Fake and duplicate accounts: spot them, prevent them.
Free trials, starting credit and referral bonuses invite people to open a second, third or tenth account. This guide shows how to spot duplicate accounts, what email checks and device fingerprints miss and why a verified phone number makes a better anchor than an email address.
- Where duplicate accounts cost you
- What email checks miss
- A verified number as the anchor
Christian Schätzlein, Founder and developer of Sendity
3 min read
Which accounts are duplicates?
Tap the suspicious accounts, then reveal.
-
First account Trial credit granted.
-
Same person Gmail ignores dots: the same inbox as #1041.
-
Same person Plus alias, the same inbox again.
-
Same person Throwaway address, five minutes later, same browser.
-
Own account Looks fine.
-
Cannot tell Own domain. Whether Max is behind it, no address can tell.
Sign-ups by message. No form, no code.
Sendity is a sign-up widget for your website. Instead of filling in a form, your visitors send one short message via WhatsApp or email. Sendity checks who it came from and hands your site the name and the confirmed phone number or email address.
See how Sendity works →-
One message instead of a form Visitors tap send in WhatsApp or their email app. Nothing to type, no confirmation email to click.
-
Confirmed by the message itself The contact comes from the sender of the message, so typos and made-up addresses never reach your list.
-
Pay per confirmed contact Start with 1,000 free credits, no credit card. After that, prepaid packages with no subscription.
Duplicate accounts follow the money: wherever a new account gets something for free, some people take it more than once.
What it costs
Trial periods that never end, starting credit paid out ten times, referral bonuses where someone refers themselves. On top of that, your sign-up figures look better than they are.
Normalising addresses
Gmail ignores dots and everything after a plus sign. Normalise addresses before you compare them, and the cheapest tricks are gone. Anyone with their own domain still has unlimited addresses.
Blocking throwaway domains
Lists of disposable email providers catch the well-known ones. New services appear daily, so the list is always a step behind.
Device and IP
Browser fingerprints and IP addresses link accounts from the same device. They also link families, flatmates and colleagues, and fingerprinting usually needs consent in the EU.
A phone number as the anchor
A working mobile number is scarcer than an email address. With an SMS code, virtual numbers and SMS receiving sites get through, and every code costs you. With reverse OTP, the number comes from the sender of a WhatsApp message.
Verify where it counts.
You do not have to slow down every sign-up. Check at the moment an account receives something of value.
Normalise and filter
Lower case, strip Gmail dots and plus aliases, block known throwaway domains.
Verify before the benefit
Before the trial credit or the bonus, the user verifies their number by sending one message.
One number, one benefit
Store the verified number, or a hash of it, and grant each benefit once per number.
Email confirmation or verified number?
What a person needs for each additional account.
| Aspect | Email confirmation link | With Sendity |
|---|---|---|
| Accounts per person | As many as they have addresses | One per verified number |
| Cost of another account | A new alias, seconds | Another number with a working WhatsApp account |
| Typed by the user | The address | Nothing: the number comes from the sender |
| Your cost for failed attempts | Every email goes out | None |
What a verified number changes.
An anchor that is hard to multiply, checked without a code to type.
Benefits once per person
Trial credit and bonuses go to a number, not to an address.
No SMS receiving sites
Public receive-an-SMS pages do not help: the message has to be sent from the number itself.
Households stay apart
Unlike IP addresses and fingerprints, mobile numbers are personal, so flatmates are not blocked.
Live on your page in minutes.
Sendity runs as a compact widget on your page. Pick the path that fits your website.
Duplicate accounts: common questions.
Can someone still have several numbers?
Yes, with a second SIM or virtual numbers registered on WhatsApp. Each one takes effort, so abuse stays the exception instead of the norm.
May I store the number for this?
Name the purpose in your privacy notice. If you only need to recognise repeats, store a salted hash instead of the number.
What about users without WhatsApp?
You can allow them to send the code by SMS. That reaches everyone but is less secure: SIM swaps are possible and SMS senders can be spoofed on some routes.
Does every user have to verify a number?
Only where an account gets something of value. For a plain newsletter, a verified email address is enough.
Keep reading.
Reviewed for accuracy in by Christian Schätzlein.
One benefit per person, verified by message.
Try the live demo on your phone. It takes ten seconds.