Multi-accounting fraud is a network problem, not an account problem

At a glance

What this is: Sift describes multi-accounting fraud as a networked abuse pattern in which one actor or ring runs several accounts to exploit bonuses, evade enforcement, and distort platform economics.

Why it matters: For identity, fraud, and platform security teams, the key lesson is that per-account controls miss the relationship signals that reveal coordinated abuse across accounts.

Context

Multi-accounting fraud is a governance problem because the unit of abuse is not a single account, but the relationship between many accounts, devices, payments, and sessions. A platform that only scores each account in isolation will miss the network structure that fraud rings deliberately create to look legitimate.

The identity angle is indirect but real: the issue is not whether an account exists, but whether the platform can trust that multiple enrolled identities are actually distinct people or legitimate households. In marketplaces and iGaming, that trust failure distorts incentives, enforcement, and the reliability of fraud controls.

Key questions

Q: What breaks when multi-accounting fraud is evaluated one account at a time?

A: Single-account evaluation misses the relationship pattern that defines multi-accounting. A fraudster can vary emails, phone numbers, payment methods, and timing so each profile looks plausible on its own. The failure is not in the account record, but in the absence of linkage analysis across devices, behaviours, and infrastructure.

Q: Why does multi-accounting remain effective even with strong registration checks?

A: Because registration checks validate enrollment details, not whether several enrollments belong to the same actor. Fraudsters can vary emails, phone numbers, devices, and timing while still reusing infrastructure and behaviour. The governance gap is that identity proof at sign-up does not prove identity uniqueness across the platform lifecycle.

Q: How do fraud teams know whether network analysis is actually working?

A: It is working when linked-account clusters are detected before bonus redemption, seller re-entry, or rating manipulation becomes widespread. Strong signal quality shows up as lower false positives on shared networks and more consistent escalation against coordinated patterns. If only obvious duplicates are caught, the model is still too shallow.

Q: Should marketplaces and iGaming platforms use IP blocking for multi-accounting?

A: IP blocking can be part of the stack, but it is too weak to stand alone because residential proxies and shared household networks both undermine its value. A better approach combines IP, device, behavioural, and payment-link analysis, then applies friction only where the cluster risk justifies it.

Technical breakdown

Why single-account rules miss coordinated fraud rings

Multi-accounting works because many fraud controls are designed to evaluate one profile at a time. That model breaks when the same person or ring distributes activity across multiple registrations, devices, IPs, and payment instruments. Rules like velocity checks and duplicate-email detection can catch obvious reuse, but they do not resolve whether separate accounts belong to one actor. The core technical issue is correlation across entities, not suspicious behaviour inside any single account.

Practical implication: move detection from isolated account scoring to relationship analysis across registrations, devices, sessions, and payments.

How device, network, and behavioural reuse exposes account clusters

Fraudsters hide behind device farms, emulators, and residential proxies, but those layers still leak shared signals. Hardware fingerprints, battery and screen context, subnet timing, navigation cadence, and typing rhythms can all form edges in a graph of linked accounts. Graph analysis matters because it turns weak, individually ambiguous signals into a stronger cluster view. The technical value is not any one indicator, but the convergence of many small resemblances across accounts that appear unrelated on the surface.

Practical implication: enrich fraud models with graph features that connect accounts through shared infrastructure and behaviour.

Why network intelligence improves response without blocking legitimate users

Network intelligence lets teams apply friction only when a cluster crosses a risk threshold, instead of punishing every user who shares an IP, device type, or access pattern. That distinction is important in marketplaces and iGaming, where legitimate users may share networks or household infrastructure. The control objective is selective verification, not blanket denial. Used well, network-level signals let operators target abuse while preserving conversion for low-risk users and reducing false positives that can damage customer experience.

Practical implication: tune friction and step-up verification to cluster risk, not to single-signal anomalies.

Threat narrative

Attacker objective: The attacker objective is to monetise platform incentives and bypass enforcement by making one coordinated operator look like many unrelated users.

1. Entry begins with mass registration across multiple identities, often using separate emails, phone numbers, payment methods, and staggered sign-up timing to avoid velocity rules.
2. Credential and environment reuse follow as the same operator or ring routes activity through shared device farms, emulators, residential proxies, and repeated behavioural patterns that look independent at account level.
3. Impact occurs when the cluster claims bonuses, evades enforcement, manipulates ratings, or re-enters marketplaces after bans, converting false identity diversity into platform loss.

