CashoutGuard: fraud prevention for rewards, GPT, faucet, PTC and offerwall sites.

Stop multi-accounts and VPN farmers before they cash out

Fraud detection for rewards sites, GPT and offerwall publishers. Catch multi-accounts, VPNs, emulators and bots before cashout. Install in 5 minutes, free up to 1,000 users.

Live in 5 minutes

No SDK to maintain, no sales call. Add a script, send one value to your server, ask for a decision.

  1. Add the script. One tag with your public key on the pages where users sign up, log in, click offers or cash out.
  2. Collect at key moments. Call collect() and send the request_id to your server with the form.
  3. Ask for a decision. Your server calls /v1/evaluate and gets allow, review or block, a 0-100 score and readable reasons.

New sites start in shadow mode: you see every score, nobody gets blocked until you switch to enforce.

Where rewards sites lose money

Every fake account that cashes out is money you paid for nothing. Then the offerwall reverses the conversion and you pay again.

  • Multi-accounts. One person, twenty accounts, twenty signup bonuses and twenty referral payouts.
  • VPN farms. Datacenter and VPN IPs posing as users in high-paying countries to unlock better offers.
  • Emulators and VMs. Android emulators and virtual machines grinding app-install offers around the clock.
  • Bots and scripts. Headless browsers and automation tools that sign up, click and complete tasks without a human.
  • Reversals and chargebacks. Offerwalls reverse fraudulent conversions weeks later, after you already paid the user.
  • Network bans. Send too much bad traffic and ad networks cut your rates or close your account.

Built around the rewards funnel

Offer click, postback, cashout. We watch the whole path, not just the login form.

  • Cashout review queue. Every cashout arrives scored. Approve, hold or deny with the evidence in front of you, and ban the whole cluster in one click.
  • Linked-accounts graph. See which accounts share a device, payout address or email. Fraud rings stop hiding behind new usernames.
  • Offer speed and velocity. Flags offers completed faster than real players can, duplicate transaction IDs and conversion bursts.
  • Shadow mode. Score everything without blocking anyone. Switch to enforce when you trust the numbers.
  • Rules and lists. Your own allow and block lists, and rules on top of the score.
  • Webhooks. Get a signed POST the moment an account turns into a block, so your backend can freeze balances before the next cashout.

55 reason codes. Every decision explains itself.

Each score comes with the reasons behind it, in plain language, in your dashboard and in the API response. Plus your own allow and block lists.

Network

  • ip_tor: Tor exit node
  • ip_vpn: VPN connection
  • ip_datacenter: Datacenter / hosting IP
  • timezone_mismatch: Browser timezone does not match IP location
  • webrtc_ip_leak: Real IP leaked in another country
  • ip_multi_timezone: Same IP used with many different timezones (proxy exit)
  • proxy_farm_ip: Several accounts on one IP, all with the same foreign clock (shared proxy)
  • privacy_relay: iCloud Private Relay (privacy feature)
  • proxy_headers: Request came through a proxy
  • geo_sources_disagree: Geolocation sources disagree
  • ip_shared_with_accounts: Same IP used by other accounts today
  • country_changed: Country changed
  • locale_country_mismatch: Browser language from another country
  • phone_country_mismatch: Phone from another country than the IP
  • ip_flagged_on_network: IP blocked on other websites

Device

  • device_shared_with_accounts: Device shared with other accounts
  • automation_detected: Bot or automation tool
  • auto_clicker: Auto-clicker on the phone
  • scripted_behavior: Scripted page use
  • emulator_or_vm: Emulator or virtual machine
  • browser_tampering: Browser tampering / spoofing
  • device_rooted: Rooted phone
  • incognito: Private browsing
  • device_spoofed: Fake phone model
  • emulator_profile: Emulator default profile
  • cloud_phone: Cloud phone
  • phone_farm_display: Phone farm display
  • device_market_mismatch: China-only phone abroad
  • storage_cleared_reappeared: Cleared cookies and came back
  • no_device_data: No device data sent
  • request_reused: Device token reused by another account
  • device_farm_proxy: Phone farm on residential proxies

