How to detect multi-accounts on a rewards site

Short answer

Link accounts by the signals that are hard to fake and rarely shared by strangers: the same payout address, the same device and the same normalised email. Require two independent signals before you block, never ban on the IP address alone, and make the final decision at cashout.

Strongest signal

A payout address (PayPal, wallet, gift card email) used by more than one account.

Weakest signal

A shared IP address: mobile carriers, universities and CGNAT put many strangers behind one IP.

First check to run

Group cashouts by payout address.

Where to decide

Flag at signup, decide at cashout, and ban the whole cluster, not one account.

Why multi-accounts cost more than they look

On a rewards site every account is worth money: a signup bonus, daily bonuses, referral commissions and, most of all, offer earnings. A farmer who opens twenty accounts collects all of those twenty times. If each account cashes out $5 a month, that is $100 a month paid to one person, and none of it came from real engagement.

The second cost arrives later. Offerwall networks scrub the traffic you send them. When they see many conversions from the same device or household, they reverse those conversions weeks after you already paid the user. Keep sending that traffic and the network may lower your payouts or close your account.

Referral programs make it worse. A farmer who refers their own accounts collects a commission on every offer those accounts complete, so the same fake activity is paid twice. Leaderboards and contests are hit the same way: a ring of accounts can take the top places from your real, loyal users.

The signals that link accounts

No single signal proves that two accounts belong to the same person. What works is combining several independent signals and weighing them by how hard they are to fake and how often innocent users share them.

Notice that the IP address, the signal most sites rely on, is the weakest one. Mobile carriers put thousands of customers behind a handful of IP addresses, so two strangers on the same carrier can share an IP. Payout addresses and devices are much more telling.

Manual checks you can run today

You do not need special software to find the worst offenders. A few queries against your own database will usually surface the biggest rings.

1. Group cashouts by payout address. Any address that received money for more than one account deserves a look. This single query often finds most of the fraud.
2. Normalise emails and group them. For Gmail, remove dots and anything after a plus sign, then lowercase. Then look for number sequences such as name1, name2, name3 on the same domain.
3. Group signups by IP address and day. Five signups from one IP within an hour are more suspicious than five over a month.
4. Walk the referral tree. Look for referrers whose referrals all signed up from the same IP or device and cashed out to similar addresses.
5. Compare user agents and screen sizes. Identical browser version, language, timezone and screen size across accounts created minutes apart is a pattern worth checking.

-- Payout addresses shared by more than one account
SELECT payout_address,
       COUNT(DISTINCT user_id) AS accounts,
       SUM(amount)             AS paid
FROM cashouts
WHERE status = 'paid'
GROUP BY payout_address
HAVING COUNT(DISTINCT user_id) > 1
ORDER BY paid DESC;

Rules of thumb that protect honest users

Aggressive bans cost you real users and bad reviews on forums where your future users read. These rules keep false positives low.

• Never ban on IP alone. Shared IPs are normal on mobile networks, in dorms and behind privacy relays.
• Require two independent signals before blocking, for example a shared device plus a shared payout address.
• Hold before you ban. Put the cashout on hold and ask for a quick check. Real users answer; farms usually move on.
• Treat households fairly. Two siblings on one computer are not a fraud ring. A household with ten accounts is.
• Add a waiting period for new accounts. A first cashout within hours of signup is a pattern that farms depend on.
• Ban the cluster, not the account. If you only remove one account, the other nineteen keep earning.

How farmers evade detection, and what still catches them

Experienced farmers know the basics. They clear cookies, use private browsing, rotate proxies and create fresh payout addresses. Each trick hides one signal but tends to leave another.

• Clearing cookies or private mode removes stored IDs, but the device characteristics stay the same, and a device that keeps reappearing with empty storage is itself a signal.
• Antidetect browsers change the fingerprint, but they often produce combinations no real device has, such as a phone screen with a desktop graphics card.
• Emulators and virtual machines let one computer act as many phones, but they leave traces that real hardware does not.
• Residential proxies give each account a clean home IP, but the timezone, language, device and offer timing still line up.
• New payout addresses break the strongest link, but farms still need to move money, and their accounts tend to cash out on the same schedule.

The honest summary: a browser fingerprint can be faked, so no tool can promise the same device with certainty. What makes detection work is layering signals so that evading all of them at once costs more than the fraud earns.

How CashoutGuard automates it

CashoutGuard runs these checks on every event. You add one script to your pages and call one API from your server at signup, login, offer click, conversion and cashout. Each call returns a decision (allow, review or block), a score from 0 to 100 and the reasons behind it.

{
  "decision": "review",
  "score": 72,
  "reasons": ["device_shared_with_accounts", "payout_address_shared"],
  "device": { "accounts_on_device": 4 }
}

• device_shared_with_accounts and payout_address_shared link accounts the way the manual checks above do, but on every event.
• email_shared and email_disposable catch the email tricks, with emails stored as hashes.
• The linked-accounts graph shows which accounts share a device, payout address or email, so you can ban a whole cluster in one click.
• Cashouts arrive in a review queue with the evidence in front of you: approve, hold or deny.

New sites start in shadow mode: everything is scored but nobody is blocked until you decide to enforce. The free plan covers 1,000 monthly active users with every signal. See the docs for the full integration or pricing for the plans.