Fake signups reveal themselves through velocity: many accounts from one device or IP range, created in a burst, with disposable emails and no browsing history. The defense is rate limits, email verification, and phone checks at signup, not after the damage.
Velocity is the first signal
A real signup flow has a human pace. One account every few minutes, spread across the day, from varied devices and networks. A fake signup flow has a machine pace: fifty accounts in an hour from the same IP range, the same device fingerprint, or the same block of VoIP numbers. The burst is the signal, because no marketing campaign produces fifty signups in an hour from one network.
The second velocity signal is the time between steps. A human takes seconds to read a form, type an email, and choose a password. A script completes the whole flow in under a second, and it does it fifty times without a pause. Log the time from page load to submit, and the accounts that complete in under two seconds are not humans with fast fingers. They are scripts.
Related reading on this site: Home and Credential Stuffing at the Login Form: Akamai's 26 Billion Attempts a Month cover the neighbouring problems in more depth.
The identity signals underneath
Under the velocity sits the identity data. Fake accounts use disposable email domains, domains created that day, and VoIP numbers that fail carrier checks. A real buyer gives a mobile or landline that exists. A bot gives a number from a VoIP range used for verification farming. A name field that fails basic validation, a string of consonants or a celebrity name, is a bot that did not bother to generate a plausible identity.
The third identity signal is history. A fake account has none: an email created that day, a device fingerprint never seen before, no browsing before the signup. A real buyer has a trail, even a short one: a product page viewed, a returning visit, a cart started. An account with no trail and no follow-through is an account to quarantine, not to welcome.
What to check, and when
Check at signup, not after. An email from a disposable domain should be flagged at submission. A phone number should pass a line-type and carrier check before the account is created. A burst of signups from one fingerprint should trip a rate limit that slows the flow to a human pace, which is enough to make the farm move on to an easier target.
None of these checks should block a signup outright. A real buyer with a new email and a VoIP number exists, and blocking them costs a customer. Flag, score, and route: high-confidence fake accounts go to a quarantine queue that a human reviews once a day, medium-confidence accounts get a verification step, and clean accounts go straight through. The goal is not a perfect filter. It is a signup flow where the first fifty accounts in the morning are people.
Frequently asked questions
What are velocity signals in fake signups?
Many accounts created in a burst from one device, IP range, or VoIP block, with form completion times under two seconds. No marketing campaign produces fifty signups in an hour from one network.
How do disposable emails reveal fake accounts?
Fake accounts use disposable domains or domains created that day. Flagging them at submission, not after the account is created, stops the cheapest farms.
Should I block signups that look fake?
No, flag and score them instead. A real buyer with a new email and a VoIP number exists, and blocking them costs a customer. Quarantine the high-confidence fakes and verify the rest.
What is a VoIP number check?
A line-type and carrier check that confirms a phone number belongs to a real mobile or landline. Numbers from VoIP ranges used for verification farming fail the check.