Multi-accounting and raffle stuffing in Retail & e-commerce

How the attack works

1. The reseller creates or prepares multiple accounts for a product raffle, using separate contact details for each entry. The objective is to increase their share of the draw before stock is allocated, rather than simply complete checkout faster at release.
2. The operator varies delivery details, including small changes to the same underlying address, and distributes entries across proxies. These variations make the accounts appear separate to checks that compare only exact email, address or network values.
3. Each identity submits an entry and keeps the necessary account access available for the result. Related devices, payment arrangements or address patterns can remain across the entries even though the visible account details differ.
4. Winning entries proceed to purchase and are consolidated for resale. The operator can repeat the account preparation for the next raffle, while the brand's records show multiple entrants rather than the concentration of participation behind them.

Why it gets through

A raffle gives each eligible entry a chance, so the entry boundary is commercially important. If eligibility is reduced to a unique email address, the operator can buy more chances by registering again. A successful email check confirms contactability, not independent participation.

Exact-match checks miss variations in account and delivery fields. Broader matching can create another problem: households and shared delivery locations can be legitimate. Your team needs relationships and context rather than an automatic assumption that every similar address belongs to an abusive entrant.

A network limit sees where an entry came from, not the whole preparation behind it. Proxy changes can spread entries across addresses, while separate account records hide reuse elsewhere in the journey. Looking at each application alone leaves the operator's combined participation difficult to assess.

Allocation per customer is the core measure. A one-entry or one-purchase rule has little commercial meaning if repeated identities receive independent treatment. A raffle can follow its draw procedure correctly while the underlying pool gives one operator more opportunities than intended.

Manual entry-review workload rises when the team tries to reconstruct relationships after registration closes. Comparing account, address and payment records across systems takes time, particularly when the release schedule leaves a short interval between the entry deadline and purchase invitations.

Fan participation and support contacts reveal the longer effect. Genuine entrants need confidence in the allocation process, while legitimate households should not be rejected simply because they share a device or address. The business needs evidence that supports a defensible review of those different situations.