[{"data":1,"prerenderedAt":1070},["ShallowReactive",2],{"glossary-index":3},[4,103,191,268,350,446,567,644,760,848,925,997],{"id":5,"title":6,"body":7,"description":90,"extension":91,"meta":92,"navigation":93,"path":94,"relatedTerms":95,"seo":98,"sitemap":99,"stem":100,"term":101,"__hash__":102},"glossary\u002F6.glossary\u002Faccount-sharing.md","What is account sharing?",{"type":8,"value":9,"toc":83},"minimark",[10,14,18,23,32,35,39,47,55,63,66,70],[11,12,6],"h1",{"id":13},"what-is-account-sharing",[15,16,17],"p",{},"Account sharing is when multiple people use a single account through one set of login credentials. The account owner hands the password to friends, family, or coworkers, and everyone uses the product under one subscription or one seat. For subscription and seat-based businesses, every shared login is a user who consumes the product without paying for their own access.",[19,20,22],"h2",{"id":21},"how-it-works","How it works",[15,24,25,26,31],{},"Unlike ",[27,28,30],"a",{"href":29},"\u002Fglossary\u002Faccount-takeover","account takeover",", account sharing is voluntary. The owner gives the password away, so no security control is bypassed and every login looks legitimate. On streaming and consumer subscriptions, it starts inside a household and drifts outward: the ex-roommate two cities away, the cousin abroad, the group chat that all watches on one plan. On seat-based SaaS, a five-person team buys one license and rotates through it, or a departing employee's login quietly keeps working for their replacement. Nobody involved thinks of it as fraud, which is exactly why it spreads.",[15,33,34],{},"The cost shows up as revenue leakage rather than a dramatic incident: flat subscriber growth while usage climbs, or seat counts that never expand even as the customer's team doubles. The obvious countermeasures, a concurrency cap and an IP check, both fall apart fast. Legitimate single users are mobile. The same person hits your app from cellular at lunch, home wifi at night, and the office network in the morning, three IPs in one day. Families share a single IP. VPNs and carrier-grade NAT put thousands of unrelated users behind one address, and can hand one sharer a fresh IP every session. Concurrency limits miss sharers who use the account at different times, which is most of them: an account split across time zones may never produce two simultaneous sessions.",[19,36,38],{"id":37},"how-to-detect-it","How to detect it",[15,40,41,42,46],{},"Reliable account sharing detection starts with counting devices, not IPs. ",[27,43,45],{"href":44},"\u002Fglossary\u002Fdevice-fingerprinting","Device fingerprinting"," gives each browser and phone a stable identifier that survives cookie clearing and network changes, so you can ask the question that actually matters: how many distinct devices used this account in the last month, and do they plausibly belong to one person? Most single users show up on a small, stable set of devices. Eight active devices spread across two operating system ecosystems tells a different story.",[15,48,49,50,54],{},"On top of device counts, watch session overlap and geography over time. Concurrent sessions from far-apart locations are a strong signal, and so is ",[27,51,53],{"href":52},"\u002Fglossary\u002Fimpossible-travel","impossible travel",": a login from Chicago forty minutes after one from Madrid. Slow patterns are often more convincing than single events. An account that resolves to two stable geographic clusters for months is almost certainly two households, not one frequent traveler. Behavior helps separate the two cases: two people produce two sets of active hours, two content tastes, and two navigation styles interleaved on one account.",[15,56,57,58,62],{},"Keep the distinction from ",[27,59,61],{"href":60},"\u002Fglossary\u002Fmultiaccounting","multiaccounting"," clear when you build rules. Sharing is many people on one account; multiaccounting is one person on many accounts. They hide behind similar evasion tools, so the same device signals expose both, but the response differs.",[15,64,65],{},"The response is where the modern approach departs from the old one. Hard blocking a paying subscriber because their partner logged in creates a support ticket and a churn risk. Most teams now treat sharers as unconverted demand: identify the extra household or extra user, then prompt them into their own plan, a paid add-on, or a proper seat, with a light verification step for the real owner. Netflix's move to paid sharing in 2023 made this the default playbook for subscription businesses.",[19,67,69],{"id":68},"how-rupt-handles-it","How Rupt handles it",[15,71,72,73,77,78,82],{},"Rupt fingerprints the devices behind each account, tracks their geography and overlap over time, and lets you set the threshold where sharing becomes likely for your product. From there you choose the response, from silent flagging to a challenge that converts the extra user into a paying one. The ",[27,74,76],{"href":75},"\u002Fsolutions\u002Faccount-sharing","account sharing solution page"," covers the approach, and the ",[27,79,81],{"href":80},"\u002Fdocs\u002Fv3\u002Fguides\u002Faccount-sharing-prevention","account sharing prevention guide"," walks through the setup.",{"title":84,"searchDepth":85,"depth":85,"links":86},"",2,[87,88,89],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"Account sharing is when multiple people use one set of login credentials. Learn how it drains subscription revenue and the signals that reveal it.","md",{},true,"\u002Fglossary\u002Faccount-sharing",[96,61,97],"device-fingerprinting","impossible-travel",{"title":6,"description":90},{"loc":94},"6.glossary\u002Faccount-sharing","Account sharing","e1ug0n2IFxcLhjzwxgkOXd7Rk-n4GbTVc8bluzTQ4nQ",{"id":104,"title":105,"body":106,"description":182,"extension":91,"meta":183,"navigation":93,"path":29,"relatedTerms":184,"seo":186,"sitemap":187,"stem":188,"term":189,"__hash__":190},"glossary\u002F6.glossary\u002Faccount-takeover.md","What is account takeover?",{"type":8,"value":107,"toc":177},[108,111,114,116,124,127,130,132,135,142,148,151,159,162,164],[11,109,105],{"id":110},"what-is-account-takeover",[15,112,113],{},"Account takeover (ATO) is an attack in which a criminal gains control of a legitimate user's account, usually by stealing or guessing the credentials that protect it. Once inside, the attacker can drain stored balances, buy things with saved payment methods, harvest personal data, or use the account as a trusted launch point for further fraud. The real owner is locked out, or worse, has no idea it happened.",[19,115,22],{"id":21},[15,117,118,119,123],{},"Most takeovers start with credentials. ",[27,120,122],{"href":121},"\u002Fglossary\u002Fcredential-stuffing","Credential stuffing"," replays username and password pairs leaked from other sites, and it works because people reuse passwords. Phishing tricks the user into typing credentials into a fake login page, and modern phishing kits proxy the real site so they capture one-time codes as the victim enters them. SIM swapping moves the victim's phone number to a SIM the attacker controls, so SMS two-factor codes arrive on the attacker's device. Session hijacking skips the login entirely: the attacker steals a valid session cookie through malware or a malicious browser extension and walks in with MFA already satisfied.",[15,125,126],{},"The cost lands in several places at once. Direct fraud losses when stored value or saved cards get spent. Chargebacks when the real owner disputes those purchases. Support load from account recovery. And churn, because a user whose account was compromised on your platform rarely trusts it again, whether or not the passwords leaked somewhere else.",[15,128,129],{},"The hard part for defenders is that a takeover looks like a successful login. The password is correct. MFA may have passed. Nothing in the authentication event itself says \"wrong person.