Fifty thousand new signups is a growth chart. It is not a headcount. Some slice of every platform's "users" is the same few operators wearing different names, and every one of those accounts, inspected on its own, looks fine. That is the defining property of multi-accounting: the fraud is invisible at the account level because the account is not the unit of fraud. The operator is. This guide covers who runs duplicate accounts and why, the toolkit that makes one person look like fifty, and the signals, most of them at the network layer, that collapse the ring back into a single actor.
One behavior, five names
Communities keep renaming the same act, which is worth knowing because the detection literature is split across all five terms:
| Term | Where it's used | The scheme |
|---|---|---|
| Multi-accounting | Fraud & trust-and-safety teams | One operator, many accounts, any motive |
| Sockpuppetry | Forums, wikis, social platforms | Fake personas backing each other up or evading bans |
| Smurfing | Competitive gaming | Experienced players on fresh accounts to dodge rank or bans |
| Gnoming | Betting & iGaming | Duplicate accounts to re-claim bonuses and dodge limits |
| Sybil attack | Crypto & distributed systems | Many pseudonymous identities to capture rewards or influence |
The motives map to money almost everywhere: re-farming the incentives covered in promo and coupon abuse detection, evading bans and rate limits, inflating reviews and votes, self-dealing on marketplaces (buying from yourself, reviewing yourself), and capturing per-identity rewards like airdrops, where single operators have run tens of thousands of wallet "identities" against one distribution.
The toolkit: how one person becomes fifty
OWASP classifies the industrial version as OAT-019 Account Creation, bulk account creation "for subsequent misuse", and the supporting tooling is cheap and legal to buy:
- Email aliasing and disposable inboxes. Plus-addressing, dot-tricks, and burner domains make "unique" emails free at any volume.
- Phone farms and VoIP numbers. SMS verification is a speed bump priced in cents per code.
- Anti-detect browsers and device farms. Per-profile fingerprint spoofing makes each account present as distinct hardware, which is one reason device fingerprinting needs IP intelligence beside it.
- Proxy and VPN rotation. Each account gets its own exit IP: datacenter if the ring is lazy, residential if it is invested (see why residential proxies dominate abusive traffic).
The scale this enables is public record. Meta reports acting on around a billion fake Facebook accounts per quarter, 1.1 billion in Q4 2025 alone, with most blocked within minutes of creation (Meta Community Standards Enforcement Report). Fake-account creation is not an edge case anywhere; it is a manufacturing industry.
Why per-account checks keep missing it
Signup-time checks inspect accounts one at a time, and one at a time the accounts are clean: valid email, verified phone, plausible name, working card. Multi-accounting only becomes visible in the relationships between accounts, and operators are demonstrably bad at severing those relationships.
The strongest evidence comes from a WWW 2022 study of 8,551 verified ban-evasion pairs on Wikipedia (Characterizing, Detecting, and Predicting Online Ban Evasion). Evaders actively tried to look different, with new usernames and toned-down language, yet stayed measurably themselves: their new accounts edited the same pages (overlap 0.12 vs. 0.0001 for unrelated pairs), reused similar vocabulary, and could be matched back to their banned parent account with a mean reciprocal rank of 0.969, which is near-perfect re-identification from behavior alone. Detection at ban time reached 0.902 AUC. People change identifiers; they do not change habits.
That finding generalizes: the ring that varies its emails forgets to vary its subnet; the one that rotates proxies keeps identical active hours; the one that spoofs fingerprints funds every account from one wallet. Coordination leaks. Your job is to log the surfaces it leaks onto.
The network signals that collapse the ring
Identity fields are the easiest thing to fake and network position is the hardest, which is why IP risk scoring sits at the center of multi-account detection:
Shared origin, correctly keyed. Multiple accounts registering or acting from one IPv4 address is the classic tell, but on IPv6 you must key on the /64 prefix, because a single subscriber controls the whole prefix and can mint a fresh address per account for free (rate-limiting IPv6 by /64). Rings that would never reuse an IPv4 address happily reuse a /64.
Consumer actions from non-consumer infrastructure. Real users sign up from residential and mobile connections; account factories run on cloud instances and VPS ranges. A cluster of "independent" accounts originating from datacenter IP space, or from a single hosting ASN, is a script with a spreadsheet of personas.
Anonymization as a batch property. One user on a VPN is Tuesday; privacy tools are mainstream. Forty new accounts in one cohort all arriving through VPN or proxy exits, especially the same provider's pool, is a coordination signature. The flag matters most in aggregate and at sensitive moments: registration, bonus claims, votes, reviews.
Residential proxy pools. Invested rings rent residential exits so each account arrives on a believable household IP. Those pools are identifiable, and their appearance on fresh accounts is a strong prior that someone is paying money to look uncoordinated.
Correlated timing and impossible geography. Accounts that wake, act, and sleep in lockstep, or that claim to be fifty users who somehow migrate cities together, cluster on timing and geolocation even when every other identifier differs.
