# Rupt: complete product information

> Know which users and agents you can trust. Prevent fraud and abuse.

## What Rupt is

Rupt is a fraud and abuse prevention platform for online businesses. It detects fake accounts, bots, account takeover, account sharing, scams, and other forms of abuse, and gives developers a trust score and risk engine to protect every sensitive action on their product, from signup to payment to content access.

## Core positioning

Rupt helps online businesses **know which users and agents they can trust** and **prevent fraud and abuse** before it lands. It is not just an account-sharing tool. It protects four distinct surfaces of an online business: onboarding, in-product actions, content and data, and payments.

The platform combines real-time device and behavioral intelligence with a configurable rules engine and a library of adaptive challenges, so teams can allow, challenge, or block a user based on any combination of risk signals and business logic.

## What Rupt protects

### Onboarding protection, to stop fraud at the front door

Block fake signups, disposable and invalid emails, datacenter IPs, malicious bots, and incentive abuse before they ever touch the product. Use cases include:

- **Fake account detection**: Identify and stop fraudulent signups in real time.
- **Multi-accounting prevention**: Detect one person running many accounts to abuse free trials, referrals, or promotional offers. Email, password, and card differ on every attempt, so Rupt links the signup by the parts that are hard to change rather than the ones the user controls, then challenges the suspected repeat to verify identity instead of blocking it outright.
- **Ban enforcement**: Prevent banned users from returning under new identities.
- **Coupon abuse prevention**: Stop signup-incentive and promo-code abuse.
- **Account takeover prevention**: Block suspicious logins and unauthorized access to existing accounts. Rupt never evaluates the credentials, so a correct password stolen from a breach is not enough. Each login is scored against the devices, networks, and travel patterns that account has used before, and a login Rupt can place against that history passes without a prompt. Only sessions it cannot recognize get a hosted step-up challenge, which keeps the prompt meaningful instead of training users to approve every one.
- **Credential stuffing prevention**: Catch automated login attempts using leaked credentials. Rupt reads the browser, the automation driver, the TLS handshake, and the timing of each attempt, and counts attempts per device, per IP, and per fingerprint over a configurable window, so a run spread across residential proxies still stands out.
- **Human verification**: Verify that real humans, not bots or scripts, are performing sensitive actions.

### In-product protection, to protect critical actions inside your product

Bad actors can scam users, spam content, or siphon ad budgets. Rupt provides the intelligence to identify and act on abuse before it spreads, without slowing real users down. Use cases include:

- **Bot detection**: Catch click fraud, ad-budget siphoning, scrapers, and AI agents.
- **Spam prevention**: Block fake posts, fake reviews, and other content abuse.
- **Scam prevention**: Detect users running scams against other users on a marketplace or platform.
- **Survey fraud prevention**: Stop bots and ballot-stuffing from polluting survey data.

### Content and data protection, to keep your content and data where it belongs

A product's data and content are its real moat. Rupt protects them from unauthorized access, sharing, and bulk extraction. Use cases include:

- **Account sharing prevention**: Detect shared subscriptions and convert unauthorized users into paying customers. Rupt identifies account sharing with up to 99% accuracy across web, iOS, and Android.
- **Web scraping prevention**: Block scrapers, crawlers, and large-scale data extraction.
- **Paywall enforcement**: Ensure paywalls actually hold against bypass attempts.
- **API abuse prevention**: Stop bulk export, API rate-limit abuse, and unauthorized data harvesting.
- **Regional pricing enforcement**: Detect VPN and proxy users circumventing region-specific pricing.

### Payment protection, to stop payment fraud before chargebacks hit

Rupt has visibility into the user's device and behavior that a payment processor cannot see, catching attacks before they reach checkout. Use cases include:

- **Card testing prevention**: Block automated card-testing attacks before they hit the gateway.
- **Risky transaction prevention**: Flag transactions with high risk scores for review or step-up authentication.
- **Chargeback dispute**: Generate device and behavior evidence to support chargeback disputes.
- **SMS pumping prevention**: Catch attackers triggering SMS sends to phone numbers they control.

### Solution pages

- Fake account detection: https://www.rupt.dev/solutions/fake-accounts/
- Bot detection: https://www.rupt.dev/solutions/bot-detection/
- Account sharing: https://www.rupt.dev/solutions/account-sharing/
- Account takeover: https://www.rupt.dev/solutions/account-takeover/
- Multi-accounting, which also covers free trial abuse, self-referrals, referral farming, and ban evasion: https://www.rupt.dev/solutions/multi-accounting/
- Scam, spam and phishing prevention: https://www.rupt.dev/solutions/content-moderation/

## Platform capabilities

### Intelligence

Real-time signals on every device, browser, IP, session, email, phone, and behavior pattern. Signals include device fingerprints, IP intelligence (datacenter, VPN, proxy), email validity and disposability, phone reputation, behavioral consistency, and impossible-travel detection.