\" The evidence is in everything around the login, not in it.",[19,131,38],{"id":37},[15,133,134],{},"Since the credentials are valid, detection depends on context.",[15,136,137,138,141],{},"A new ",[27,139,140],{"href":44},"device fingerprint"," combined with a new IP address is the strongest single signal. Most users authenticate from a small, stable set of devices and networks. An account that has only ever seen one Windows laptop on a residential ISP, and suddenly logs in from an unrecognized device behind a datacenter or VPN IP, deserves friction before it deserves access.",[15,143,144,147],{},[27,145,146],{"href":52},"Impossible travel"," catches stolen sessions and credentials used from far away: two logins whose locations cannot be reconciled with physical travel in the time between them, such as London at 09:00 and Singapore at 09:40.",[15,149,150],{},"Behavior after login matters as much as the login itself. Attackers move straight to the valuable actions: changing the account email or password, adding a payout method, redeeming stored credit, exporting data. Real users wander; attackers loot. A brand-new session that immediately touches security settings is far riskier than a month-old session doing the same thing.",[15,152,153,154,158],{},"Watch for precursors at the traffic level. A credential-stuffing wave against your login endpoint (spiking failure rates, hundreds of distinct accounts tried from a handful of IPs or fingerprints) typically precedes individual takeovers by hours or days, so ",[27,155,157],{"href":156},"\u002Fglossary\u002Fbot-detection","bot detection"," on the login route doubles as early warning. Rising password-reset and MFA-prompt volume are similar tells.",[15,160,161],{},"Email and phone signals help at the recovery layer. A request to change the account email to a freshly registered address, or the phone number to a VoIP line, is exactly the moment to step up verification rather than send a confirmation after the fact.",[19,163,69],{"id":68},[15,165,166,167,171,172,176],{},"Rupt scores every login and sensitive action using device, network, and behavioral signals, so a correct password from an unrecognized device on a risky network can be challenged or blocked instead of waved through. See ",[27,168,170],{"href":169},"\u002Fsolutions\u002Faccount-takeover","account takeover protection"," for the product overview and the ",[27,173,175],{"href":174},"\u002Fdocs\u002Fv3\u002Fguides\u002Faccount-takeover-prevention","account takeover prevention guide"," for implementation steps.",{"title":84,"searchDepth":85,"depth":85,"links":178},[179,180,181],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"Account takeover (ATO) is when an attacker gains control of a legitimate user's account through stolen credentials, phishing, or session hijacking.",{},[185,97,96],"credential-stuffing",{"title":105,"description":182},{"loc":29},"6.glossary\u002Faccount-takeover","Account takeover","eJgjXLww232hZtvImFb4lsN1cUVVOsWJNktEUfqHOFg",{"id":192,"title":193,"body":194,"description":258,"extension":91,"meta":259,"navigation":93,"path":260,"relatedTerms":261,"seo":263,"sitemap":264,"stem":265,"term":266,"__hash__":267},"glossary\u002F6.glossary\u002Fban-evasion.md","What is ban evasion?",{"type":8,"value":195,"toc":253},[196,199,202,204,207,210,216,218,224,227,230,238,240],[11,197,193],{"id":198},"what-is-ban-evasion",[15,200,201],{},"Ban evasion is the practice of returning to a platform after being banned, usually by registering a new account, switching devices, or rotating IP addresses so the platform fails to recognize the returning user. The goal is to resume whatever behavior triggered the ban: harassment, spam, cheating, fraud, or repeated terms-of-service violations. A ban that only blocks an email address or username is trivial to evade, so durable enforcement has to recognize the person and their hardware rather than the account alone.",[19,203,22],{"id":21},[15,205,206],{},"Most bans are applied at the account level, and account identifiers are cheap. A banned user signs up again with a fresh address from a free email provider, a plus-addressed alias, or a disposable domain, picks a new username, and is back inside in minutes. If the platform blocked their IP, they switch to a VPN, a datacenter proxy, or their phone's mobile connection, which assigns a new address on demand.",[15,208,209],{},"Determined evaders go further. They clear cookies and local storage, browse in incognito or anti-detect browsers, run virtual machines, or buy aged accounts from marketplaces so the replacement identity arrives with history attached. On mobile, they reinstall the app or factory reset the device to rotate app-scoped identifiers.",[15,211,212,213,215],{},"Ban evasion is a specific case of ",[27,214,61],{"href":60},": one person operates multiple identities, but the motive is escaping enforcement rather than farming incentives. The economics favor the evader as long as bans stay account-scoped, because creating a new account costs seconds while investigating and re-banning costs staff time.",[19,217,38],{"id":37},[15,219,220,221,223],{},"The strongest signal is device reuse. Cookies are easy to clear, but hardware and browser characteristics are not, so a ",[27,222,140],{"href":44}," that belonged to a banned account and reappears under a fresh signup is close to conclusive. This is the core of ban enforcement that actually holds: keep the fingerprints of banned devices and match every new session against that list.",[15,225,226],{},"Network signals come next. Watch for new accounts created from IP addresses, subnets, or ASNs already tied to banned accounts, and for signups on VPN or datacenter IPs shortly after a residential user was banned. Timing matters too. An account created minutes after a ban, from the same rough location, deserves scrutiny before it does anything at all.",[15,228,229],{},"Email and phone identifiers repeat in predictable ways: plus-addressed and dot-variant forms of a banned address, disposable email domains, sequential handles like \"mike_r2\" and \"mike_r3\", and VoIP verification numbers where the banned account used a real mobile line.",[15,231,232,233,237],{},"Behavior gives evaders away even when their technical footprint is clean. Returning users rejoin the same groups, message the same targets, keep the same timezone and language settings, and type and navigate the way they always did. Matching those traits against recently banned accounts catches the evaders who did everything else right. And because a replacement account is by definition not a genuine new user, ",[27,234,236],{"href":235},"\u002Fglossary\u002Ffake-account-detection","fake account detection"," at signup stops many evaders before their first action.",[19,239,69],{"id":68},[15,241,242,243,247,248,252],{},"Rupt fingerprints every device it sees and links new signups back to previously banned devices and networks, so a ban follows the person instead of the account. The ",[27,244,246],{"href":245},"\u002Fdocs\u002Fv3\u002Fguides\u002Fban-enforcement","ban enforcement guide"," walks through wiring this into signup and login flows, and the ",[27,249,251],{"href":250},"\u002Fsolutions\u002Fmulti-accounting","multi-accounting solution"," covers the broader problem of one person running many accounts.",{"title":84,"searchDepth":85,"depth":85,"links":254},[255,256,257],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"Ban evasion is when a banned user returns to a platform under a new account, device, or IP address. Learn how to detect and stop repeat offenders.",{},"\u002Fglossary\u002Fban-evasion",[61,96,262],"fake-account-detection",{"title":193,"description":258},{"loc":260},"6.glossary\u002Fban-evasion","Ban evasion","bJ5WBRtj-oVlIe7_Q9c_eHoB9nxJHdYagP92k3SdwWM",{"id":269,"title":270,"body":271,"description":341,"extension":91,"meta":342,"navigation":93,"path":343,"relatedTerms":344,"seo":345,"sitemap":346,"stem":347,"term":348,"__hash__":349},"glossary\u002F6.glossary\u002Fbonus-abuse.md","What is bonus