The caution that keeps you honest. Carrier-grade NAT parks hundreds or thousands of genuine subscribers behind one address, and Cloudflare measured CGNAT IPs getting rate-limited about 3x more often than comparable traffic despite similar bot rates (Cloudflare). Households, dorms, and offices share IPs legitimately, and roughly one in four internet users runs a VPN (Security.org). A shared or anonymized origin is a clustering key, never a verdict.
A detection playbook that targets the operator
- Log cluster keys at signup and at sensitive actions. IP and /64 prefix, ASN and connection type, anonymization flags, device fingerprint, payment instrument. Multi-accounting is confirmed at bonus claims, votes, and withdrawals more often than at registration.
- Build the graph, then read it. Link accounts sharing two or more independent keys. One shared key is life (CGNAT, one household); two or more independent families of overlap, like network plus payment or network plus device, make a ring hypothesis worth a look.
- Adjudicate clusters, not accounts. Reviewing fifty accounts one at a time costs fifty investigations and misses the point. Queue the cluster as a single case with its shared keys on top.
- Respond in graduated steps. For suspected clusters: withhold incentives, cap referral payouts, restrict votes and reviews, delay withdrawals. Reserve mass bans for corroborated rings. The same threshold discipline you use for fraud scores applies to cluster actions.
- Sweep retroactively. Rings optimize against the checks you ran at signup, not the ones you run later. Periodic re-clustering over the accumulated log is how airdrop sybil hunts recovered millions after distribution, and it is how you catch the ring that got in clean.
- Watch the recidivists. Ban evasion is multi-accounting with a grudge, and the research above says evaders return more camouflaged but still linkable. Compare fresh signups against recently banned accounts' keys as a standing job.
How GeoIPHub answers it
The clustering keys above come back from a single lookup per IP: asn, asn_type, and connection_type separate residential and mobile consumers from datacenter and hosting origins; the detection block flags VPN, proxy, Tor, and relay exits with proxy_type, anonymity_level, and, where a commercial provider is identified, the vpn_provider name, so "forty accounts, one VPN pool" is a query instead of a hunch; is_cgnat marks shared carrier addresses so households never get treated as rings; and the explainable 0-100 fraud score arrives with a recommended_action and the exact signals that fired, including exonerating ones. Every field ships on the free tier at 1,500 lookups per day, which is enough to score every signup and sensitive action on most platforms, and you can look up any IP without an API key to see the response shape first.
Where this fits in your fraud stack
Multi-accounting is the engine underneath several frauds that look distinct on a dashboard: it powers the incentive farming in promo abuse, supplies the persona churn behind account takeover and credential stuffing, and hides inside the anonymized traffic covered in how VPN and proxy detection works. Build the cluster log first. Every one of those defenses gets sharper the moment your platform can ask not "is this account risky?" but "how many of my users is this person?"
Frequently Asked Questions
What is multi-accounting?
Multi-accounting is one person or group operating multiple accounts on a platform that expects one account per user. Depending on the community it is called sockpuppetry (forums and wikis), smurfing (competitive gaming), gnoming (betting and iGaming), or a sybil attack (crypto and web3). Motives range from farming signup bonuses and referral payouts to evading bans, manipulating reviews and votes, and laundering marketplace feedback.
How do websites detect multiple accounts from the same person?
Platforms correlate what accounts cannot help sharing: network origin (the same IP address or IPv6 /64 prefix, the same VPN or proxy exit pool), device and browser fingerprints, payment instruments, contact details and their aliases, and behavioral patterns like identical active hours or interaction sequences. No single signal is conclusive, so detection works by clustering accounts that share several of these keys and reviewing the cluster as one case.
Does using a VPN hide multi-accounting?
It defeats naive same-IP checks, but it introduces its own signal: commercial VPN and proxy exits are identifiable as such, so a batch of 'unrelated' new accounts all arriving through anonymized infrastructure is itself a coordination indicator. Research on ban evasion also shows operators remain linkable through behavior. In a study of 8,551 Wikipedia ban evasion pairs, the evading account could be matched back to its banned parent with near-perfect accuracy from edit patterns alone.
Is multi-accounting illegal?
Usually it is a terms-of-service violation handled by suspension rather than a crime. It crosses into criminal territory when combined with identity theft, forged documents, or schemes to obtain money by deception. US prosecutors have brought wire fraud and aggravated identity theft charges against rings that mass-created accounts to farm referral bonuses. For regulated industries like iGaming, duplicate accounts can also create compliance exposure for the operator.
How do I stop multi-accounting without punishing shared networks?
Never treat a shared IP alone as proof, because carrier-grade NAT, campus networks, offices, and families legitimately put many real users behind one address. Check for a CGNAT flag and connection type before acting, require corroboration across independent signal families (network plus device plus payment plus behavior), and respond in graduated steps: withhold incentives and restrict privileges for suspected clusters, and reserve account bans for corroborated rings.