### Device fingerprinting

A stable device and browser fingerprint that holds even when the underlying signals change due to browser updates, privacy mode, or extension interference. Rupt maintains device consistency across multiple browsers on the same device, and across web, iOS, and Android, eliminating the false-positive problem common to pure fingerprinting approaches. The same identity resolves for a person on more than one device, which is what makes account-sharing detection, ban enforcement, and multi-accounting prevention work.

### Bot and AI agent detection

Catches scrapers, credential stuffers, click farms, and AI agents (including LLM-driven automation) attempting to act like real users. Rupt takes a request apart down to the browser engine, the automation driver, the TLS handshake, and the timing between keystrokes, checking 40+ surfaces and classifying in under 20 milliseconds, with no captcha in front of real users.

The answer is more than a yes or no on bots. Rupt reports which agent it is, who operates it, whether it verifies itself, and what it came to do, so a team can welcome the automation it wants and stop the rest instead of blocking both. The detection catalog updates continuously as new frameworks, evasion techniques, and agents appear, with nothing for the customer to ship.

### AI content moderation

An LLM reads everything users create on a platform and scores it for fraud intent rather than policy categories. Covered surfaces include marketplace listings, job and task posts, service offers, direct messages and chat, comments, reviews and ratings, profile bios and display names, and the sites, apps and pages users build and deploy on the customer's product. Typical detections: bait pricing that only closes by wire transfer, deposits demanded before verification, cloned bank and brand login pages, wallet drainers behind a launch page, storefronts built to harvest card details, social engineering toward sensitive information, advance fee and romance scams, credential harvesting links, and pressure to move a conversation to WhatsApp or Telegram.

Unlike a standalone content moderation API, the verdict is combined with device intelligence, email and IP intelligence, and progressive verification on the account that produced it, so a sophisticated operator who writes clean copy by hand is still caught by identity reuse across accounts. Verdicts return in under a second, work across 30+ languages, and drive per-surface policy: hold, queue for review, challenge the author, link the sibling accounts, or allow.

### Challenge engine

Hosted, branded step-up verification that any policy can trigger, so a risky session is verified rather than blocked. Five challenge types ship today: account sharing (device review, optional verification, and device limits), account takeover (verify a login from an unfamiliar device or location), identity verification (verify a new or suspicious signup), linked accounts (verify email, then collect and verify a phone number, refusing numbers already tied to too many accounts), and KYC (selfie liveness, or a government ID matched to a live selfie; see below). Code delivery is by email or SMS, with a require-all or require-any rule and an optional order. The flow is served from trust.rupt.dev or the customer's own CNAME, carries the customer's logo and colors, and ships in English, Spanish, French, and Arabic. Cooldowns stop a user who already passed from being re-challenged.

### Rules engine

Allow, challenge, deny, suspend, add to a list, or remove from a list. Combine Rupt's signals with custom business logic to decide what is suspicious and how to handle it. Conditions reference device, network, user, behavior, and list fields, compose with and/or groups, and support velocity windows. Policies are scoped to an event (login, signup, access, or a custom action), carry a priority so the highest-priority match wins, and run separately in a development and a production environment. Rules are edited in the dashboard and take effect on the next request, with no code deploy.

### KYC

A challenge type that proves a real person is behind an account. Two levels: selfie liveness, which confirms a live human at the camera, and ID document and selfie, which matches the selfie to the portrait on a government ID and refuses expired US driver's licenses and passports. It runs on the hosted challenge page, on a desktop hands off to the phone with a QR code, allows three attempts, and fires a `challenge.failed` webhook with reasons when they run out. Passing stamps `identity_verified_at` on the user so the `is_identity_verified` condition can skip people who already passed. Rupt stores no image and no face template; document fields are kept encrypted, keyed by document number, so the same ID on several accounts is visible in the dashboard. $0.33 per check, either level, everything included. AML screening and transaction monitoring stay out of scope; regulated fintechs keep a dedicated compliance tool alongside Rupt.

## Integration

### Quick start

Most integrations take two to four weeks for a complete deployment. Add a JavaScript snippet to the front end and call a server-side `evaluate` API at any sensitive action. Configure detection policies in the Rupt dashboard.