abuse?",{"type":8,"value":272,"toc":336},[273,276,283,285,288,291,294,301,303,306,312,315,318,321,323],[11,274,270],{"id":275},"what-is-bonus-abuse",[15,277,278,279,282],{},"Bonus abuse is the exploitation of promotional offers, such as signup bonuses, deposit matches, free bets, and referral rewards, by claiming them more times or in ways the terms don't allow. It almost always involves ",[27,280,281],{"href":60},"multi-accounting",": one person or crew operating many accounts to collect an incentive that was priced for one new customer. The practice is best known in igaming and sports betting, where it is often called bonus hunting, but fintech and trading apps with cash incentives see the same behavior.",[19,284,22],{"id":21},[15,286,287],{},"A signup or deposit bonus is a customer acquisition cost. The operator expects to pay it once per real new customer and earn it back over the account's lifetime. Bonus abusers break that math by collecting the bonus many times and contributing nothing afterward.",[15,289,290],{},"In igaming, the classic play is bonus hunting across accounts. The abuser registers repeatedly with different emails and identities, deposits the minimum that triggers the match, then clears the wagering requirement with low-risk play: low house edge games, minimum-stake grinding, or hedged bets placed across accounts or competing books so the outcomes offset. Whatever survives the playthrough is withdrawn, and the account goes quiet.",[15,292,293],{},"In fintech, the target is usually the deposit or referral incentive. Self-referral is the simplest loop: the abuser creates fake accounts, \"refers\" them from the main account, cycles the same deposit money through each one, and collects both sides of the reward. At scale this becomes referral farming, with scripted signups, rented identities, and phone farms producing accounts that exist only to trigger a payout.",[15,295,296,297,300],{},"The abuse isn't always solo. Organized crews run hundreds of accounts using emulators, anti-detect browsers, SIM banks, and purchased identity data. The same infrastructure behind industrial ",[27,298,299],{"href":235},"fake account creation"," powers industrial bonus farming, which is why detection looks similar for both.",[19,302,38],{"id":37},[15,304,305],{},"Each individual signup looks clean. The signal is in the links between accounts and in the timing.",[15,307,308,309,311],{},"Device and browser linking is the strongest lever. ",[27,310,45],{"href":44}," ties \"different\" customers back to the same hardware: ten accounts claiming a signup bonus from one device is not ten customers. Emulators, anti-detect browsers, and automation frameworks leave their own detectable traces.",[15,313,314],{},"Payment linking catches what device signals miss. The same card (BIN plus last four), bank account, or crypto withdrawal address appearing across accounts collapses them into one actor. Watch for deposits that sit exactly at the bonus minimum, and for withdrawals that follow the wagering requirement being cleared by hours.",[15,316,317],{},"Identity signals fill in the rest: disposable or aliased email addresses (plus addressing, sequential patterns like name1 and name2), VoIP or freshly issued phone numbers, reused or lightly edited KYC details, and mailing addresses that repeat with trivial variations.",[15,319,320],{},"Velocity and graph structure expose the farms. Bursts of signups from one subnet or device in a short window, referral chains that loop back to their origin, and cohorts of accounts created around a promo launch that go dormant when it ends are all strong indicators. A referral graph where reward flows converge on a few cash-out accounts is a farm, whatever each account looks like on its own.",[19,322,69],{"id":68},[15,324,325,326,330,331,335],{},"Rupt links accounts by device, network, and behavioral signals at signup and at reward-triggering events, so a bonus claim from a device already tied to previous claimants can be flagged or challenged before payout. The ",[27,327,329],{"href":328},"\u002Fdocs\u002Fv3\u002Fguides\u002Fincentive-abuse-prevention","incentive abuse prevention guide"," walks through the setup, and ",[27,332,334],{"href":333},"\u002Fsolutions\u002Freferral-fraud","referral fraud"," covers the self-referral and referral farming side specifically.",{"title":84,"searchDepth":85,"depth":85,"links":337},[338,339,340],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"Bonus abuse is the exploitation of signup, deposit, and referral promotions through multiple accounts. Learn how it works and how to detect it.",{},"\u002Fglossary\u002Fbonus-abuse",[61,262,96],{"title":270,"description":341},{"loc":343},"6.glossary\u002Fbonus-abuse","Bonus abuse","vyRKeSSCp6uvX-O79OFmpByqmJy3DBuUUOlpG7m5elM",{"id":351,"title":352,"body":353,"description":437,"extension":91,"meta":438,"navigation":93,"path":156,"relatedTerms":439,"seo":441,"sitemap":442,"stem":443,"term":444,"__hash__":445},"glossary\u002F6.glossary\u002Fbot-detection.md","What is bot detection?",{"type":8,"value":354,"toc":432},[355,358,361,363,374,387,390,392,395,409,412,415,418,420],[11,356,352],{"id":357},"what-is-bot-detection",[15,359,360],{},"Bot detection is the practice of separating automated traffic from real human users. It covers scrapers, credential stuffing tools, click bots, spam scripts, and, increasingly, AI agents that drive full browsers. The output is a classification per session (human, bot, or acceptable automation) that downstream systems use to block, challenge, or allow the request.",[19,362,22],{"id":21},[15,364,365,366,369,370,373],{},"Bots exist because automation is cheap and manual work is not. A scraper can pull a pricing catalog thousands of times a day. A ",[27,367,368],{"href":121},"credential stuffing"," tool can test a million leaked passwords overnight. A registration bot can create the raw accounts behind a ",[27,371,372],{"href":235},"fake account"," farm. Each of these attacks only pays off at volume, and volume is exactly what detection systems look for.",[15,375,376,377,381,382,386],{},"Traditional detection works in layers. The first layer inspects the client environment for automation framework markers: ",[378,379,380],"code",{},"navigator.webdriver"," set to true, Selenium or Puppeteer artifacts in the JavaScript runtime, and the stripped-down feature set of headless builds. The second layer checks consistency through ",[27,383,385],{"href":384},"\u002Fglossary\u002Fbrowser-fingerprinting","browser fingerprinting",": a client claiming to be an iPhone should not report a SwiftShader WebGL renderer. The third layer watches behavior over time, because even a bot with a perfect fingerprint still has to act, and acting at machine speed is hard to hide.",[15,388,389],{},"AI agents changed the economics of this fight. An LLM-driven agent runs a real Chrome instance with a real rendering engine, real fonts, and often a residential IP. Nothing about it is headless, so naive checks pass cleanly. The problem also stopped being purely adversarial: an agent booking a flight or renewing a subscription for a paying customer is traffic many businesses want to serve. That shifts the goal from \"block everything automated\" to \"know what is automated, then decide.