they all deliver to.
Subnet: A /24 rather than an address, because addresses rotate. Weak on its own: an office, a campus and a coffee shop all look like one subnet, so it needs company before it links anything.

Linking also has to stop somewhere. OneTrial walks the accounts directly connected to a signup and the accounts connected to those, then stops. Following the chain further makes for an impressive diagram and eventually joins half your customer base into one cluster, at which point the cluster tells you nothing.

What to do once you can see the cluster

Seeing it is most of the work, and it changes what you can decide. A signup with no history of its own, linked to four accounts that each consumed a trial, is a different decision from the same signup considered alone.

Then answer proportionally. Ask a borderline cluster for one proof rather than blocking it: a card authorisation, an email link, or a captcha. Reserve a hard block for the cases where several independent kinds of evidence agree. Someone genuinely new clears a challenge in seconds, and someone on their fifth account usually will not bother.

Expect to be wrong sometimes and make being wrong cheap. Households share devices, colleagues share networks, and one of your own staff will eventually get challenged during a demo. Mark it, let them through, and write a rule so the same shape does not cost you the same customer twice.

See it on your own signups

OneTrial links accounts as they arrive and shows you the cluster behind any decision, including what each linked account was told. New workspaces run in shadow mode, so you can read a week of your own traffic before anything is enforced.

Start free See a decision assemble