You launch a generous offer: first month free, or credit for new signups. The numbers look fantastic for a week. Then you notice the signups are not converting, the credits are gone, and a lot of the new accounts share something in common.
That is multi-accounting, and it is one of the most common ways a marketing budget leaks.
The abuser's playbook
Claiming one offer fifty times means looking like fifty different people. The toolkit is cheap and well known:
- A pile of disposable email addresses, or a catch-all domain that turns one inbox into thousands.
- A VPN or proxy to change the apparent location between signups.
- Prepaid or virtual cards, each used once, so nothing links back.
Any one of these alone is something ordinary users do too. Stacked together on a fresh account grabbing a promo, they tell a clear story.
Where it breaks down
The abuser's weak point is that disposable infrastructure looks disposable. A wave of signups all arriving through the same VPN or proxy network, in a short window, using prepaid cards, is a fingerprint no genuine launch produces. You do not need to identify the individual; you need to recognise the pattern.
Screening without punishing real signups
The trick is to keep the offer frictionless for genuine customers while making repeat abuse expensive:
- Flag signups from VPN, proxy and datacenter networks for a lighter-touch check, not an outright block.
- Treat prepaid-card BINs on a promo signup as a reason for verification.
- Count claims per network, not just per email, so rotating addresses does not reset the limit.
Measure the leak first
Before changing anything, log the IP verdict and BIN type on every promo signup for a week, then see how many claims came from flagged networks and prepaid cards. For most offers the abusive share is larger than anyone expected. Fraudex gives you both verdicts from one key, so you can size the leak before you decide how hard to screen.