\"",[19,391,38],{"id":37},[15,393,394],{},"Practitioners layer signals rather than trusting any single one.",[15,396,397,398,400,401,404,405,408],{},"On the device side, look for ",[378,399,380],{},", Chrome DevTools Protocol artifacts, and overridden native functions whose ",[378,402,403],{},"toString()"," output no longer reads ",[378,406,407],{},"[native code]",". Headless builds also ship with missing media codecs, empty plugin arrays, and permission APIs that answer too fast or too uniformly.",[15,410,411],{},"On the network side, datacenter ASNs, hosting-provider IP ranges, and known proxy or VPN exits carry weight. So do volume patterns: dozens of new accounts registered from one device, one account touched from hundreds of IPs, or request rates no human could produce from a single connection.",[15,413,414],{},"Behavioral timing is the hardest signal to fake at scale. Forms completed in under a second, pointer traces that are perfectly linear or absent entirely, uniform intervals between requests, and navigation that skips every intermediate page all point to a script. LLM agents invert some of these tells: they can be slower than a human on individual actions but oddly consistent across sessions, and they often act through the accessibility tree or scripted selectors instead of a mouse.",[15,416,417],{},"Challenge escalation ties the signals together. Low-risk sessions pass invisibly, borderline sessions get a lightweight proof-of-work or interaction check, and high-risk sessions face verification that costs real effort to clear. A standalone CAPTCHA is no longer a reliable gate on its own; solver services are cheap and multimodal models handle most visual puzzles, so the challenge has to be one layer among several rather than the whole defense.",[19,419,69],{"id":68},[15,421,422,423,426,427,431],{},"Rupt runs these layers as one pipeline: environment checks, fingerprint consistency, network reputation, and behavioral scoring feed a single verdict per session, with challenges that escalate only when risk warrants it. The ",[27,424,157],{"href":425},"\u002Fplatform\u002Fbot-detection"," page covers the signal set, and the ",[27,428,430],{"href":429},"\u002Fplatform\u002Ffraud-detection-api","fraud detection API"," is how you wire verdicts into your own signup, login, and checkout flows.",{"title":84,"searchDepth":85,"depth":85,"links":433},[434,435,436],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"Bot detection separates automated traffic, scrapers, credential stuffers, and AI agents from human users using device, network, and behavioral signals.",{},[185,262,440],"browser-fingerprinting",{"title":352,"description":437},{"loc":156},"6.glossary\u002Fbot-detection","Bot detection","hyfB7yjSz01AczoNavBD3WMsmf6bmtRP08f0ftM3fGk",{"id":447,"title":448,"body":449,"description":557,"extension":91,"meta":558,"navigation":93,"path":384,"relatedTerms":559,"seo":562,"sitemap":563,"stem":564,"term":565,"__hash__":566},"glossary\u002F6.glossary\u002Fbrowser-fingerprinting.md","What is browser fingerprinting?",{"type":8,"value":450,"toc":552},[451,454,457,459,462,472,493,500,502,505,527,537,539],[11,452,448],{"id":453},"what-is-browser-fingerprinting",[15,455,456],{},"Browser fingerprinting is a technique that identifies a specific browser installation by combining dozens of attributes the browser exposes, such as canvas rendering output, WebGL renderer details, installed fonts, and screen metrics, into a single identifier. It works without cookies or any stored state, so it survives cleared storage, private windows, and logged-out sessions. The fingerprint identifies a browser install, not a person.",[19,458,22],{"id":21},[15,460,461],{},"A script reads attributes that vary from one machine to the next. Canvas fingerprinting draws text and shapes onto a hidden canvas element and hashes the pixel output; GPU hardware, graphics drivers, and OS font smoothing each nudge the pixels enough to separate machines. WebGL contributes the reported vendor and renderer strings plus its own rendered output. Audio context fingerprinting pushes a generated signal through an oscillator and compressor and hashes what comes out. Font detection measures rendered text against a list of known typefaces to infer what is installed. On top of that sit screen resolution, device pixel ratio, color depth, timezone, languages, and User-Agent Client Hints, the structured values Chromium browsers now offer in place of the old User-Agent string.",[15,463,464,465,471],{},"Each attribute contributes some entropy, and together they narrow a browser down fast. Peter Eckersley's 2010 EFF study found at least 18 bits of entropy in the fingerprint distribution, and 84% of sampled browsers were unique among roughly 470,000 ",[27,466,470],{"href":467,"rel":468},"https:\u002F\u002Fcoveryourtracks.eff.org\u002Fstatic\u002Fbrowser-uniqueness.pdf",[469],"nofollow","participants",". The catch is that the highest entropy signals are also the least stable. A browser update can change canvas output overnight, a driver update rewrites the WebGL renderer string, and a new monitor changes screen metrics. Production systems expect this drift: they match fingerprints fuzzily and let an identifier evolve over time instead of comparing exact hashes.",[15,473,474,475,480,481,486,487,492],{},"Browser vendors also push back. Safari deliberately exposes a small surface (system fonts only, a simplified User-Agent) as part of WebKit's ",[27,476,479],{"href":477,"rel":478},"https:\u002F\u002Fwebkit.org\u002Ftracking-prevention\u002F",[469],"tracking prevention"," work. Firefox ships a ",[27,482,485],{"href":483,"rel":484},"https:\u002F\u002Fsupport.mozilla.org\u002Fen-US\u002Fkb\u002Ffirefox-protection-against-fingerprinting",[469],"fingerprinting protection"," mode that reports generic values for timezone, screen size, and other attributes. Brave ",[27,488,491],{"href":489,"rel":490},"https:\u002F\u002Fbrave.com\u002Fprivacy-updates\u002F3-fingerprint-randomization\u002F",[469],"randomizes"," canvas and audio readouts per site. The practical effect is lower entropy in those browsers: thousands of Safari users on the same iPhone model and iOS version can produce nearly identical fingerprints.",[15,494,495,496,499],{},"That is why the per-browser frame matters. Chrome and Safari on the same laptop produce two unrelated fingerprints, so one person can look like three \"users\" across the browsers they use. Fingerprinting gives you continuity within a single browser install. Person-level continuity, recognizing the same actor across browsers and devices, needs an identification layer on top: account linkage, ",[27,497,498],{"href":44},"device fingerprinting",", IP history, and behavioral signals.",[19,501,38],{"id":37},[15,503,504],{},"For fraud teams the operational question is usually the reverse: detecting browsers that lie about their fingerprint. The reliable signals are contradictions between attributes.",[506,507,508,512,515,518,521],"ul",{},[509,510,511],"li",{},"A User-Agent that claims Windows while WebGL reports an Apple GPU, or a claimed iPhone with a screen size no iPhone ships.",[509,513,514],{},"A desktop browser with touch events, or a mobile browser with none.",[509,516,517],{},"Timezone and language that never line up with the IP address's region.",[509,519,520],{},"Canvas output that changes between two identical draws in the same session, which means noise injection by Brave or an anti-detect browser.",[509,522,523,524,526],{},"Automation artifacts: navigator.webdriver set to true, missing codec and plugin sets, or a software renderer like SwiftShader on a machine that claims a gaming GPU. These overlap heavily with ",[27,525,157],{"href":156},".",[15,528,529,530,532,533,536],{},"Some checks only work across a whole population of sessions. A fingerprint shared by thousands of \"different\" accounts points at an anti-detect template, a pattern common in ",[27,531,61],{"href":60}," and ",[27,534,535],{"href":260},"ban evasion",". Anti-detect browsers spoof attributes one at a time, and the seams between attributes are where they get caught.",[19,538,69],{"id":68},[15,540,541,542,546,547,551],{},"Rupt collects canvas, WebGL, audio, font, and client hint signals with consistency checks built in, and treats the resulting ",[27,543,545],{"href":544},"\u002Fplatform\u002Fbrowser-fingerprinting","browser fingerprint"," as one input rather than the whole answer. Its ",[27,548,550],{"href":549},"\u002Fplatform\u002Fidentification","identification layer"," links fingerprints to devices and accounts, so recognition survives fingerprint drift and works across the browsers one person actually uses.",{"title":84,"searchDepth":85,"depth":85,"links":553},[554,555,556],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"Browser