If you run a community, marketplace, app or giveaway, you've probably met the person with twenty accounts. They come back after every ban, claim every sign-up bonus, stuff every poll, and leave fake reviews. This guide covers the common defenses, what each one actually stops, and how to stop the same person creating many accounts without collecting anyone's identity.
Why duplicate accounts are hard to stop
Every common sign-up signal can be cheaply repeated:
- Email addresses are free and unlimited, and many services offer disposable ones.
- Phone numbers can be bought in bulk, rented by the minute, or generated as virtual numbers.
- IP addresses and devices change with a VPN, a mobile network or a new browser profile, while shared networks make different people look the same.
- CAPTCHAs stop simple scripts, but cheap solving services and AI get through, and they say nothing about whether this is the same person as another account.
So most defenses raise the cost of each fake account a little. None of them ties an account to one real person.
The usual defenses, and what they stop
| Defense | Stops bots? | Stops one person with many accounts? | Cost to genuine users |
|---|---|---|---|
| CAPTCHA | Simple ones | No | Annoying |
| Email verification | No | No | Low |
| SMS verification | Some | Slows them down | Low; excludes some people |
| Device fingerprinting | Some | Partly, until they switch device or browser | Hidden, but a privacy concern |
| Behaviour analysis and rate limits | Many | Partly | Low, with occasional false positives |
| Payment or deposit | Many | Partly | High: many people won't pay to join |
| Full ID check (KYC) | Yes | Yes | High: people hesitate to upload IDs, and you must protect the data |
| Proof of personhood | Yes | Yes | Low after the first verification |
The pattern: the defenses that really stop duplicates, like ID checks, are the ones that create a new problem, a database of identity documents you now have to secure, and a sign-up step that scares away privacy-minded users.
Stopping duplicates without collecting identity
Proof of personhood separates the two things an ID check normally does. It uses an ID to prove a person is real and unique, but it doesn't hand that identity to you.
With Human Pass, for example:
- A user taps Continue with Human Pass on your site.
- The first time they ever use Human Pass, they verify a government ID once, with a liveness check. After that, it's a normal sign-in on any site.
- Your site receives a yes and an ID for that person, the same ID every time they sign in, and a different one from any other person. Nothing else: no name, no birth date, no document.
Because the ID is tied to the person, not the account:
- Bans stick. A banned person who signs up again arrives with the same Human Pass ID.
- One person, one account. You can refuse a second account for an ID you've already seen.
- Rewards go once per person, for referrals, trials, giveaways and votes.
And because the ID is different on every site, people can't be tracked across the web through it.
Practical tips for rolling it out
- Start where abuse happens. You don't have to require verification for everyone on day one. Require it for the actions that get abused, such as posting links, claiming a reward, voting or messaging strangers, or offer it as an optional "verified human" badge.
- Keep your other defenses. Rate limits and behaviour signals still help against a real person misusing a single account.
- Tell users what you get. "We learn that you're a real, unique person, not who you are" makes verification far easier to accept than "upload your ID".
- Measure the change: repeat-ban rates, bonus redemptions per real person, and moderation time.
Try it
Human Pass is in early access, with a public sandbox for testing integrations. It uses standard OpenID Connect, so it works with most sign-in libraries.