How to Stop Bonus Abuse and Multi-Accounting
Bonus abuse and multi-accounting drain promo budgets. Learn how abusers use proxies and VPNs to fake unique users, and how to detect and stop them by IP.
Sign-up bonuses, free trials and referral rewards are growth tools — until abusers turn them into a revenue leak by claiming them many times over. The mechanism is almost always multi-accounting, and it lives at the IP layer.
How the abuse works
Your promo rule says "one per customer." The abuser's job is to look like many customers:
- Route each account through a different IP — frequently a residential proxy so it looks like a real home user.
- Use disposable emails and fresh device fingerprints.
- Rinse and repeat, claiming the bonus each time.
Because the IPs look residential and rotate, a naive "block duplicate IPs" rule never fires.
Check an IP for proxy and evasion signals
The signals that expose it
- Residential-proxy detection — the top signal, since abusers specifically buy residential IPs to defeat checks. Use residential proxy detection.
- VPN / datacenter proxy — cheaper abusers still use these.
- IP reputation — repeat-abuse history on the address or range.
- Velocity — many signups or claims clustered in time.
Combine them into an IP fraud score you can threshold at claim time.
A layered defense
IP intelligence is the first and highest-leverage layer, but multi-accounting rewards defense in depth:
| Layer | Catches |
|---|---|
| IP scoring (proxy/VPN/residential) | Bulk creation behind anonymisers |
| Device fingerprinting | Same device, many accounts |
| Account linking | Shared payment methods, addresses, referral loops |
| Velocity limits | Bursts of signups/claims |
Where to enforce
- At signup — gate bonus eligibility, not just account creation. See how to prevent fake account signups.
- At claim/withdrawal — re-check, since that's where the money moves.
- On referrals — referral rewards are a favourite target.
Avoiding collateral damage
Households and offices legitimately share IPs, so don't ban on raw IP matches. Lean on the residential-proxy and reputation signals plus device/account linking, and use scoring so real customers on shared connections aren't punished.
Bottom line
Bonus abuse is multi-accounting hidden behind rotating proxies — usually residential. Detect the anonymising infrastructure, score it, and enforce at signup, claim and referral with device and account-linking layers behind it. That protects the promo budget without blocking legitimate shared-IP users.