fingerprinting combines canvas, WebGL, fonts, and other browser attributes into an identifier that recognizes a returning browser without cookies.",{},[96,560,561],"bot-detection","ban-evasion",{"title":448,"description":557},{"loc":384},"6.glossary\u002Fbrowser-fingerprinting","Browser fingerprinting","0-DtpatPDzmsVjO8l24rcyaaoc7xiKhXC2mwS3tssv8",{"id":568,"title":569,"body":570,"description":636,"extension":91,"meta":637,"navigation":93,"path":121,"relatedTerms":638,"seo":640,"sitemap":641,"stem":642,"term":122,"__hash__":643},"glossary\u002F6.glossary\u002Fcredential-stuffing.md","What is credential stuffing?",{"type":8,"value":571,"toc":631},[572,575,580,582,591,594,597,599,605,611,614,620,622],[11,573,569],{"id":574},"what-is-credential-stuffing",[15,576,577,578,526],{},"Credential stuffing is an automated attack in which criminals replay username and password pairs leaked from one service against the login endpoints of other services. It works because people reuse passwords: if a user's credentials from a breached forum also unlock their streaming or banking account, the attacker walks in through the front door. It is one of the most common paths to ",[27,579,30],{"href":29},[19,581,22],{"id":21},[15,583,584,585,590],{},"Attackers start with a combolist, a file of email and password pairs compiled from past breaches. These lists circulate cheaply, and ",[27,586,589],{"href":587,"rel":588},"https:\u002F\u002Fowasp.org\u002Fwww-community\u002Fattacks\u002FCredential_stuffing",[469],"OWASP"," ranks the resulting attacks among the most common techniques for taking over user accounts. The attacker loads the list into an automation tool, points it at a login endpoint, and lets bots submit each pair once.",[15,592,593],{},"Two things make the economics work. Proxy networks, often residential, spread the traffic across thousands of IPs so no single address looks busy. And the attack only needs a small fraction of pairs to succeed: even a fraction of a percent of a ten million line list yields thousands of working accounts, which the attacker drains or resells.",[15,595,596],{},"Credential stuffing is not brute force, and the difference matters for defense. Brute force hammers one account with many password guesses, which lockout policies catch quickly. Stuffing sends one or two attempts per account across a huge set of accounts, so per-account lockouts never trip. You have to read the traffic in aggregate, not account by account.",[19,598,38],{"id":37},[15,600,601,602,604],{},"The clearest signal is velocity measured against something the attacker cannot rotate cheaply. IP velocity helps (hundreds of login attempts from one address is an easy call), but proxies blunt it. Device velocity is harder to evade: when ",[27,603,498],{"href":44}," shows one device identity attempting logins for dozens of unrelated usernames, you are watching a stuffing run even if every attempt arrives from a different IP.",[15,606,607,608,610],{},"Automation signals come next. Stuffing tools run headless browsers or raw HTTP replays, and both leak. Webdriver flags, missing browser APIs, a user agent that contradicts the TLS or HTTP fingerprint, and forms submitted with no keystrokes or pointer events all point the same way. ",[27,609,444],{"href":156}," on the login endpoint catches most off-the-shelf tooling.",[15,612,613],{},"Failure patterns give it away at the aggregate level. A login endpoint has a fairly stable baseline failure rate. During a stuffing run the rate spikes, and the failures look odd: spread thinly across many accounts with one or two attempts each, heavy on \"unknown user\" errors because the list is stale. The attempts often land at machine-regular intervals too.",[15,615,616,617,619],{},"Finally, watch the successes. A stuffed login that works still carries the attacker's context, not the owner's. A success from a new device, a datacenter ASN, or a location that implies ",[27,618,53],{"href":52}," from the account's last session deserves a step-up challenge before it turns into a takeover.",[19,621,69],{"id":68},[15,623,624,625,627,628,630],{},"Rupt scores every login attempt with device identification, automation detection, and velocity rules, so a stuffing run stands out even when it is spread across residential proxies. The ",[27,626,175],{"href":174}," covers the login setup, and the ",[27,629,30],{"href":169}," solution covers what to do with the attempts that get through.",{"title":84,"searchDepth":85,"depth":85,"links":632},[633,634,635],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"Credential stuffing is the automated replay of leaked username and password pairs against login forms. Learn how it works and the signals that expose it.",{},[639,560,97],"account-takeover",{"title":569,"description":636},{"loc":121},"6.glossary\u002Fcredential-stuffing","FpKmhqdBIEzt9vZb8WVCXLzFntuSXGznxJ0VlTSI6Ow",{"id":645,"title":646,"body":647,"description":753,"extension":91,"meta":754,"navigation":93,"path":44,"relatedTerms":755,"seo":756,"sitemap":757,"stem":758,"term":45,"__hash__":759},"glossary\u002F6.glossary\u002Fdevice-fingerprinting.md","What is device fingerprinting?",{"type":8,"value":648,"toc":746},[649,652,655,657,666,669,689,693,699,703,706,715,719,735,737],[11,650,646],{"id":651},"what-is-device-fingerprinting",[15,653,654],{},"Device fingerprinting is a technique that identifies a device by combining dozens of observable attributes, such as screen dimensions, installed fonts, GPU characteristics, and timezone, into a single identifier. The fingerprint is computed from what the device is rather than stored on it, so it survives cookie clearing, private browsing, and logouts. Fraud teams use it to recognize a returning device even when the person behind it is trying to look new.",[19,656,22],{"id":21},[15,658,659,660,665],{},"A script on the page (or an SDK inside a native app) reads attributes the platform exposes and hashes them into an identifier. No single attribute identifies anyone. Your timezone is shared with millions of people. The power is in the combination: enough weakly identifying signals, taken together, separate one browser from almost every other browser that visits the site. The EFF's ",[27,661,664],{"href":662,"rel":663},"https:\u002F\u002Fcoveryourtracks.eff.org\u002F",[469],"Cover Your Tracks"," project demonstrates this by showing visitors how identifiable their own browser is.",[15,667,668],{},"The signals that carry the most entropy:",[506,670,671,680,683,686],{},[509,672,673,674,679],{},"Canvas rendering. The script draws text and shapes to an invisible canvas and reads the pixels back. Anti-aliasing, font rasterization, and GPU quirks make the output differ across hardware and driver combinations. ",[27,675,678],{"href":676,"rel":677},"https:\u002F\u002Fhovav.net\u002Fucsd\u002Fdist\u002Fcanvas.pdf",[469],"Mowery and Shacham described the technique in 2012"," and it is still one of the strongest signals available.",[509,681,682],{},"WebGL. The reported renderer, the supported extensions, and the exact output of a rendered test scene reveal the GPU and driver stack.",[509,684,685],{},"Fonts. The set of installed fonts, measured by rendering text and comparing element dimensions, reflects the operating system and whatever software the user has installed over the years.",[509,687,688],{},"Hardware and environment. CPU core count, device memory, screen resolution, pixel density, touch support, timezone, and language each contribute a few bits.",[19,690,692],{"id":691},"browser-fingerprinting-versus-device-fingerprinting","Browser fingerprinting versus device fingerprinting",[15,694,695,696,698],{},"On the web the two terms get used interchangeably, but what a script collects is really a browser fingerprint. Chrome and Firefox on the same laptop produce different fingerprints because every signal passes through the browser's rendering engine and API surface. That is not a flaw. Fingerprinting is per-browser by design, and the practical job is