Nobody creates one fake account. Fake signups are a bulk process, accounts manufactured to harvest a promotion, resell access, test stolen payment details, or build inventory for later abuse, and bulk is what makes them detectable. Start with the contact layer. Disposable email domains, the throwaway inbox services that hand out an address in seconds, are a standard tool of bulk signup operations, and email risk scoring now flags them alongside addresses whose patterns and infrastructure look synthetic. Cloudflare built disposable email checks and email risk tiers into its account abuse tooling for exactly this reason, after measuring login attack volumes in the billions of attempts per day across its network. Then the device layer: one device fingerprint behind dozens of supposedly unrelated signups is close to a confession, because real customers do not share a browser configuration across forty strangers. Add velocity, signups arriving in bursts or at metronome intervals, and form behaviour, fields completed in an order and at a speed no person produces, and the picture completes itself. No single signal should block a real customer. Combined, they separate manufacturing from shopping with room to spare.
Layer the response, because the signals are probabilities
The mature pattern is stepped friction. A clean signup with a normal email, an unseen device, and human timing sails through with no checks at all, which is most of your real customers and the experience they should get. A signup carrying one weak signal gets a cheap challenge or an email verification step before account privileges unlock. A signup carrying the full stack, disposable email plus a recycled device plus burst velocity, gets stopped or held for review, and the store should be unapologetic about it: the prior probability that this is a customer is tiny, and the cost of letting a manufactured account through is paid later in promo abuse, chargebacks, and support time. CAPTCHA alone is not a layer anymore. Solving services, often human powered, clear commodity challenges for fractions of a cent per solve, so a challenge can raise cost slightly but cannot be the wall.
Related reading on this site: Home and Disposable Email Checks Catch Less Than Their Dashboards Claim cover the neighbouring problems in more depth.
Post signup behaviour is the second gate
Some manufactured accounts pass signup and reveal themselves in the first session. Real customers browse like people with a purpose they are still forming. Manufactured accounts go directly to the highest value action the account unlocks: the referral credit, the promo, the listing, the download, with no exploratory behaviour before or after. Accounts that sign up, never verify, never return, and exist only as a number in a growth chart are the residue of an operation that failed at verification and succeeded at inflating your metrics. Monitor activation and first session shape, not just signup volume, and the fake share of the base becomes visible. A store reporting record signups while activation quietly falls is not growing. It is being filled.
Link analysis turns clean accounts dirty
The strongest detection operates after the fact and across accounts: shared payment instruments, addresses, devices, and hashed identifiers linking accounts that each looked clean at their own signup. One account per signal is a coincidence rate. A cluster of sixty accounts sharing infrastructure in rotation is an operation, and it should be enforced as a cluster, closing the shared infrastructure with the accounts, or the operator reuses it tomorrow under new names. This is also the answer to the synthetic identity problem, real and fabricated details blended to pass individual checks. The identity may be synthetic. The infrastructure is real, reused, and countable.
Frequently asked questions
What is a fake account signup?
It is an account created with disposable, synthetic, or stolen identity details, usually by automation or a coordinated operator, to obtain something the account system gates: promotions, referrals, resale access, or a platform for later fraud. They are typically created in bulk rather than individually.
What signals best expose fake signups?
Combinations: disposable or high risk email addresses, device fingerprints shared across many accounts, signup velocity in bursts or at regular intervals, inhuman form completion speed and order, and post signup behaviour that goes straight to the highest value action. Single signals are weak; combined signals are strong.
Why is CAPTCHA not enough to stop fake accounts?
Because solving services clear commodity CAPTCHAs cheaply, using automation or low cost human labour. A challenge adds slight friction and cost but does not verify identity, device history, or intent, so it must sit inside a layered system rather than serve as the whole defence.
How should a store respond to a suspicious signup?
With stepped friction matched to the signal strength: verification steps for weak signals, holds or review for strong combinations, and unrestricted flow for clean signups. Blanket friction punishes real customers; blanket openness invites manufacturing.