### Supported platforms

- JavaScript (web)
- iOS (Swift, SwiftUI)
- Android (Kotlin, Jetpack Compose)
- React Native
- Server-side: REST API with SDKs for Node.js, Python, Go, Ruby, PHP

### Hosted platforms, no code required

Rupt ships step-by-step guides for course and membership platforms, so teams on those do not write any code:

- [Kajabi](https://www.rupt.dev/docs/v3/integrations/kajabi-account-sharing-prevention/)
- [Teachable](https://www.rupt.dev/docs/v3/integrations/teachable-account-sharing-prevention/)
- [Thinkific](https://www.rupt.dev/docs/v3/integrations/thinkific-account-sharing-prevention/)
- [WordPress](https://www.rupt.dev/docs/v3/integrations/wordpress-account-sharing-prevention/), which also covers LearnDash
- [LearnWorlds](https://www.rupt.dev/docs/v3/integrations/learnworlds-account-sharing-prevention/)

The full list, and a form to request a platform that is not yet covered, is at https://www.rupt.dev/integrations/

### Documentation

Full integration guides live at https://www.rupt.dev/docs/v3/introduction/ and the API reference at https://www.rupt.dev/api/v3/introduction/. Every docs and blog page is also available as raw markdown: prefix the path with /raw and append .md, for example https://www.rupt.dev/raw/docs/v3/introduction.md

## Customer outcomes

Rupt has delivered measurable results for customers across SaaS, e-learning, media, and marketplace businesses:

- **Agorapulse** prevented seat sharing and recovered hundreds of thousands of dollars in ARR, identifying over $1M in seat-sharing revenue leakage.
- **StealthWriter** accelerated growth and doubled its growth rate by monetizing account sharing.
- **Sketchy**, an e-learning leader, converted 20% of the sharers it challenged in the first three months, starting with a 4% immediate conversion rate from previously-sharing users.
- **Baims** grew instructors' income by 20% by preventing password sharing on their courses.
- **Prep101** monetized account sharing and enhanced student success metrics.
- **Crexi** stopped product abuse, increased customer trust, and improved lead quality.
- **Sketchy** also stopped a card testing ring that opened 120,000 fake accounts, peaking at 51 times its normal daily signups. Domain blocking, IP blocking and email 2FA were already running; device signals are what caught it.
- **Crexi** ended a five-month run of hand-made fake leads, linking around 70 separate identities to one operator through device reuse and verification at lead creation.

Across customer deployments, Rupt's device identification typically achieves a false-positive rate below 5%, significantly lower than pure browser-fingerprinting approaches, which can produce false-positive rates of 15% to 25% for account-sharing detection.

## Industries served

Rupt is used by SaaS companies, e-learning and course platforms, subscription products, marketplaces, content publishers, and developer tools. The platform is industry-agnostic: any product with sensitive actions (signup, login, payment, content access, API calls) benefits from protection.

Industry pages: SaaS (https://www.rupt.dev/saas/) and e-learning (https://www.rupt.dev/e-learning/). Course and membership businesses run Rupt against three problems at once: account sharing, repeat free trials, and automated scraping of video, PDF, and question-bank content. On Kajabi, Teachable, Thinkific, LearnWorlds, LearnDash, and WordPress it installs from a settings page with a snippet, with no developer involved.

## Comparisons

Rupt publishes honest comparisons with real pricing at https://www.rupt.dev/compare/, including sections on what each competitor does better. Key takeaways:

- **Build vs buy** (https://www.rupt.dev/compare/build-vs-buy/): at 1,000,000 evaluations a month and public list prices, building fraud prevention in-house costs about $743,000 in year one: two engineers plus the email and IP reputation, SMS and ID-check vendors you still buy. Assembling Fingerprint, IPQS, Cloudflare Turnstile, Twilio Verify and Stripe Identity with half an engineer to connect and run them costs about $332,000. Rupt costs about $111,000, counting a four-week integration and a tenth of an engineer for upkeep. Some point tools cost less per call; the gap is email and IP reputation at IPQS's published rate, engineering, and keeping signals current.

