TL;DR: Akamai reported AI-powered bot traffic increased 300% in a year, while Sumsub found multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025, showing that signup fraud is becoming more automated and coordinated, according to Sift's analysis. Single checks no longer hold up against fraud rings that combine device, network, behavioral, and identity signals.
At a glance
What this is: Sift argues that fake account detection now depends on combining device, network, behavioral, and identity signals because single checks are no longer enough against automated signup fraud.
Why it matters: This matters to IAM and fraud practitioners because signup abuse directly affects identity proofing, account lifecycle controls, trust and safety operations, and the quality of downstream customer identity decisions.
Context
Fake account detection is a governance problem as much as a fraud problem. Self-serve registration creates a low-friction entry point, and once a fake account exists, it can be used for promotion abuse, platform manipulation, or account takeover staging. The control challenge is that modern fraud rings now mix real and synthetic identity artefacts, so teams cannot rely on one check at the form boundary.
The article’s identity angle is strongest where fake signup prevention overlaps with identity verification and customer account governance. That boundary matters for marketplaces and SaaS platforms because the first trust decision is often made before a customer relationship truly exists, which means teams need layered decisioning rather than a single pass or fail rule.
Key questions
Q: What breaks when fake account detection relies on a single check?
A: A single check only sees one layer of risk, so fraudsters can route around it by changing the specific artefact that control inspects. Email validation, CAPTCHA, or document review may each work in isolation, but none of them proves that the signup is tied to a real person, a trustworthy device, and a plausible behaviour pattern at the same time.
Q: Why do layered signals catch more fake accounts than identity verification alone?
A: Identity verification can confirm that a document or selfie looks valid, but it does not tell you whether the applicant is part of a coordinated fraud operation. Layered signals add device, network, and behavioural context, which helps distinguish a real user from a manufactured account even when the identity artefacts appear credible.
Q: What are the signs that a login or signup flow is being abused by bots?
A: Common warning signs include unrealistically fast actions, repeated attempts at high volume, limited behavioral flexibility, and inconsistencies with a user’s normal device or location pattern. A sudden shift in IP address, browser, or geography can also be a signal. None of these indicators prove fraud alone, but together they help teams distinguish automation from legitimate human behavior.
Q: How should fraud teams respond when fake accounts are linked across many registrations?
A: Treat the pattern as a cluster problem, not an isolated account review. Review shared infrastructure, verify whether the same device or network pattern appears across multiple signups, and use the confirmed cases to tune scoring, challenge rules, and analyst escalation so the next wave is caught sooner.
Technical breakdown
Why single checks fail at signup
Standalone controls such as email checks, CAPTCHA, or document review each see only a narrow slice of the signup event. Fraudsters exploit that narrowness by changing the artefact that a specific control examines, while keeping the overall fraud campaign intact. The technical issue is not that one signal is weak in every case, but that no single signal can prove personhood, device continuity, and behavioural plausibility at the same time. Effective fake account detection therefore correlates multiple weak signals into one risk decision instead of treating any one check as authoritative.
Practical implication: Design signup controls as a layered decision chain, not as isolated gates.
How device, network, and behaviour signals work together
Device intelligence links sessions that look unique at the surface but originate from the same physical or emulated environment. Network reputation adds context by distinguishing residential, proxy, VPN, and data centre traffic, while behavioural analysis looks for speed, input sequence, and interaction patterns that do not match human signup behaviour. Each signal is probabilistic on its own, but together they raise confidence that a signup is manufactured. This is why modern fraud platforms weight the whole registration event and then keep watching after approval.
Practical implication: Fuse telemetry across device, IP, and interaction layers before you make a trust decision.
Why velocity and link analysis matter after approval
A fake account may look clean at first but still belong to a coordinated ring that shares devices, payment instruments, shipping addresses, or recovery details across many registrations. Velocity analysis catches bursts and repetition that are invisible when each signup is judged alone. Link analysis then exposes the graph behind the fraud, showing how accounts cluster around shared infrastructure or reused attributes. That is especially important for SaaS trials and marketplaces, where the harm often appears only after the account starts consuming credits, posting listings, or manipulating platform metrics.
Practical implication: Keep evaluating accounts after signup so linked abuse patterns can be detected before downstream loss scales.
Threat narrative
Attacker objective: The objective is to create trusted-looking accounts that can be monetised through abuse, manipulation, or downstream fraud.
- Entry occurs through self-serve signup flows where fraudsters use synthetic identities, disposable contact details, bots, or device farms to create accounts at scale.
- Credentialless trust abuse follows when those accounts pass fragmented checks by varying the signal each control inspects, such as the email domain, phone number, device, or IP reputation.
- Impact comes when the fake accounts are used for promo abuse, fraudulent listings, review manipulation, free-trial exploitation, or as a staging point for broader account abuse.
Breaches seen in the wild
- Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.
