What is fake account detection?
Fake account detection is the practice of identifying newly registered accounts that belong to bots, fraud rings, or banned users rather than real customers. It scores each signup against signals like email reputation, IP type, device history, and automation markers, then blocks or challenges the registrations that look fabricated.
How it works
Fake accounts are the raw material for most product abuse. Spammers need throwaway accounts to send from. Scammers need clean profiles to message victims from. Incentive farmers register hundreds of accounts to claim signup credits, free trials, and referral payouts (see bonus abuse). Review manipulation runs on the same supply chain: sellers buy blocks of aged fake accounts to post glowing reviews or bury a competitor's listing.
The economics explain why the problem clusters at signup. Registration is usually free, rarely rate limited, and often rewarded with a trial or a credit. One person with an emulator farm or a browser automation script can create thousands of accounts in an afternoon, and each one costs the attacker almost nothing until you make it cost something. So detection concentrates its effort at the registration step. It is the one moment where every abusive account has to pass through the same door.
Detection happens in two windows. At signup, you evaluate the email, phone, IP, and device before the account exists. Right after signup, you watch what the account does in its first minutes. Fake accounts sprint straight to the thing they were created for. Real users wander.
How to detect it
No single signal is decisive, so practitioners score several together.
Email signals come first because they are cheap to check. Disposable domains, addresses with no MX records, domains registered in the last few days, and sequential local parts like jsmith01 and jsmith02 all point toward bulk creation. Gmail dot tricks and plus addressing let one inbox back hundreds of "unique" addresses.
Network signals matter next. Signups from datacenter ASNs (AWS, Hetzner, OVH) are a strong tell, since real people do not browse from server racks. Proxies and VPNs are weaker evidence because privacy tools have legitimate users, but a burst of registrations spread across one provider's IP pool is not organic. Watch counts per IP and per /24 inside short windows.
Device signals are the hardest for attackers to fake at scale. Device fingerprinting ties registrations together even when every account uses a fresh email behind a rotating proxy: fifty accounts on one device is a farm, not a coincidence. The same signal catches ban evasion and multiaccounting, which are the repeat offender versions of the same problem.
Automation markers expose the scripts doing the work. Headless browser flags, webdriver properties, missing touch or sensor data on a claimed mobile device, and forms completed in under a second with no mouse movement all indicate software rather than a person. This overlaps heavily with bot detection.
Velocity ties everything together. Real signups arrive in a messy trickle across time zones. Fake ones arrive in bursts: dozens of accounts in minutes, identical form timing, the same user agent on every one.
The scoring has to tolerate ambiguity. A disposable email alone might be a privacy conscious user, and a VPN alone might be a corporate network. Stacked together on one registration, they stop being coincidences. Block the obvious cases, challenge the middle, and let clean signups through untouched.
How Rupt handles it
Rupt scores every signup using device identity, network and email reputation, and automation markers, so repeated registrations get linked even when each account arrives with a fresh email and a new IP. The fake accounts solution describes the approach, and the fake account detection guide walks through wiring it into a registration flow.