---
title: Linked accounts
description: Linked accounts are separate accounts that share identifying state (the same fingerprint or the same IP) when they should be independent. Useful for catching multi-accounting and ban evasion.
---

# Linked accounts

Linked accounts are accounts that look independent but share identifying state underneath. The clearest case is one [fingerprint](/docs/v3/concepts/fingerprints) showing up across accounts that should belong to different people. That's the signature of multi-accounting: one person running many accounts to farm referrals, dodge a ban, stack free trials, or stuff a vote.

Rupt scores this risk on the `login` and `signup` [actions](/docs/v3/concepts/actions), because the same person can resurface at either. It skips `access`: linkage is established when an identity is asserted, and the heartbeat action would only repeat what the login already said.

## What Rupt looks for

- **Shared fingerprint**: how many distinct users a single [fingerprint](/docs/v3/concepts/fingerprints) has been seen on. One device behind one account is normal. One device behind a dozen accounts is not.
- **Shared IP**: how many distinct users have been seen on the same [IP](/docs/v3/concepts/ip) in the last 180 days. Weaker evidence than a fingerprint match, so it carries fewer points.

## Severity and response

Those checks feed a `linked_accounts` [risk](/docs/v3/concepts/risks) severity. Shared devices and networks have innocent explanations, like a family computer, an office machine everyone logs into, or a campus network, so the count matters more than the sharing itself. A handful of accounts on one fingerprint is plausible; dozens is a ban-evasion ring. Most teams [add the device to a list](/docs/v3/concepts/lists) for review and escalate to a [challenge](/docs/v3/concepts/challenges) or `deny` as the count climbs. Your [policies](/docs/v3/concepts/policies) decide where normal ends.