Detecting Multi-Accounting with Device Intelligence

Multi-accounting is one person, household, or farm opening many product accounts. The tell is not a new email. Emails are cheap. The tell is the same device fingerprint, or a tight cluster of fingerprints, tied to several customer.externalId values, often with signup velocity and recycled payment instruments.

Naiza links device fingerprints to customer identifiers to reveal accounts on the same device, like four wallets opened from one tablet. Send registration, login, and first-funding events with both identifiers, then count customers per device in a named window.

REVIEW the cluster before you BLOCK the tablet

Three or more accounts on one device is usually REVIEW, not an automatic BLOCK. Families share tablets. A parent and two teenagers on the same iPad will look like a cluster. So will a small shop with one back-office laptop. So will a farm.

Analysts confirm farms. Then you list the fingerprint. If you skip the human pass, you will block a household and spend the next day explaining why a legitimate signup died. Scoring can push the densest clusters to the top of the queue. The named rule is still "customers per fingerprint in this window," and the first outcome should be REVIEW until the pattern is confirmed.

Write the threshold as a sentence you can defend. "Four or more customer.externalId values on one fingerprint in seven days" is a rule. "Linked devices" is a vibe. Start in shadow or REVIEW, watch how many clusters are households, then enforce BLOCK on the fingerprints you have already listed.

Do not collapse every burst into one typology

Promo abuse, mule onboarding, and card testing can look like the same spike in the dashboard. They are not the same event.

A bonus claim is a signup or a promo event. Instrument it as that. A first funding on a new account is a funding event. A payout to many counterparties is a different typology. Screen the far side of that payout with the AML API as well. Fraud lists and AML watchlists do not mean the same thing in a case note. Label the source.

If you only send signup, you will catch the farm that opens accounts and miss the one that funds them. If you only send payments, you will miss the unused wallets sitting on one device waiting for a promo. Registration, login, and first funding are the minimum set that makes the cluster readable.

Naiza connects device context with fraud events and supports fingerprint lists. Configure named multi-account and velocity thresholds for your customer base, then review linked activity before enforcing a rule. The docs cover event fields and integration.

Device fingerprints join accounts better than IP

Attackers rotate addresses. Households share one. A shared mobile gateway will make unrelated customers look related if IP is your only key. Device fingerprints persist across those rotations. If your stack is still a VPN list, compare device intelligence with IP-only checks before you write a multi-accounting rule on address alone.

Even with a fingerprint, expect collisions and shared devices. That is why the first decision is REVIEW. The second decision, after an analyst looks at signup velocity, reused cards, and whether the names look like a household, is to list the fingerprint or close the case.

The control is simple when you keep it honest. Join device to customer. Count. Queue the cluster. List what you confirm. Leave the family iPad alone until someone has actually looked.