Home / Knowledge hub / Account sharing
Knowledge hub
Account sharing
One paid account used by many people, and how a business detects and limits it.
What it means
Account sharing is when several people use one login that was paid for by one. A team splits a single seat, a family passes a password around, or a reseller rents access. The product works as designed, but you are serving more people than you are billing.
Sometimes it is harmless and sometimes it is organised, as when logins are sold in bulk. Either way, the problem is the same: your system treats an account as one person. When it cannot tell, a licence designed for one becomes access for many.
Why it matters
The loss is revenue, since each extra user is a customer who never bought a seat and never will. It is also risk. Shared passwords are rarely rotated, cannot be tied to a person in the audit log, and drift to people who left the team years ago and still know them. If the account is breached, you cannot tell afterwards who did what.
For customers in regulated sectors, shared credentials can fail an audit and put a contract at risk. They also make account takeover harder to spot, because logins from several places look normal. Nobody can say whether a login came from the owner or from a stranger.
How it shows up
You meet it in subscription and seat-based products, streaming, software licences and learning platforms. Detection signals include many concurrent sessions, logins from distant places within hours, many devices on one account, and a password that never changes. Each one has innocent explanations, such as travel.
Controls include a limit on concurrent sessions and devices, step-up verification when something changes, per-seat invitations so teams add real users, and a clear policy. Choose friction carefully, since false alarms annoy paying customers. Test whether limits actually hold, not only whether they exist.
Questions people ask
Account sharing, answered
Is account sharing a security vulnerability?
Not by itself, since nothing is bypassed. It is a business and a risk issue: you lose revenue and you lose the link between an action and a person. A weak limit on sessions or devices can be tested as a flaw.
How do we detect account sharing?
Look for many simultaneous sessions, unusually many devices, logins from places too far apart for one person to travel, and shared use patterns. Combine signals, because any single one can be innocent.
Should we block it entirely?
That depends on your product and customers. Some businesses allow limited sharing as marketing. Others cap devices or charge for extra seats. Whatever you choose, state it clearly, so enforcement does not feel arbitrary.
Does multi-factor authentication stop sharing?
It makes it harder, since each login needs the owner's second factor, but a determined owner can still pass the codes along to others. It works best alongside device limits and per-seat accounts.
How is account sharing different from credential stuffing?
Sharing is done with the owner's consent. Credential stuffing uses stolen passwords against your login without the owner knowing. The signals can look alike, which is why logging and context matter.
Sources
Where this comes from
Related
Terms that sit next to this one
Concurrent sessions
One account signed in on several devices at once, and how many you allow.
Device binding
Tying a session or token to one device so a copy elsewhere is refused.
Impossible travel
Two sign-ins from places too far apart for one person to have reached.
Adaptive authentication
Asking for more proof when a sign-in looks unusual.
Audit log
A record of who did what and when, kept so you can answer later.
Does the limit really hold?
Session and device limits only protect revenue if they hold under a test. We check whether a second or tenth session is actually refused and report what we saw. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.