Account Farming and Multi-Accounting

A different email does not necessarily mean a different customer. Account farming lets the same person return to your store, claim another benefit or create a replacement account after a ban.

Try free

TL;DR

Account farming creates accounts for later use. Multi-accounting uses them to exceed limits, collect repeated benefits or evade bans. Your account count grows without equivalent customer growth. Compare accounts before granting access, and distinguish repeat misuse from legitimate shared devices and households.

What is Account Farming and Multi-Accounting

The same person creates several accounts, verifies separate emails and uses each account independently. Your store sees a fresh user ID with no previous purchases, claims or bans.

The accounts do not have to be used immediately. Account farming builds a supply for later misuse; multi-accounting describes operating several accounts to get around your rules. OWASP documents bulk account creation as a distinct automated threat.

The Core Abuse Pattern & Hidden Costs

Online marketplaces

The same person operates several buyer accounts, each appearing to bring another customer to your marketplace. They claim referral rewards, make qualifying purchases and move to another account when the benefits run out.

Your growth report counts separate buyers, while your retention report records customers who never return. Beyond the rewards paid, your team spends time investigating accounts individually and makes campaign decisions using an inflated customer count. The underlying problem is that each new account resets what your marketplace knows about the person using it.

Classifieds

The person you banned returns with another email and resumes posting. The replacement account has no moderation history, so your team waits for another report before investigating behaviour it has already reviewed.

The cost includes repeated moderation, complaints from newly affected users and the time between the replacement account's first post and its removal. Counting bans hides whether enforcement works. A rising removal count could mean your moderators are repeatedly dealing with the same people.

Additional industries

Retail accounts repeatedly claim welcome offers. Luxury buyers split purchases across accounts to exceed per-customer limits. Ticketing accounts accumulate presale access. Beauty accounts collect samples, while electronics accounts reserve repeated pre-orders. In SaaS, farming free accounts gives one person several separate quotas.

Fraudsters’ Best Practices

Separate the accounts in the browser

The same person uses separate browser profiles so each account keeps its own cookies and login. Your store receives apparently independent sessions. Clearing a cookie or starting another session therefore tells you little about whether the person is new.

Spread attempts across IPs

Proxies send requests through different internet connections. Each IP stays below your rate limit while the total number of sign-ups keeps climbing. An IP associated with a household connection does not establish that each account belongs to a different household.

Change details that exact matches depend on

The same person uses different emails and varies address formatting while keeping deliveries pointed at the same destination. The person you banned replaces the email or phone number on your blocklist. Each change removes an obvious match without changing who controls the account.

Prepare accounts before using them

Accounts created earlier need not appear in a sign-up spike when misuse begins. An older account is not automatically an independent customer. Several accounts becoming active together deserve examination even when their creation dates differ.

Playwright is a browser-testing framework. Its isolation documentation explains how sessions maintain separate cookies and storage within one browser. Your engineers can use it in your test environment to check whether account limits depend only on cookies. Separate sessions do not establish separate people.

How to Detect & Prevent Account Farming and Multi-Accounting

Define whether your limit applies per account, person or household before enforcing it.

Compare user IDs appearing on the same device, then check payment-method references, delivery addresses and previous bans in your records. Preserve apartment numbers and other meaningful address differences. A shared laptop warrants investigation, not automatic rejection.

Check eligibility before issuing a benefit. For ban evasion, review the original ban reason and any successful appeal before removing a replacement account. Measure repeat claims, reopened moderation cases and legitimate customers mistakenly blocked.

How Kairal can help you stop Account Farming and Multi-Accounting

Kairal records devices, IPs and sessions and connects them to the user ID you pass to Kairal. You inspect accounts using the same device alongside your purchase, referral or moderation records.

Bot Protection scores requests on protected pages, applies configured checks or blocks, and logs what happened. Kairal Business Defense, currently in early access, adds account-abuse assessment.

You decide which accounts breach your rules and which customers need further verification. Browser collection supplies device details; enforcement runs at your edge or server. A completed browser check does not establish eligibility for another benefit or overturn a previous ban.

Make your business a harder target.

Get a 3-month free hands-on trial to gain visibility into the threats facing your online business.