- 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Layered signal analysis is now the minimum viable control for fake account governance. Single checks fail because fraud rings can adapt one artefact at a time, while the platform still treats the signup as trustworthy. Device, network, behaviour, and identity telemetry only becomes useful when it is fused into one decision model. Practitioners should treat trust as a scored outcome, not a checkbox.
Fake account detection is an identity governance problem at the point of account creation. This is where identity proofing, fraud detection, and account lifecycle control overlap. When platforms accept synthetic or coordinated identities at signup, every downstream control inherits that error, so the real issue is not just fraud loss but polluted identity records. The practical conclusion is that customer onboarding controls must be designed as governance gates, not convenience features.
Verification fatigue is the wrong operating model for modern signup fraud. The article shows why binary approve-or-block logic breaks down when legitimate users and fraud rings both resemble high-risk edge cases. Risk-based friction is the correct pattern because it preserves conversion for low-risk users while concentrating challenge steps where the signal stack justifies them. Practitioners should move away from uniform friction and toward adaptive trust decisions.
Fraud rings now behave like coordinated ecosystems, not isolated bad actors. That shifts the control problem from one-off detection to pattern recognition across accounts, devices, and behavioural clusters. For identity and fraud teams, the implication is clear: isolated platform data will always miss some of the picture, so feedback loops and signal sharing matter as much as the first-line controls. Teams should optimise for correlation, not just blockage.
What this signals
Verification fatigue is a real risk for marketplaces and SaaS teams. If every signup sees the same friction, legitimate users are slowed while sophisticated fraud still slips through the gaps. The better model is adaptive friction that responds to risk signals at the point of decision.
Identity proofing and fraud detection are converging at the onboarding stage. That means customer identity controls can no longer live only in KYC workflows or only in fraud tooling. Practitioners need a shared decision layer so onboarding, verification, and abuse detection use the same trust picture.
Linked-account analysis is becoming as important as single-account review. Fraud rings reuse devices, payment methods, addresses, and recovery details across many signups, so the operational win comes from seeing the cluster. Teams that only score accounts one at a time will keep missing the wider campaign.
For practitioners
- Implement layered signup scoring Combine device, network, behavioural, and identity data into a single risk decision so no single check can be gamed in isolation.
- Add adaptive friction for higher-risk signups Route clean traffic through with minimal delay and escalate only the suspicious cohort to extra verification steps such as email or phone confirmation.
- Review post-signup behaviour continuously Re-score accounts after creation so a signup that looks legitimate at first can still be challenged if it later shares infrastructure or abuse patterns with other accounts.
- Build fraud link analysis into case review Investigate shared device fingerprints, payment instruments, shipping addresses, and recovery details to uncover account clusters rather than single events.
- Feed analyst findings back into the model Use confirmed fraud cases to update proxy ranges, device clusters, and synthetic identity patterns before the same campaign expands.
Key takeaways
- Fake account abuse is no longer a simple signup nuisance because fraudsters now combine automated tooling, synthetic identity elements, and coordinated infrastructure.
- The control failure is treating one signal as decisive when fraud detection now depends on correlating device, network, behavioural, and identity evidence.
- Fraud teams should shift to adaptive, layered decisioning and post-signup monitoring so high-risk clusters are challenged before they damage platform trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Fake accounts are created outside legitimate lifecycle controls and later abused as durable identities. |
| NHI-10 — Human Use of NHI | Fraud rings often mix human operators, automation, and fake accounts to bypass trust controls. | |
| Recommendation — Apply NHI-01 controls to stop unauthorized account creation and remove fraudulent identities quickly. Treat human-in-the-loop fraud operations as a governance risk and verify who is operating each identity. | ||
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article sits at the boundary of account enrolment and identity proofing for self-serve onboarding. |
| Recommendation — Strengthen enrollment checks where account creation feeds downstream trust decisions. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Fraudulent accounts depend on weak credential and recovery controls once created. |
| Recommendation — Use IA-5 to govern credential issuance, recovery, and lifecycle controls for new accounts. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account management is central because fake accounts exploit weak creation and review processes. |
| Recommendation — Harden CIS-5 account governance to detect and remove unauthorised or abusive registrations. | ||
Key terms
- Duplicate Account Detection: Duplicate account detection is the process of identifying when one person or fraud ring controls multiple player accounts. The strongest versions connect device data, payment methods, behavioural similarity, and referral relationships so teams can stop repeat abuse before bonuses are converted into losses.
- Layered Signals: Layered signals are multiple independent indicators used together to make a trust decision. In fraud detection, they reduce reliance on any single check by combining evidence from the session, the device, the network, and the identity artefacts presented during signup.
- Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
- Risk-Based Friction: Risk-based friction is the practice of applying extra verification, inspection, or policy constraints only when signals indicate elevated abuse or loss exposure. It protects the merchant without forcing every customer through the same slow process, which is essential when trust and conversion must both be preserved.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course if your role spans identity governance, trust decisions, or the controls that sit around account creation.
Published by the NHIMG editorial team on August 1, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org