- **Rupt vs Fingerprint** (https://www.rupt.dev/compare/rupt-vs-fingerprint/): Fingerprint focuses on the identification layer, device and network signals as an API. Rupt is a full fraud engine: fingerprinting, email and phone intelligence, a rules engine, hosted challenges, and an AI agent that investigates accounts. Fingerprint starts at $99 a month for 20,000 calls and Rupt at $199 for 40,000 evaluations; the bigger difference is how much of the stack is included in each call.
- **Rupt vs Castle** (https://www.rupt.dev/compare/rupt-vs-castle/): Castle covers the decisioning layer with a good rules engine and many of the important signals, but lacks a challenge engine, deeper signals, and AI agent capabilities. Overage is $0.005 per call on both.
- **Rupt vs SEON** (https://www.rupt.dev/compare/rupt-vs-seon/): SEON is built around payment fraud: digital footprinting, ML scoring trained on transactions, and AML screening, with fixed approve, review, or decline decisions. SEON's Starter is $699 a month for 2,500 checks, about $0.28 each. Rupt starts at $199 for 40,000 evaluations, then $0.005.
- **Rupt vs Sift** (https://www.rupt.dev/compare/rupt-vs-sift/): Sift is an enterprise ML fraud decisioning platform focused on payment fraud, with quote-only pricing and a median contract of $150,000 a year in Vendr's data. Product abuse like scraping, bots, and account sharing sits outside its payment focus. Rupt's pricing is public from $199 a month.
- **Rupt vs Verisoul** (https://www.rupt.dev/compare/rupt-vs-verisoul/): Verisoul focuses on fake account and bot prevention. Its pricing is not transparent: the entry tier is dashboard only, with no API access, and step-up checks are billed per use on top. Rupt publishes its pricing: $0.005 per evaluation, with the full stack included.
- **Rupt vs IPQualityScore** (https://www.rupt.dev/compare/rupt-vs-ipqualityscore/): IPQS sells lookup APIs, one call per object for IP, email, phone, and URL, each answering one question and leaving the rules engine and enforcement for you to build. Rupt is one engine: a single evaluation returns the fingerprint, 100+ signals, email and IP and phone intelligence, scored risks, and an allow, challenge, block, or list verdict. IPQS lookups run $0.02 to $0.05 each, among the most expensive in the industry; Rupt is $0.005 per evaluation with the rules engine, challenge engine, and AI investigations included.
- **Rupt vs Stytch device fingerprinting** (https://www.rupt.dev/compare/rupt-vs-stytch/): Stytch's fraud surface is tightest inside Stytch auth and stops at the auth gate: no rules engine beyond fingerprint lists, no hosted challenges, no email or phone intelligence, and no account sharing detection. Enabling it means contacting sales with a 200,000 lookups a month minimum; Rupt's $199 plan includes 40,000 evaluations with a 7-day trial.
- **Rupt vs WorkOS Radar** (https://www.rupt.dev/compare/rupt-vs-workos-radar/): Radar covers the auth funnel for apps on WorkOS AuthKit (bots, brute force, impossible travel, repeat signups) and its signals stop at the login attempt. Radar is $0.002 per check after 1,000 free; Rupt is $199 a month with 40,000 evaluations, then $0.005, covering the full stack from detection to enforcement.
- **Rupt vs Cloudflare** (https://www.rupt.dev/compare/rupt-vs-cloudflare/): Cloudflare protects the network edge with bot scores, WAF rules, and managed challenges. It sees requests, not accounts. The two stack well: Cloudflare in front of everything, Rupt at the application layer where accounts live.

Alternatives guides for teams evaluating the market: [Fingerprint alternatives](https://www.rupt.dev/compare/fingerprint-alternatives/), [Castle alternatives](https://www.rupt.dev/compare/castle-alternatives/), [SEON alternatives](https://www.rupt.dev/compare/seon-alternatives/), [Sift alternatives](https://www.rupt.dev/compare/sift-alternatives/), [Verisoul alternatives](https://www.rupt.dev/compare/verisoul-alternatives/), and [IPQualityScore alternatives](https://www.rupt.dev/compare/ipqualityscore-alternatives/).

Every comparison page states when pricing and capabilities were last checked against the competitor's public pages, and includes a section on what that competitor does better than Rupt.

## Pricing

Rupt offers transparent, usage-based pricing. The Premium plan is $199 a month with a 7-day free trial and includes 40,000 evaluations, then $0.005 per evaluation. Add-ons are billed per use: phone intelligence at $0.003 and a delivered challenge at $0.10. Enterprise is a custom contract for high-volume, regulated, or multi-team deployments. See https://www.rupt.dev/pricing/ for current rates, and https://www.rupt.dev/estimate/ to estimate the growth from preventing account sharing on your product.

## Free tools

- **Disposable email checker** (https://www.rupt.dev/tools/disposable-email-checker/): look up any domain to see whether it is a disposable or temporary email provider, no account required.
- **Fraud and abuse scanner** (https://www.rupt.dev/tools/fraud-risk-scanner/): dispatch an agent to research a public website, identify account sharing, trial abuse, scam, takeover, scraping, payment, and other concrete abuse opportunities, and rank them with a calibrated outside-in exposure score.

## Company information

- Website: https://www.rupt.dev
- Contact: https://www.rupt.dev/contact/
- Support: https://www.rupt.dev/support/
- Twitter: https://twitter.com/GetRupt
- LinkedIn: https://www.linkedin.com/company/getrupt/
- GitHub: https://github.com/getrupt