differentiating users within a browser population: telling apart the thousands of Chrome-on-Windows visitors who would otherwise look identical. Producing one identifier that follows a person across different browsers is a separate identification problem, solved above the fingerprint layer by linking fingerprints through accounts, sessions, and network history rather than by stretching the fingerprint itself. ",[27,697,565],{"href":384}," covers the web-specific mechanics in more depth. Native mobile apps get closer to a true device fingerprint because they can read hardware-level identifiers, though platforms restrict those too: Apple scopes its identifier for vendors to a single developer's apps.",[19,700,702],{"id":701},"stability-versus-uniqueness","Stability versus uniqueness",[15,704,705],{},"Every fingerprinting system balances two goals that pull against each other. A fingerprint should be stable, so the same device produces the same value next week and after a browser update. It should also be unique, so no two devices share one. Adding more signals increases uniqueness but makes the fingerprint brittle: a browser upgrade or a newly installed font changes a signal and breaks continuity. Using fewer, coarser signals keeps the fingerprint stable but produces collisions.",[15,707,708,709,711,712,714],{},"Collisions are worst on uniform hardware. Two iPhones of the same model on the same iOS version are nearly identical: same screen, same GPU, same font set, and an operating system that deliberately limits the APIs that could tell them apart. A fingerprint alone cannot separate them, and treating a raw match as proof of \"same device\" merges strangers. The false positive cost is real. An innocent user can inherit a ban meant for someone else's ",[27,710,535],{"href":260},", or two unrelated customers can get flagged as one ",[27,713,281],{"href":60}," operator. The practitioner's answer is corroboration: a fingerprint match on commodity hardware should only be trusted when supporting evidence agrees, such as overlapping IP history, shared account linkage, or consistent behavioral patterns. Fingerprints work best as a weighted input to a scoring system, not a binary verdict.",[19,716,718],{"id":717},"fraud-prevention-versus-ad-tracking","Fraud prevention versus ad tracking",[15,720,721,722,725,726,728,729,734],{},"Fingerprinting earned its poor reputation from advertising, where it was used to follow people across unrelated websites and rebuild profiles they had tried to delete. Fraud prevention uses the same techniques with a narrower scope: first party, on a single service, to answer whether this device has been here before and what it did. That covers recognizing the device behind repeated ",[27,723,724],{"href":235},"fake signups",", catching one device that operates a farm of accounts, and spotting the rendering anomalies that give away headless browsers in ",[27,727,157],{"href":156},". The distinction matters legally as well. Under GDPR, fraud prevention is explicitly named as a legitimate interest (",[27,730,733],{"href":731,"rel":732},"https:\u002F\u002Fgdpr-info.eu\u002Frecitals\u002Fno-47\u002F",[469],"Recital 47","), while cross-site ad tracking generally requires consent.",[19,736,69],{"id":68},[15,738,739,740,742,743,745],{},"Rupt collects a ",[27,741,545],{"href":544}," as one input to its ",[27,744,550],{"href":549},", not as the identity itself. Fingerprint matches are corroborated with network and account signals before devices are merged, which keeps same-model phones from collapsing into a single device, and the resulting device IDs stay stable even when individual fingerprint signals change.",{"title":84,"searchDepth":85,"depth":85,"links":747},[748,749,750,751,752],{"id":21,"depth":85,"text":22},{"id":691,"depth":85,"text":692},{"id":701,"depth":85,"text":702},{"id":717,"depth":85,"text":718},{"id":68,"depth":85,"text":69},"Device fingerprinting identifies a device by combining signals like canvas rendering, WebGL, fonts, and hardware traits into a stable identifier.",{},[440,560,61],{"title":646,"description":753},{"loc":44},"6.glossary\u002Fdevice-fingerprinting","1GS-RFWfqHYlQClPq52RzCPddCp1ywCeOn5rXd8mP70",{"id":761,"title":762,"body":763,"description":839,"extension":91,"meta":840,"navigation":93,"path":235,"relatedTerms":841,"seo":843,"sitemap":844,"stem":845,"term":846,"__hash__":847},"glossary\u002F6.glossary\u002Ffake-account-detection.md","What is fake account detection?",{"type":8,"value":764,"toc":834},[765,768,771,773,780,783,786,788,791,794,797,808,813,816,819,821],[11,766,762],{"id":767},"what-is-fake-account-detection",[15,769,770],{},"Fake account detection is the practice of identifying newly registered accounts that belong to bots, fraud rings, or banned users rather than real customers. It scores each signup against signals like email reputation, IP type, device history, and automation markers, then blocks or challenges the registrations that look fabricated.",[19,772,22],{"id":21},[15,774,775,776,779],{},"Fake accounts are the raw material for most product abuse. Spammers need throwaway accounts to send from. Scammers need clean profiles to message victims from. Incentive farmers register hundreds of accounts to claim signup credits, free trials, and referral payouts (see ",[27,777,778],{"href":343},"bonus abuse","). Review manipulation runs on the same supply chain: sellers buy blocks of aged fake accounts to post glowing reviews or bury a competitor's listing.",[15,781,782],{},"The economics explain why the problem clusters at signup. Registration is usually free, rarely rate limited, and often rewarded with a trial or a credit. One person with an emulator farm or a browser automation script can create thousands of accounts in an afternoon, and each one costs the attacker almost nothing until you make it cost something. So detection concentrates its effort at the registration step. It is the one moment where every abusive account has to pass through the same door.",[15,784,785],{},"Detection happens in two windows. At signup, you evaluate the email, phone, IP, and device before the account exists. Right after signup, you watch what the account does in its first minutes. Fake accounts sprint straight to the thing they were created for. Real users wander.",[19,787,38],{"id":37},[15,789,790],{},"No single signal is decisive, so practitioners score several together.",[15,792,793],{},"Email signals come first because they are cheap to check. Disposable domains, addresses with no MX records, domains registered in the last few days, and sequential local parts like jsmith01 and jsmith02 all point toward bulk creation. Gmail dot tricks and plus addressing let one inbox back hundreds of \"unique\" addresses.",[15,795,796],{},"Network signals matter next. Signups from datacenter ASNs (AWS, Hetzner, OVH) are a strong tell, since real people do not browse from server racks. Proxies and VPNs are weaker evidence because privacy tools have legitimate users, but a burst of registrations spread across one provider's IP pool is not organic. Watch counts per IP and per \u002F24 inside short windows.",[15,798,799,800,802,803,532,805,807],{},"Device signals are the hardest for attackers to fake at scale. ",[27,801,45],{"href":44}," ties registrations together even when every account uses a fresh email behind a rotating proxy: fifty accounts on one device is a farm, not a coincidence. The same signal catches ",[27,804,535],{"href":260},[27,806,61],{"href":60},", which are the repeat offender versions of the same problem.",[15,809,810,811,526],{},"Automation markers expose the scripts doing the work. Headless browser flags, webdriver properties, missing touch or sensor data on a claimed mobile device, and forms completed in under a second with no mouse movement all indicate software rather than a person. This overlaps heavily with ",[27,812,157],{"href":156},[15,814,815],{},"Velocity ties everything together. Real signups arrive in a messy trickle across time zones. Fake