Account

  • payout_address_shared: Payout address used by other accounts
  • email_disposable: Disposable email
  • email_shared: Same email as another account
  • phone_shared: Phone number shared by other accounts
  • phone_voip: VoIP or virtual phone number
  • phone_invalid: Invalid phone number
  • many_devices_per_account: Too many devices on one account
  • flagged_on_network: Blocked on another website protected by CashoutGuard

Behavior

  • offer_completed_too_fast: Offer completed impossibly fast
  • conversion_velocity: Too many conversions per hour
  • conversion_without_click: Conversion with no click from your wall
  • click_conversion_country_mismatch: Clicked in one country, converted in another
  • offer_country_mismatch: Offer country differs from the user’s
  • click_velocity: Too many offer clicks in a few minutes
  • earnings_spike: Earnings far above a normal user
  • source_high_reversals: Source with many chargebacks
  • offer_high_reversals: Offer with many chargebacks
  • duplicate_transaction: Duplicate transaction ID
  • offer_repeated_other_publisher: Same offer already done through another publisher
  • offer_repeated_other_account: Same offer already done by another account on this device
  • cashout_velocity: Too many cashouts per day
  • new_account_cashout: Cashout from a brand-new account

Your lists

  • blocklisted: On your blocklist

Simple pricing that grows with you

Every plan includes all signals. Start free, upgrade when you need the cashout queue and team tools.

  • Free (Try it on a live site): $0/mo, 1,000 monthly active users. History: 7 days. Sites: 1. All signals and reason codes, Shadow mode.
  • Starter (Small rewards sites): $29/mo, 25,000 monthly active users. History: 30 days. Sites: 1. All signals and reason codes, Shadow mode, Cashout review queue, Alerts, Linked-accounts graph, Offer speed and velocity, 3 custom rules.
  • Growth (Growing GPT and offerwall sites): $79/mo, 100,000 monthly active users. History: 90 days. Sites: 3. All signals and reason codes, Shadow mode, Cashout review queue, Alerts, Linked-accounts graph, Offer speed and velocity, Webhooks, Unlimited rules.
  • Pro (Networks and multiple sites): $199/mo, 400,000 monthly active users, then $1.00 per 1,000 extra. History: 1 year. Sites: 10. All signals and reason codes, Shadow mode, Cashout review queue, Alerts, Linked-accounts graph, Offer speed and velocity, Webhooks, Unlimited rules, Priority support.

You get every Growth feature for 14 days without entering a card. When it ends you choose a plan or stay on Free. Nothing is charged automatically.

Questions site owners ask

Will real users get blocked by mistake?

Nobody is blocked by default. New sites start in shadow mode, and every decision shows its reasons so you can check them. Weak signals such as private browsing only add a little to the score, and you can allowlist any account, IP or payout address.

What is shadow mode?

In shadow mode we score every event and return the real decision, but the action field always says allow. You watch the results in the dashboard for a few days, then switch to enforce when you trust them.

Is it GDPR friendly?

We only process what is needed to prevent fraud, which is a legitimate interest under GDPR. Emails and payout addresses are stored as hashes, the collector keeps a single random first-party ID (no advertising or cross-site tracking), and history is deleted after your plan's retention period. We sign a DPA with you, and you mention us in your privacy policy as a fraud prevention processor.

What data does the script collect?

Technical browser and device properties (screen, time zone, language, graphics and audio fingerprints, automation and emulator hints), the page URL without query string, and a random ID stored on your domain. It also counts clicks, key presses and pointer moves, and their timing, to tell people from scripts, but never which keys were pressed, form fields or page content.

Does it work in iOS and Android apps?

Yes, inside WebViews and in-app browsers. Load your page with the script and call collect() as usual. Some apps never send the scan's POST: the script then resends it as a small GET on its own, so the scan still arrives. If your app keeps a list of allowed domains, add cashoutguard.com. Some in-app browsers block storage, so expect more first-time devices there.

How fast is it?

The collector runs in the background and caps its device checks at 1.5 seconds, usually less. The server check is one API call, so you can run it right before you pay a cashout.

What if a user blocks the script?

collect() never throws. Your server can still call evaluate without a request_id, and signups or cashouts without device data get the no_device_data reason so they do not slip through.

Do I need to talk to sales?

No. Sign up, copy the snippet, and see your first scores in minutes. Upgrades and cancellations are self-serve.

Guides