How to Block Fake Account Signups

Fake account signups are more than a vanity-metric problem. They soak up free-trial credits, poison your analytics, seed spam and reviews, and give fraudsters a foothold. The good news: most fake signups share a handful of tell-tale signals, and you can block the majority without adding friction for real users.

Why fake accounts get created

• Promo and trial abuse, one person claiming a bonus many times over.
• Bots and scraping, automated accounts to inflate numbers or extract data.
• Spam and manipulation, fake reviews, votes, or messages.
• Fraud staging, disposable accounts used to test stolen cards or launder activity.

The signals that expose them

Fake signups cluster on cheap, disposable infrastructure. Screen three things at registration:

• Email, disposable domains, undeliverable mailboxes, and alias tricks that let one inbox look like many.
• Phone, VoIP and prepaid numbers used to pass verification cheaply.
• IP, datacenter ranges and known VPNs that hide automation and location.

Any one of these can be innocent. Together, they are a near-certain fake, which is why combining them is the key.

A layered approach

1. Score at registration with a risk API before the account is created.
2. Combine signals, take the worst level across email, phone and IP, or sum weighted signals.
3. Apply graduated friction, allow low risk, challenge medium, block high.
4. Add velocity limits, catch distributed attacks that stay under the per-signup radar.

const email = await score("email_risk", { email });
const ip = await score("ip_risk", { ip: clientIp });

const risky =
  email.risk.level === "high" ||
  ip.ip_features.known_vpn ||
  ip.ip_features.classification === "datacenter";

if (risky) requireVerification();   // or block on high-value actions
else allow();

Keep real users out of the crossfire

The goal is not zero fake accounts at any cost, it's the best trade-off. Hard-blocking on a single signal creates false positives; graduated friction (an extra verification step for medium risk) stops the obvious abuse while letting genuine users through. Tune thresholds from your own data over time.