TL;DR: multi-account detection stack for aged accounts
- Identity checks are cheap: Email and SIM verification is a low bar to clear. Disposable inboxes and prepaid SIMs are cheap enough that fifty accounts with fifty different identifiers still trace back to one laptop.
- What cside returns: cside builds a device fingerprint from 250+ browser signals that survives cookie clearing, incognito windows and VPN swaps, and returns both a stable device ID and the count of accounts already tied to it inside your chosen time window.
- How to act on it: If iGaming welcome bonuses or SaaS referral payouts are quietly funding one operator's coffee habit, wire the signal into a delayed-eligibility rule. If IP-based linking is still on your roadmap, cancel it.
Short on time? See cside's real-time signup-fraud detection. It covers everything below in one deployment.
Multi-accounting is one person running several accounts on the same platform to claim a bonus, referral reward, or promo offer more than once. Multi-accounting detection software links those accounts back to a single operator so you can catch the abuse before the payout goes out.
The attacker uses a fresh email, phone number, and payment method for every account, which is why identity checks alone miss the pattern. The device fingerprint is different. It comes from hardware and browser signals the attacker cannot swap by rotating credentials, so it stays constant across all fifty accounts and links them together.
| Tool | Signal used | Catches same-device multi-accounting | Works across incognito sessions | Free tier |
|---|---|---|---|---|
| cside | Browser-layer hardware fingerprint | Yes | Yes | Yes, 1,000 API calls/mo |
| Email/phone verification | Identity document validation | No, disposable identifiers bypass it | N/A | Varies |
| IP-based linking | IP address correlation | Partial, shared IPs cause false positives | No | Varies |
Where multi-accounting causes the most damage
iGaming and online casinos are the highest-exposure vertical. Welcome bonuses, free spins, and deposit match offers exist to acquire new customers. A single operator creating dozens of accounts to claim each welcome offer multiple times turns an acquisition cost into a direct loss. The economics are simple: if the bonus is worth more than the cost of creating an account, multi-accounting turns a profit.
SaaS with referral programs face a different version of the same attack. If a referral bonus pays $50 per new user referred, one person creating accounts to refer to themselves and collect on each referral is pulling money straight out of the referral budget.
Fintech and neobanks with new-account bonuses (sign-up credits, cashback on first transactions) face multi-accounting from organized groups that treat account creation as a revenue operation.
In every one of these cases the attacker's play is identity rotation: a new email, a new phone number, a new payment method for each account. Verification that only checks whether an email or phone is valid has no way to tell that the same person on the same laptop opened fifty accounts.
cside: device fingerprinting for multi-account linking
cside multi-accounting detection builds a stable device fingerprint from over 250 browser signals during each registration session. That fingerprint holds up across cookie clearing, incognito windows, and VPN use, the evasion tricks multi-accounters lean on, because it comes from physical hardware: GPU rendering output, font metrics, canvas entropy, WebGL behavior, and audio context.
When the same fingerprint shows up on more than one account, cside flags the link. It returns a stable device fingerprint ID for the session, a signal for whether that fingerprint has already been seen on other accounts, and the number of accounts tied to it within a time window you set.
Your platform decides what to do with that signal: delay bonus eligibility for new accounts on linked devices, ask for extra verification before a high-value promotion, or block registration outright when the device is already linked to a flagged account.
The detection runs passively. A legitimate user opening a single account from their own device sees no extra friction. Only registrations from devices already tied to other accounts surface in the signal.
Email and phone verification
Email and phone verification confirm that the person registering controls the email address or phone number they entered. They are a useful baseline against low-effort multi-accounting from casual bad actors who use obviously fake identifiers.
They do nothing against anyone with a supply of disposable email addresses or prepaid SIM cards, both cheap and widely used by multi-accounting operations. Someone who registers fifty accounts with fifty different emails from one laptop walks straight past email verification. Device fingerprinting is the control that catches that scenario.
IP-based account linking
IP-based linking flags accounts that register from the same IP address. It catches some cases, mainly attacks run from a single machine on a static IP, but it produces both false positives and false negatives in practice.
False positives: households, offices, and student dorms share IP addresses. Flag every account from one IP and you catch multi-accounters along with legitimate users who happen to share a connection.
False negatives: VPNs and residential proxies change the apparent IP with every session. An operator rotating VPN connections gets a fresh IP for each registration and slips past IP-based linking completely.
Device fingerprinting avoids both failure modes. The fingerprint changes only when the physical device changes.