ones arrive in bursts: dozens of accounts in minutes, identical form timing, the same user agent on every one.",[15,817,818],{},"The scoring has to tolerate ambiguity. A disposable email alone might be a privacy conscious user, and a VPN alone might be a corporate network. Stacked together on one registration, they stop being coincidences. Block the obvious cases, challenge the middle, and let clean signups through untouched.",[19,820,69],{"id":68},[15,822,823,824,828,829,833],{},"Rupt scores every signup using device identity, network and email reputation, and automation markers, so repeated registrations get linked even when each account arrives with a fresh email and a new IP. The ",[27,825,827],{"href":826},"\u002Fsolutions\u002Ffake-accounts","fake accounts solution"," describes the approach, and the ",[27,830,832],{"href":831},"\u002Fdocs\u002Fv3\u002Fguides\u002Ffake-account-detection","fake account detection guide"," walks through wiring it into a registration flow.",{"title":84,"searchDepth":85,"depth":85,"links":835},[836,837,838],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"Fake account detection identifies accounts created by bots or fraud rings at signup, using email, IP, device, and automation signals to block abuse early.",{},[61,560,842],"bonus-abuse",{"title":762,"description":839},{"loc":235},"6.glossary\u002Ffake-account-detection","Fake account detection","Og7EZU6CYHpw1us4X2AdSL82098Ov9OFA30269paFnA",{"id":849,"title":850,"body":851,"description":918,"extension":91,"meta":919,"navigation":93,"path":52,"relatedTerms":920,"seo":921,"sitemap":922,"stem":923,"term":146,"__hash__":924},"glossary\u002F6.glossary\u002Fimpossible-travel.md","What is impossible travel?",{"type":8,"value":852,"toc":913},[853,856,862,864,867,873,875,878,889,892,898,901,903],[11,854,850],{"id":855},"what-is-impossible-travel",[15,857,858,859,861],{},"Impossible travel is a fraud signal that fires when two events on the same account, usually logins, come from locations too far apart to travel between in the time that elapsed. A sign-in from Chicago followed by a sign-in from Singapore twenty minutes later implies a speed no aircraft can reach, so at least one of the two sessions deserves scrutiny. It is one of the oldest heuristics in ",[27,860,30],{"href":29}," detection, and still one of the most useful when applied with care.",[19,863,22],{"id":21},[15,865,866],{},"The mechanics are simple. Each event carries an IP address. You geolocate both IPs, compute the distance between the two points, and divide by the time between the events. That gives you an implied speed. If the speed exceeds a plausible threshold, commonly around the 550 mph cruise speed of a commercial airliner plus some margin, the pair gets flagged.",[15,868,869,870,872],{},"The signal works because attackers rarely sit in the same city as their victims. Stolen credentials get tested from datacenters and proxy networks around the world, so a successful ",[27,871,368],{"href":121}," hit often produces a login thousands of miles from anywhere the real user has ever signed in. Meanwhile the legitimate owner keeps using the account from home, and the two access patterns collide into an impossible pair. A velocity check catches that collision without needing to know anything else about the attacker.",[19,874,38],{"id":37},[15,876,877],{},"The naive version (IP geolocation plus a speed check) generates heavy false positives. Three sources cause most of them:",[506,879,880,883,886],{},[509,881,882],{},"VPNs. A user who connects through a VPN exits the internet wherever the provider's server sits. Turning the VPN off between two requests looks like teleporting across an ocean, and switching exit nodes looks the same.",[509,884,885],{},"Corporate egress. Many companies route employee traffic through a security stack in another region, so one person can legitimately appear in two countries within minutes depending on which network their laptop joined.",[509,887,888],{},"Mobile carrier NAT. Carrier-grade NAT can assign a phone a public IP that geolocates hundreds of miles from the handset, and the assigned IP can change between sessions without the phone moving at all.",[15,890,891],{},"IP geolocation is also imprecise on its own. Databases routinely place an IP in the wrong city and occasionally the wrong country, which stretches or shrinks the computed distance.",[15,893,894,895,897],{},"The fix is corroboration, mostly with device signals. Check whether both events came from the same device: an identical ",[27,896,140],{"href":44}," on both sides of an impossible pair points at a VPN toggle rather than a second actor. Check the network type: a jump that lands on a hosting provider or a known VPN exit is far more suspicious than one that lands on a residential ISP. Check session continuity: did the second location reuse an existing authenticated session, or present a password and start fresh? And keep allowlists for corporate egress ranges your real users are known to traverse. Impossible travel plus a never-seen device plus a datacenter ASN is a strong account takeover indicator. Impossible travel alone is a prompt to look closer, not a verdict.",[15,899,900],{},"Tuning matters too. A threshold set at exactly airliner speed flags people who land and open their laptop at the gate. Adding a buffer for time zones, airport-to-city gaps, and geolocation error cuts noise without hiding real attacks, since credential stuffing pairs usually imply speeds that are absurd rather than borderline.",[19,902,69],{"id":68},[15,904,905,906,910,911,526],{},"Rupt computes travel velocity between events as one input to a larger score, weighed against device identity, network reputation, and the account's own history on the ",[27,907,909],{"href":908},"\u002Fplatform\u002Fintelligence","intelligence layer",". An impossible pair backed by a known device can resolve quietly, while the same pair from a new device on a hosting network can trigger step-up verification or a block, the pattern described in ",[27,912,170],{"href":169},{"title":84,"searchDepth":85,"depth":85,"links":914},[915,916,917],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"Impossible travel is when two logins on one account come from locations too far apart to reach in the time between them, a classic account takeover signal.",{},[639,185,96],{"title":850,"description":918},{"loc":52},"6.glossary\u002Fimpossible-travel","JZsJviBBrsuEbtx1CHB-b3kD8XZG40wKNgu0q3n33Wc",{"id":926,"title":927,"body":928,"description":989,"extension":91,"meta":990,"navigation":93,"path":60,"relatedTerms":991,"seo":992,"sitemap":993,"stem":994,"term":995,"__hash__":996},"glossary\u002F6.glossary\u002Fmultiaccounting.md","What is multiaccounting?",{"type":8,"value":929,"toc":984},[930,933,936,938,944,947,950,952,958,964,970,972],[11,931,927],{"id":932},"what-is-multiaccounting",[15,934,935],{},"Multiaccounting is the practice of one person creating and operating multiple accounts on a platform that expects one account per user. It is done to collect per-account incentives more than once, to keep operating after a ban, or to manipulate systems that count accounts as people, such as reviews, votes, and referral programs. The variant spelling multi-accounting refers to the same behavior.",[19,937,22],{"id":21},[15,939,940,941,943],{},"The motive is almost always an incentive that pays out per account. A free trial is worth signing up for twice. A referral program that rewards both sides turns into a money printer when one person controls both sides. A marketplace that ranks sellers by review volume rewards anyone who can review their own listings from a second account. And a ban only works if the platform can stop the same person from registering again, which makes ",[27,942,535],{"href":260}," a special case of multiaccounting.",[15,945,946],{},"The mechanics are cheap. Free email providers hand out unlimited addresses, and plus addressing means one inbox can back hundreds of signups. Disposable email