Multi-accounting detection without blocking real users
Shared Wi-Fi isn't proof of a second account. How to detect multi-accounting and duplicate accounts in SaaS without false positives that turn real customers away.
Multi-accounting detection has two ways to fail. Miss the repeat claims and you keep paying for the same person over and over, and when a script finds your offer, a wave of new accounts can burn through thousands of dollars of credits before morning. Catch too much and you turn away real customers who just happen to share an office network, a family laptop or a mobile carrier with someone else. The second failure is quieter and often more expensive: a blocked customer rarely complains. They just leave.
From our early beta
After a launch went viral on X, one team gained 6,400 new users in a month. 2,700 of them were duplicate accounts. About 32 became paying customers.
This guide covers why simple duplicate account detection produces false positives, and how to stop repeat claims while keeping your benefits open to real people.
Why "same IP, same person" breaks
The fastest rule anyone writes is "one trial per IP address". It's also one of the least reliable. Huge numbers of real, unrelated people share networks and devices every day.
| Situation | What's shared | Who gets hurt by a naive rule |
|---|---|---|
| Offices and coworking spaces | One public network for hundreds of people | Colleagues who each want their own trial |
| Universities and schools | Campus networks for thousands of students | Students, your future customers |
| Mobile carriers | Public addresses shared by many subscribers | Anyone signing up from a phone |
| Households | Wi-Fi, laptops and tablets | Partners, roommates and family members |
| Privacy-minded users | VPN exit addresses shared with strangers | People who care about their privacy |
| Libraries, cafés and hotels | Public Wi-Fi and shared computers | Travelers and anyone without home internet |
The same is true for every single signal. A shared device doesn't prove one person. Neither does a shared card in a family, or a shared company email domain. A signal on its own is a hint, not proof, and any rule that treats it as proof will block real users.
What a false positive really costs
A denied repeat claim saves you the cost of a benefit. A denied real customer costs you their lifetime value, a support conversation and, sometimes, a public complaint. That asymmetry is why the goal of multi-accounting detection isn't to deny as much as possible. It's to deny the claims that are actually repeats, and nothing else.
If you haven't sized the cost of the repeats themselves, start with the real cost of free trial abuse.
Signals together, not one at a time
Repeat claims hide in how signals line up, not in any single one. A real student on a campus network looks nothing like one person cycling through new accounts from the same campus, even though both share an IP range.
That's how AbuseZero approaches every evaluation. The AbuseZero AI Risk Engine reads a claim's signals together, never one at a time, with a proprietary algorithm built on 140,000+ risk signal combinations and AI that checks the claim again. Each claim is checked against your workspace's full claim history, and the result comes back with an AbuseZero Risk Score and a readable reason, so your team can always see why a claim was denied.
A fair rollout playbook
You don't have to choose between protection and fairness on day one. Roll protection out in steps and look at real results before any user is affected. The tooling behind each step is covered in shadow mode for abuse rules.
Start in observe mode. Every claim is allowed, and AbuseZero records what it would have decided. Nobody is blocked while you learn. See protect and observe.
Review the would-be denials. Open the evaluations AbuseZero would have denied and read their reasons and risk scores. Look for patterns that belong to your real customers.
Pick the right protection level. Lenient favors conversion, Balanced suits most products, and Strict favors protection when each claim is expensive. See protection levels.
Replay before you change. Test a new level or rule against your recent traffic and see every result that would change before anyone feels it. See test changes safely.
Allow who you already trust. Add partner domains, known customers or internal accounts to an allow list. They're allowed every time.
Switch to protect. Flip the benefit to protect when the results look right. Keep reviewing denials as your traffic changes.
Protection you can see before it acts
Observe mode, replays and allow lists are built into AbuseZero. Start with a benefit in observe mode and switch to protect when you're confident. Start with Builder or see pricing.
What to tell a user you denied
How you handle a denial matters as much as the decision. Two rules work well:
- Don't explain the detection. Telling someone why a claim was denied teaches the next abuser what to change. Keep the message neutral.
- Always offer a way forward. A real customer who was denied by mistake should be one message away from help.
For example:
We couldn't apply the free trial to this account. If you think this is a mistake, contact our support team and we'll take a look.
When your team decides a denied claim should get the benefit after all, add the user to an allow list for next time and record the grant, so your claim history stays accurate. See grants after a deny.
Teams, agents and other edge cases
Team signups. In B2B products, several colleagues often sign up from the same office in the same week. If your benefit is meant per company, not per person, protect it that way: send a company or workspace identifier with each claim as a custom identifier. The API free tier playbook walks through it.
AI agents. More and more real customers sign up through browser assistants and AI agents. Blocking all automation blocks them too. AbuseZero recognizes agents that can prove who they are and lets you decide, benefit by benefit, which ones may claim. See AI agents are claiming your free trials.
Returning customers. Someone coming back after a year isn't abusing your trial. Set an eligibility period, such as once every 365 days, so a fair return is allowed. More on this in how to prevent free trial abuse. See also setting trial eligibility.
Frequently asked questions
What is multi-accounting?
Multi-accounting is when one person creates and uses more than one account, usually to claim a free trial, signup credits, a free plan or a promotion more often than intended.
How do you detect multiple accounts from the same person?
Reliable duplicate account detection connects a new claim to earlier claims across several kinds of evidence at once, rather than relying on one identifier like an email or IP address. AbuseZero checks every claim against your full claim history and returns allow or deny with a reason.
Will users on a shared IP address get blocked?
A shared network on its own doesn't prove that two accounts belong to one person. AbuseZero reads signals together, and you can review every would-be denial in observe mode before any user is affected.
Can I override a denial for a specific user?
Yes. Add the user, email, domain or device to an allow list, and record the grant if you give them the benefit. Changes apply to the next claim, with no code change.
What's a good false positive rate for abuse prevention?
It depends on what a lost customer costs you compared with a repeat claim. Measure both on your own traffic in observe mode, then pick the protection level that fits your product.
Stop repeat claims, keep real customers
Start with Builder
Pay as you go. Start in observe mode.
See pricing
Builder, Pro, Scale and Enterprise.
Test changes safely
Preview, replay and observe before you protect.
Keep reading
- How to prevent free trial abuse, starting with the offer itself
- Add a trial and credit abuse check to your signup flow
- The real cost of free trial abuse for SaaS and AI apps
- AI agents are claiming your free trials. Let the right ones in.
- Abuse prevention vs fraud detection vs identity verification
- Why we built AbuseZero: an abuse prevention API for SaaS
- Shadow mode for abuse rules: turn on protection safely