Home / Knowledge hub / Fake account creation
Knowledge hub
Fake account creation
Mass sign-ups by bots to abuse offers, spam users or farm rewards.
What it means
Fake account creation is the automated creation of accounts that no real customer will ever use. A script fills in your sign-up form again and again, often with throwaway email addresses, and the new accounts are then used for something your product never meant to allow.
The reasons vary: collecting a free trial or welcome credit many times over, sending spam through your messaging features, inflating reviews or followers, or preparing accounts to use later in a fraud. The sign-up works exactly as built, which is the problem.
Why it matters
Fake accounts cost real money. Free credits and trials are consumed, verification emails and texts are paid for per message, and storage and support grow. Your numbers also become unreliable: sign-up counts, conversion and active users all look better than they are.
Real users pay too. They receive spam, see fake reviews and meet suspended features after you tighten rules. In the worst case the accounts are the first step in credential stuffing, trial abuse or other fraud.
How it shows up
It shows up in sign-up and invitation forms, social login, phone verification, referral programmes and any free tier. Typical weaknesses are no limit on attempts per address, email verification that can be skipped, and sign-up APIs that skip the checks the web form applies.
Combine controls: verify email or phone, limit sign-ups per address and device, challenge suspicious sessions and watch for patterns such as sequential names. Test it by scripting the sign-up endpoint directly, checking whether verification can be bypassed, and seeing how far an unverified account can go.
Questions people ask
Fake account creation, answered
Why do bots create fake accounts?
To claim free offers repeatedly, send spam, boost ratings or prepare accounts for later fraud. The accounts are cheap to produce, so even a small gain per account is worth it to them.
Is email verification enough to stop it?
No. Attackers use disposable inboxes and services that read verification mail automatically. It slows them down but needs support from rate limits and behaviour checks.
What is the difference from a bot attack in general?
Bot traffic is the broad term. Fake account creation is one use of it, aimed at the sign-up step and what follows from it.
How do I measure the problem?
Compare sign-ups with real activity. A large group of accounts that never log in again, share patterns in names or addresses, or all claim the same offer is a sign.
How can we test our sign-up?
Script the sign-up request many times from one address, skip the verification step and call the API instead of the form. See how many accounts you can make and what an unverified one can do.
Sources
Where this comes from
Related
Terms that sit next to this one
Bot traffic
Automated visitors that scrape, stuff credentials or buy stock before real customers.
Trial abuse
Signing up again and again to keep free access without ever paying.
Referral fraud
Gaming a refer-a-friend reward with fake or self-made accounts.
Credential stuffing
Trying passwords leaked elsewhere, because people reuse them.
Rate limiting
Capping how often something can be attempted, per user or per address.
How many accounts can one script make?
Sign-up and verification flows are part of the business logic we test, including whether checks can be skipped by calling the API directly. Each finding carries the exact requests. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.