domains and VoIP phone numbers cover verification steps. On the device side, an incognito window defeats cookie-based tracking, a VPN rotates the IP, and anti-detect browsers go further by spoofing the parts of the browser that fingerprinting scripts read. Serious operations run dozens of browser profiles or racks of physical phones in parallel.",[15,948,949],{},"Severity varies a lot. A student making a second account for another free month is a nuisance. A ring running thousands of accounts to drain a referral budget or launder marketplace rankings is a business problem. The detection methods are the same either way. The response usually is not.",[19,951,38],{"id":37},[15,953,954,955,957],{},"No single signal proves two accounts belong to the same person, so detection is really account linking. The strongest link is the device. If ",[27,956,498],{"href":44}," puts the same hardware behind five accounts, you have a cluster worth acting on, because clearing cookies or logging out does not change the device. IP addresses are a weaker version of the same idea: useful for spotting bursts of signups from one address, but noisy on their own, since carrier-grade NAT and campus networks put many real users behind one IP.",[15,959,960,961,963],{},"Identity fields carry their own patterns. Sequential or templated email addresses (jsmith1, jsmith2, jsmith3), plus-addressed variants of one inbox, and disposable domains all point at one operator. Phone numbers from VoIP ranges or number rental services are a similar tell. These checks overlap heavily with ",[27,962,236],{"href":235},", since a multiaccounter's extra accounts are by definition fake.",[15,965,966,967,969],{},"Behavior closes the loop. Accounts that sign up minutes apart, complete onboarding in the same unusual order, or paste into the same form fields tend to share an operator. Behavioral similarity is hard to suppress at scale because it comes from habit rather than configuration, and it catches the case where every technical signal looks clean: fresh device, residential proxy, plausible email, but identical behavior across twenty accounts. When the incentive under attack is a signup bonus or referral payout, the same clusters surface in ",[27,968,778],{"href":343}," investigations.",[19,971,69],{"id":68},[15,973,974,975,978,979,983],{},"Rupt links accounts through device identity, network signals, and behavior, then exposes the cluster so a policy can decide what happens next: block the signup, require a challenge, or quietly withhold the incentive. The ",[27,976,977],{"href":250},"multi-accounting solution page"," explains how the linking works, and the ",[27,980,982],{"href":981},"\u002Fdocs\u002Fv3\u002Fguides\u002Fmulti-accounting-prevention","prevention guide"," has the policy recipes.",{"title":84,"searchDepth":85,"depth":85,"links":985},[986,987,988],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"Multiaccounting is one person running multiple accounts on one platform to abuse free trials, farm referral rewards, evade bans, or manipulate marketplaces.",{},[561,842,262],{"title":927,"description":989},{"loc":60},"6.glossary\u002Fmultiaccounting","Multiaccounting","QT2sAg0nqLEirfaX6RNoMyX2833biWVdgbMN8zV9Q_E",{"id":998,"title":999,"body":1000,"description":1061,"extension":91,"meta":1062,"navigation":93,"path":1063,"relatedTerms":1064,"seo":1065,"sitemap":1066,"stem":1067,"term":1068,"__hash__":1069},"glossary\u002F6.glossary\u002Fsms-pumping.md","What is SMS pumping?",{"type":8,"value":1001,"toc":1056},[1002,1005,1008,1010,1013,1021,1024,1026,1029,1032,1035,1048,1050],[11,1003,999],{"id":1004},"what-is-sms-pumping",[15,1006,1007],{},"SMS pumping (also called SMS toll fraud or artificially inflated traffic) is a scheme where attackers abuse any feature that sends a text message, usually one-time passcode delivery, to push SMS traffic toward phone number ranges they profit from. The business pays its normal per-message rate on every send. The attacker, working with a complicit carrier or reseller somewhere in the delivery chain, collects a share of the termination fees.",[19,1009,22],{"id":21},[15,1011,1012],{},"The attacker starts by finding an endpoint that turns a request into a text message: signup phone verification, login OTP, \"text me a download link\", SMS two-factor enrollment. These endpoints are attractive because they sit in front of authentication. They are reachable without an account, and teams rarely rate limit them as hard as the rest of the product.",[15,1014,1015,1016,526],{},"They then script the endpoint with bots and feed it numbers from ranges where they earn revenue. Termination fees are split among the parties that carry a message to its destination, and rogue operators or resellers kick back a portion of that fee for traffic delivered to numbers they control. International destinations with high termination rates are the usual target, which is why victims often notice sudden volume to countries where they have no users at all. Twilio documents the same pattern under the name ",[27,1017,1020],{"href":1018,"rel":1019},"https:\u002F\u002Fwww.twilio.com\u002Fdocs\u002Fglossary\u002Fwhat-is-sms-pumping-fraud",[469],"artificially inflated traffic",[15,1022,1023],{},"The economics favor volume over stealth. A single run can generate tens of thousands of OTP sends in a few hours, often overnight when nobody is watching the messaging dashboard. No code is ever entered. For many teams, the first sign is the invoice from their SMS provider.",[19,1025,38],{"id":37},[15,1027,1028],{},"Watch the destination numbers first. Pumping runs burn through contiguous blocks, so you see sends to numbers ending 0011, 0012, 0013 within the same prefix in minutes. Real users never arrive as a sequential range. A velocity counter per number prefix, rather than per individual number, is the most useful control to maintain.",[15,1030,1031],{},"Completion rate is the second tell. Legitimate OTP flows convert. Ranges under attack sit near zero because nobody is on the other end to enter the code. Track verification completions by destination country and prefix, and alert when any segment's rate collapses.",[15,1033,1034],{},"Carrier and number-type lookups catch a lot before the send: VoIP and disposable numbers, prefixes tied to premium-rate or revenue-share operators, and destination countries outside your user base.",[15,1036,1037,1038,532,1040,1042,1043,1045,1046,526],{},"Then look at the requests themselves. Pumping is bot-driven, so the standard automation signals apply: headless browsers, missing or faked JavaScript execution, datacenter and proxy IPs, one device fingerprint appearing behind hundreds of \"different\" phone numbers, and inter-request timing too regular to be human. ",[27,1039,444],{"href":156},[27,1041,498],{"href":44}," cover these signals in depth. The same infrastructure that runs signup farms often runs pumping, so there is heavy overlap with ",[27,1044,236],{"href":235},", and the endpoints involved are the same ones probed during ",[27,1047,368],{"href":121},[19,1049,69],{"id":68},[15,1051,1052,1053,1055],{},"Rupt scores the request before the message goes out. Its ",[27,1054,157],{"href":425}," flags automation on the OTP endpoint, and device identification ties bursts of sends back to a single actor even when the attacker rotates IPs and phone numbers. Gating the verification endpoint this way means a failed check blocks the send rather than the login, so real users never notice the control exists.",{"title":84,"searchDepth":85,"depth":85,"links":1057},[1058,1059,1060],{"id":21,"depth":85,"text":22},{"id":37,"depth":85,"text":38},{"id":68,"depth":85,"text":69},"SMS pumping is toll fraud where attackers trigger OTP texts to number ranges they profit from. You pay the messaging bill and they take a cut.",{},"\u002Fglossary\u002Fsms-pumping",[560,262,185],{"title":999,"description":1061},{"loc":1063},"6.glossary\u002Fsms-pumping","SMS pumping","2f94Dgl1MmcPDM9TtJwUO0KHwh1V5hBgqernVmWVmj8",1786669618283]