What is account sharing?
Account sharing is when multiple people use a single account through one set of login credentials. The account owner hands the password to friends, family, or coworkers, and everyone uses the product under one subscription or one seat. For subscription and seat-based businesses, every shared login is a user who consumes the product without paying for their own access.
How it works
Unlike account takeover, account sharing is voluntary. The owner gives the password away, so no security control is bypassed and every login looks legitimate. On streaming and consumer subscriptions, it starts inside a household and drifts outward: the ex-roommate two cities away, the cousin abroad, the group chat that all watches on one plan. On seat-based SaaS, a five-person team buys one license and rotates through it, or a departing employee's login quietly keeps working for their replacement. Nobody involved thinks of it as fraud, which is exactly why it spreads.
The cost shows up as revenue leakage rather than a dramatic incident: flat subscriber growth while usage climbs, or seat counts that never expand even as the customer's team doubles. The obvious countermeasures, a concurrency cap and an IP check, both fall apart fast. Legitimate single users are mobile. The same person hits your app from cellular at lunch, home wifi at night, and the office network in the morning, three IPs in one day. Families share a single IP. VPNs and carrier-grade NAT put thousands of unrelated users behind one address, and can hand one sharer a fresh IP every session. Concurrency limits miss sharers who use the account at different times, which is most of them: an account split across time zones may never produce two simultaneous sessions.
How to detect it
Reliable account sharing detection starts with counting devices, not IPs. Device fingerprinting gives each browser and phone a stable identifier that survives cookie clearing and network changes, so you can ask the question that actually matters: how many distinct devices used this account in the last month, and do they plausibly belong to one person? Most single users show up on a small, stable set of devices. Eight active devices spread across two operating system ecosystems tells a different story.
On top of device counts, watch session overlap and geography over time. Concurrent sessions from far-apart locations are a strong signal, and so is impossible travel: a login from Chicago forty minutes after one from Madrid. Slow patterns are often more convincing than single events. An account that resolves to two stable geographic clusters for months is almost certainly two households, not one frequent traveler. Behavior helps separate the two cases: two people produce two sets of active hours, two content tastes, and two navigation styles interleaved on one account.
Keep the distinction from multiaccounting clear when you build rules. Sharing is many people on one account; multiaccounting is one person on many accounts. They hide behind similar evasion tools, so the same device signals expose both, but the response differs.
The response is where the modern approach departs from the old one. Hard blocking a paying subscriber because their partner logged in creates a support ticket and a churn risk. Most teams now treat sharers as unconverted demand: identify the extra household or extra user, then prompt them into their own plan, a paid add-on, or a proper seat, with a light verification step for the real owner. Netflix's move to paid sharing in 2023 made this the default playbook for subscription businesses.
How Rupt handles it
Rupt fingerprints the devices behind each account, tracks their geography and overlap over time, and lets you set the threshold where sharing becomes likely for your product. From there you choose the response, from silent flagging to a challenge that converts the extra user into a paying one. The account sharing solution page covers the approach, and the account sharing prevention guide walks through the setup.