Breaches seen in the wild

• JetBrains Marketplace AI Plugin Campaign: 15 malicious JetBrains Marketplace plugins steal AI API keys from 70,000+ developers via supply chain attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Network-level trust is now the decisive fraud control boundary. Multi-accounting is not primarily an account hygiene problem, because the abuse is created by coordination across identities, devices, and payment paths. Controls that stop at the account boundary will always under-read the threat. Practitioners should treat relationship signals as first-class security data, not as secondary enrichment.

Identity proofing alone does not solve multi-accounting. A platform can collect strong registration data and still be exposed if the same actor can reuse infrastructure and behavioural patterns across many records. That is the governance gap this article surfaces: assurance at enrolment does not equal assurance at use. The operational conclusion is that fraud governance must extend beyond onboarding into ongoing linkage analysis.

Multi-accounting creates fraud governance debt. Every tolerated cluster weakens promotional integrity, rating integrity, and enforcement credibility, which then reduces the quality of future fraud signals. In practice, the platform begins to train itself on contaminated data. Practitioners should assume that delayed network detection compounds into higher investigation cost and lower model quality.

Selective friction is the right response to clustered abuse. Broad blocking policies tend to increase false positives, especially where households, workplaces, or shared networks are normal. The better model is to escalate verification only when link-analysis confidence crosses a threshold. That keeps conversion intact while still making coordinated abuse economically unattractive.

Multi-accounting is an identity governance problem hiding inside fraud operations. When the same actor can create many apparently separate identities, the platform has effectively lost control over identity uniqueness. That failure matters for marketplaces, iGaming, and any service where account reputation or entitlement has economic value. Practitioners should align fraud operations with identity governance rather than treating them as separate disciplines.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Multi-accounting forces fraud teams to think in relationships, not records. A platform can have clean-looking individual accounts and still be under active abuse if the same actor can spread activity across infrastructure and identities. The practical shift is from per-account policy enforcement to cluster-based governance and escalation.

Network signals are now a governance control, not just a detection enhancement. When a platform learns that device farms, shared proxies, and behavioural reuse connect multiple records, the question becomes who owns the response path and how quickly friction can be applied. That is the difference between absorbable fraud and repeated economic leakage.

For practitioners

• Build graph-based linkage scoring Correlate devices, IP ranges, payment metadata, registration timing, and behavioural similarity so that one actor operating many accounts becomes visible as a cluster, not a series of isolated records.
• Use step-up checks on clustered risk Apply additional verification only when multiple accounts share enough relational evidence to justify intervention, which reduces friction for legitimate users while preserving enforcement against coordinated abuse.
• Track hardware and behavioural reuse Look for repeated GPU, screen, audio, battery, navigation, and typing patterns across accounts even when surface identifiers change, because those signals often survive resets and proxy rotation.
• Separate bonus controls from single-account rules Treat welcome offers, referrals, and seller reputation as economically sensitive flows that require cluster-aware controls, not just per-account thresholds.

Key takeaways

• Multi-accounting fraud succeeds because fraud rings distribute abuse across many accounts, devices, and payment paths instead of attacking one account directly.
• The strongest evidence comes from relationship signals such as shared infrastructure, behavioural reuse, and linked registration patterns.
• Platforms need cluster-aware verification and enforcement, because account-level rules alone cannot distinguish legitimate users from coordinated abuse.

Key terms

• Multi-accounting: Multi-accounting is the practice of one actor creating or controlling multiple identities to evade limits, gain incentives, or hide coordinated behaviour. In betting and fraud environments, it matters because the platform may see each account as separate unless identity signals are correlated across devices, payments, and sessions.
• Graph-Based Link Analysis: Graph-based link analysis is a method for finding hidden relationships between accounts by modelling them as connected nodes. It helps fraud teams identify shared devices, infrastructure, payment methods, and behavioural patterns that are invisible when each account is scored in isolation.
• Behavioral Biometrics: Behavioral biometrics uses patterns such as typing rhythm, swipe style, device handling, and session timing to infer whether the same user is still present. In practice, it supports continuous verification, but it also demands careful tuning because legitimate behavior can change with context.
• Device Fingerprinting Accuracy: Device fingerprinting accuracy is the rate at which a system correctly recognises a returning device as the same device on later visits. In practice, it measures how reliably identification persists over time, especially when browser, hardware, and network signals are reused or change slightly.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners build the identity controls that support fraud-resistant access and lifecycle oversight.