What is multiaccounting?
Multiaccounting is the practice of one person creating and operating multiple accounts on a platform that expects one account per user. It is done to collect per-account incentives more than once, to keep operating after a ban, or to manipulate systems that count accounts as people, such as reviews, votes, and referral programs. The variant spelling multi-accounting refers to the same behavior.
How it works
The motive is almost always an incentive that pays out per account. A free trial is worth signing up for twice. A referral program that rewards both sides turns into a money printer when one person controls both sides. A marketplace that ranks sellers by review volume rewards anyone who can review their own listings from a second account. And a ban only works if the platform can stop the same person from registering again, which makes ban evasion a special case of multiaccounting.
The mechanics are cheap. Free email providers hand out unlimited addresses, and plus addressing means one inbox can back hundreds of signups. Disposable email domains and VoIP phone numbers cover verification steps. On the device side, an incognito window defeats cookie-based tracking, a VPN rotates the IP, and anti-detect browsers go further by spoofing the parts of the browser that fingerprinting scripts read. Serious operations run dozens of browser profiles or racks of physical phones in parallel.
Severity varies a lot. A student making a second account for another free month is a nuisance. A ring running thousands of accounts to drain a referral budget or launder marketplace rankings is a business problem. The detection methods are the same either way. The response usually is not.
How to detect it
No single signal proves two accounts belong to the same person, so detection is really account linking. The strongest link is the device. If device fingerprinting puts the same hardware behind five accounts, you have a cluster worth acting on, because clearing cookies or logging out does not change the device. IP addresses are a weaker version of the same idea: useful for spotting bursts of signups from one address, but noisy on their own, since carrier-grade NAT and campus networks put many real users behind one IP.
Identity fields carry their own patterns. Sequential or templated email addresses (jsmith1, jsmith2, jsmith3), plus-addressed variants of one inbox, and disposable domains all point at one operator. Phone numbers from VoIP ranges or number rental services are a similar tell. These checks overlap heavily with fake account detection, since a multiaccounter's extra accounts are by definition fake.
Behavior closes the loop. Accounts that sign up minutes apart, complete onboarding in the same unusual order, or paste into the same form fields tend to share an operator. Behavioral similarity is hard to suppress at scale because it comes from habit rather than configuration, and it catches the case where every technical signal looks clean: fresh device, residential proxy, plausible email, but identical behavior across twenty accounts. When the incentive under attack is a signup bonus or referral payout, the same clusters surface in bonus abuse investigations.
How Rupt handles it
Rupt links accounts through device identity, network signals, and behavior, then exposes the cluster so a policy can decide what happens next: block the signup, require a challenge, or quietly withhold the incentive. The multi-accounting solution page explains how the linking works, and the prevention guide has the policy recipes.