Stop New-Account and Signup-Bonus Abuse: How to Shut Down Multi-Accounting

New-account or signup-bonus abuse, also called multi-accounting, is when one person or an organized ring creates many accounts to claim a promotion repeatedly, most often a new-customer welcome discount, a referral bonus, a free trial, or store credit. Instead of the offer winning a genuine first-time customer, it is farmed by the same actor over and over using disposable identifiers: throwaway or aliased emails, small variations on a name or address, virtual and prepaid cards that produce a fresh number each time, and device or browser spoofing to avoid looking like the same machine. At the casual end it is a customer making a second account for the discount again; at the organized end it is a bot farm or ring harvesting bonuses at scale, sometimes as a step toward larger fraud. The reason it is so effective is that each account looks perfectly legitimate on its own, so a signup check that examines one account at a time cannot see the abuse. It only becomes visible in the relationships between accounts, which is why the effective defenses focus on linking accounts and capping redemptions across the links.

It is common enough that account creation is now the single most-attacked stage of the customer lifecycle. TransUnion’s 2025 fraud analysis found that 8.3% of digital account-creation attempts were suspected of fraud, higher than any other stage from login through transaction, which works out to roughly one in twelve new signups carrying a fraud signal. Not all of that is bonus farming specifically, but signup-time abuse is a major reason the risk concentrates at account creation. Automation is what pushes it to scale: automated traffic now makes up the majority of web traffic, and much of it targets exactly the signup and account-creation flows where offers live, because a welcome discount worth real money is a payout worth automating against. It is worth being honest that the activity spans a spectrum, from a casual customer opening a second account for the discount to a coordinated ring or bot farm harvesting bonuses in bulk. The casual end wastes margin and the organized end wastes real money and pollutes acquisition data, but both are multi-accounting and both are invisible unless you look across accounts rather than at one signup at a time.

You stop it with three controls that work together, because no single one is enough. First, make offers single-use and tokenized, redeemable exactly once and bound to a strong identifier like a verified phone or payment instrument rather than an email address, which costs nothing to multiply. Second, use graph-based detection to link accounts by the signals a ring cannot cheaply vary, device and browser fingerprint, payment instrument, normalized address, and behavioral patterns, so that fifty accounts sharing one device show up as a cluster instead of fifty strangers. Third, set redemption caps per identity, defined by that cluster of strong signals, rather than per account or email, and add velocity limits that throttle bulk signups from one device or network before they even reach redemption. Together these raise the cost of each additional fake account from near-zero to something that deters farming. The crucial guardrail is to remember that real customers sometimes share devices and addresses, so score the strength of a cluster and route suspicious ones to verification rather than blanket-blocking everyone who appears linked.

It can, if you block on links alone, which is exactly the mistake to avoid. Real customers legitimately share devices and addresses all the time: a household with several family members, an office or shared workplace network, a university dorm, or a public library computer will all show multiple accounts on one device or address, and those are genuine customers, not a ring. If you treat any shared signal as proof of abuse and auto-block, you will turn away real buyers and damage the acquisition the offer was meant to drive. The right approach is to score the shape and strength of a cluster rather than the mere existence of a link. Dozens of accounts rapidly churning offers on a single device, with rotating throwaway emails and virtual cards, is a ring; three accounts on a family device accumulated over two years is a household. A good system distinguishes these by the volume, velocity, and pattern of the cluster, and routes the genuinely suspicious ones to a verification step, a confirmation, a challenge, or a hold, instead of a hard rejection. That way you remove the profit from multi-accounting while letting a real second family member still redeem.

Graph-based fraud detection is a technique that models accounts as nodes and their shared attributes as connections, so that accounts linked by the same device, payment instrument, address, or behavioral fingerprint form a visible cluster instead of appearing as unrelated individuals. It matters for multi-accounting because the abuse is not visible in any single account, which looks like a normal new customer, but only in the relationships between accounts, which is precisely what a graph captures. When one device fingerprint connects to forty accounts, or a dozen accounts share a single payment card or a normalized address, that cluster is the multi-accounting ring. The strength of the technique depends on linking on hard-to-vary signals: device and browser fingerprint, payment instrument, and normalized address carry weight, while weak identifiers like email should carry little because they are trivially multiplied. The same relationship view is valuable beyond promo abuse, because the identities in a farming ring often overlap with those behind synthetic-identity and account-takeover activity. Used responsibly, graph detection scores the size and shape of a cluster and sends the suspicious ones to verification, rather than treating every shared link as proof of fraud.

Reducing the offer is a blunt lever that trades away real acquisition to deny fraud, so it is usually the wrong first move. A smaller welcome offer does make farming less profitable, but it also makes the offer less effective at winning the genuine first-time customers it exists for, so you pay for reduced abuse with reduced acquisition, which is often a worse deal than the abuse itself. The better approach is to keep the offer competitive and protect it with controls that raise the cost of abuse without touching the value to real customers: single-use tokenized offers bound to a verified identity, graph-based detection that catches multi-account clusters, and per-identity redemption caps with signup velocity limits. Those controls target the farming specifically, so a real first-time customer gets the full offer while a ring cannot claim it fifty times. There is a place for tuning offer generosity as part of overall economics, but it should not be your primary fraud control, because shrinking the offer punishes your best prospects to inconvenience the abusers, whereas targeted controls remove the abuse and leave the offer intact for the people it is meant to win.