Account creation fraud: How to detect multiple accounts in food delivery apps?

It’s no secret that user moderation and fraud prevention can feel like a never-ending game of Whack-a-Mole. After a bad actor is successfully blocked, two more  pop up immediately to fill in the gap. Fraudsters are constantly developing new attack vectors that fraud teams must respond to as quickly as possible or risk losing revenue and their customer’s trust.

But creativity is not the only advantage that fraudsters have. There’s another challenge hidden under the surface — many companies do not have the signals they need to prevent multi-accounting.

As the name suggests, account creation fraud, multi-accounting, or multiple account fraud is when a bad actor creates many fake accounts (a direct policy violation) in order to execute some fraud scheme. Without the right signals, companies do not recognize the link between these accounts and fraudsters can mask the true scope of their operation. Often only one account is blocked, allowing the scam to continue via the other fake accounts.

Why do bad actors commit multiple accounts fraud?

Multiple account fraud is a technique used to exploit a service for financial or personal gain.

For example, an app’s marketing team might have a certain budget for encouraging new signups, including a promotional bonus like a percentage discount or a small credit for a first login with the app. When used as intended, this sort of incentive can be an excellent investment for the company’s user acquisition efforts, as the cost of discounted orders or free credits is often outweighed by that new customer’s lifetime value.

Multi-accounters take advantage of these promotions by making multiple new accounts under different names, email addresses, and phone numbers and claiming a discount with each new account. When fraudsters use this kind of account creation fraud, rewards meant for the many go instead to the few, and the company’s ability to use its customer acquisition budget efficiently is compromised.

In addition to our podcast episode above, here's Jaanus Uudmäe of food delivery platform Bolt explaining promo abuse in a webinar with Incognia: 

Promotional abuse isn’t the full extent of the multi-accounter’s wheelhouse, however. Multi-accounting can also be used to scale existing fraud operations. While someone creating multiple accounts on a food delivery app to take advantage of first-timer promos or delivery fees violates the policies of the app, the scam typically ends there. 

However, when organized fraudsters combine multi-accounting with other techniques like app cloning, which enables them to run multiple instances of the same app on one device, and device farming, which means employing hundreds of devices at a time, fraud losses can quickly spiral out of control.

Furthermore, many companies use weak device identification solutions which makes it very difficult to track behavior across devices. If users are banned for fraud or policy abuse, they can reset their devices and start the same scam all over again. Without the ability to detect account creation fraud, fraud teams can’t help but get wrapped up in a vicious cycle of detection and blocking that never solves the problem.

In addition to the use of multi-accounting for promotion abuse, there are a number of other scams that are achieved by creating many fake accounts. Food delivery platforms, for example, suffer from logistics challenges as a result of multi-accounting.

A courier running multiple accounts at the same time has a distinct advantage over other drivers when it comes to claiming preferred rides. A scheme like this has three victims. The customer’s delivery may be delayed resulting in a poor customer experience, the platform’s brand reputation suffers and changebacks increase, and policy-abiding drivers might struggle to compete, leading to frustration and churn.

The consequences of multi-accounting are too important to ignore, but before a company can address the problem, they need a reliable way to understand its scope.

How can food delivery apps detect multi-accounting? 

Simply put, multi-accounting enables fraud. There’s virtually no good reason why a legitimate user would need to open more than one account, let alone dozens. Because multi-accounting enables fraud and policy abuse to scale, being able to track this activity back to a user is critical for reducing promotional fraud and policy abuse on food delivery and courier apps (among others). For many in the courier app space today, however, detecting multiple account opening is easier said than done.

1. What are the main challenges of detecting multiple accounts? 

One unfortunate truth of developing an onboarding flow is that what’s easy and frictionless for good users is often also easy and frictionless for fraudsters. While platforms have to jump through the hoops of using device ID, behavioral signals, geolocation, and other indicators to determine when someone’s using multiple accounts, fraudsters can often just create a new email address or buy a prepaid cellphone to be back in business with yet another new, fake account.

Compounding the problem is the inconvenient reality that many multiple account detection tools today aren’t doing the job effectively. If device ID is used on its own to identify unique users, factory resetting is a common method used to bypass device identity. Geolocation is another common signal for identifying unique users, but standard location signals like GPS aren’t enough on their own, because they’re vulnerable to tampering and may result in false positives due to low precision.

Fortunately, there are new, more resilient options available. 

2. Tamper-resistant location intelligence 

Most fraud prevention tools are strongest when used in conjunction with other tools and processes, and the best strategy for detecting multi-accounting is no different. By combining device intelligence with tamper-resistant location data, platforms can identify each user even if they switch devices or locations.

When a well developed device fingerprint is combined with tamper-proof location intelligence, a device can be reidentified in a way that is even resistant to the factory reset process. While it’s true that switching devices is a workaround to bypass device ID, spoof-resistant location fills this gap.

By going beyond GPS and IP addresses to use a combination of signals from GPS, Bluetooth, WiFi, and more, a more comprehensive picture of a device’s location can be made—importantly, one that’s much harder to spoof than GPS or IP alone and much more accurate. Because the device’s reported location data can be compared to other location signals in the area, mismatches can alert the software to an increased risk of location spoofing attempts.

These signals used in combination, like the approach Incognia takes, makes multi-accounting difficult to scale and therefore a bad investment of effort and resources for fraudsters.

Location intelligence provides additional context for fraud fighters that otherwise might have gone uncovered. Incognia’s location intelligence takes this principle one step further with features like Suspicious Locations, which enables clients to flag the location of repeat offenders and preemptively block any new activity coming from that location in the future with place-level precision.

Multi-accounting is only one tool in a fraudster’s ever-evolving kit, but it’s a tool that allows them to quickly and discreetly expand their operations, making it particularly dangerous for platforms like courier services and food delivery. When it comes to multi-accounting, detecting perpetrators and understanding the scope of the problem is half the battle. Fortunately, device and spoof-resistant location intelligence represent the winning combination that can do both—detect and prevent multi-accounting fraud.

Anyone interested in learning more should read this case study, which highlights how one large food delivery company used Incognia to solve this exact challenge.