Trust and Safety · September 14, 2026

How to Detect Fake Accounts on Your Platform

The five kinds of fake account behave differently, so one detection model never covers them all. Here are the signals that work at registration, the ones that only work in session, and how to measure your real rate.

Ammar Khan

Short answer: You detect fake accounts by matching the signal to the category. Bots and bulk-registered accounts show up in registration signals such as device velocity, data center IP ranges and form interaction timing. Purchased and shared accounts pass every registration check, because a real person created them, so they surface only in session through location, device and behavior changes. Synthetic accounts sit between the two. The one signal covering all five categories is whether the person behind the account is a real, unique human who does not already hold an account with you, asked at the moments that matter rather than once at signup.

Key takeaways

Fake accounts are five different problems. One classifier tuned on bot traffic will miss purchased and shared accounts entirely.
Arkose Labs reported that fake account creation made up 46% of all fraudulent activity it observed and was the leading attack type across nine industries in its Q4 2025 report.
The 2026 Thales Bad Bot Report put bots at more than 53% of web traffic, malicious bots at 40%, and found AI-driven bot attacks rose 12.5x year over year, from about 2 million to 25 million a day.
Attention checks and simple bot challenges no longer separate people from agents. A Dartmouth study published in PNAS found an AI agent passed 99.8% of attention checks across 43,000 tests.
Meta estimates around 4% of its more than 3 billion monthly active users are fake, which is roughly what a platform converges on when detection runs alone.
Detection tells you how bad the problem is. Prevention decides how big it gets.

The five categories of fake account

Category	How it is created	What it costs you	Which signals see it
Bots	Scripts or AI agents complete the signup form	Spam, scraping, credential stuffing, skewed metrics	Registration signals, strongly
Bulk-registered	One operator opens dozens or hundreds of accounts by hand or semi-automatically	Promo abuse, referral fraud, review manipulation, vote manipulation	Registration signals, moderately
Purchased	An aged account with real history is bought from a seller	Ban evasion, trust abuse, marketplace fraud	Session signals only
Shared or rented	A real account holder lends or rents access	Payout fraud, gig-economy substitution, policy circumvention	Session signals only
Synthetic	A fabricated persona built from real and invented details	Lending fraud, payout fraud, long-con account building	Mixed, and often neither

The structural point is the fourth column. Purchased and shared accounts were created by a genuine person who passed every check you run at the front door. No amount of tuning at registration will find them, because at registration there was nothing wrong.

Signals at registration

Registration signals are cheap, fast and invisible. They also carry most of the false positive risk, because they judge a user before that user has done anything.

Signal	What it catches	False positive risk
Email address reputation and domain age	Disposable mailboxes and bulk signup lists	Medium. Real users hold new addresses and privacy relay addresses
Phone number type and carrier	Cheap virtual numbers bought in bulk	Medium. Many real users have virtual numbers as their only number
IP reputation, data center and proxy detection	Automation on cloud infrastructure and proxy farms	High. VPN use is ordinary consumer behavior
Device fingerprint and device velocity	Several accounts opened from one device or browser	Medium. Shared family devices, public terminals and library machines
Form interaction timing and paste events	Scripted submissions and form-filling tools	Low. Real users rarely trip it
Registration velocity by cohort	Coordinated bursts from one operator	Low at the cohort level, higher on individual accounts
CAPTCHA and attention checks	Naive scripts	Low, and increasingly low value against AI agents
Unique human verification	The same person opening a second account, on any device, with any email address or phone number	Low. The check either matches an existing verified person or it does not

The Dartmouth finding applies to the seventh row. An AI agent passed 99.8% of attention checks across 43,000 tests and made no errors on logic puzzles, so a challenge that once separated humans from scripts now separates cheap scripts from funded ones.

Signals in session

In-session signals are the only ones that see purchased and shared accounts, because they compare the account's current behavior against its own history.

Location behavior. An account whose home base moves to another city or country, and stays there, is a strong sharing or resale signal on mobile platforms.
Device change with no overlap. A clean switch between devices with no transition period is different from a phone upgrade, where the two devices overlap for days.
Session schedule. Accounts active 18 or more hours a day, or with two distinct activity windows in different time zones, usually have more than one person behind them.
Style discontinuity. Writing style, typing cadence and task quality change when the person changes, and those changes are measurable on platforms with text or task output.
Graph position. Accounts that connect into a tight cluster sharing payout details, referral codes or delivery addresses are worth review even when each one is individually clean.
Payout patterns. Multiple accounts paying out to one destination is the clearest late-stage signal, and the most expensive one to learn from.

Detection versus prevention

Detection and prevention answer different questions, and the confusion between them is why fake account programs stall.

Detection tells you which of the accounts you already have are fake. It runs after the account exists, it produces a backlog, and it generates appeals from users you were wrong about.

Prevention stops the account from existing. It runs at creation, it produces no backlog, and it generates fewer appeals because there is no established account to lose.

Both are necessary, and the question is the ratio. A platform that spends its whole budget on detection is committing to a permanent cleanup crew, and its fake account rate will settle wherever its detection stack can sustain it. Meta's estimate that around 4% of its more than 3 billion monthly active users are fake is what that equilibrium looks like at scale, alongside enforcement volumes analysts have tracked at 1.4 billion fake accounts actioned in a single quarter. Prevention shifts the equilibrium. If the same person cannot open a second account, the bulk-registered, purchased and shared categories shrink at the source rather than being cleaned up one at a time.

How to measure your fake account rate

You cannot manage this without a number, and the number has to come from a sample you inspected, not from your detection stack's output.

Draw a random sample of accounts created in one month. Two hundred is enough to start. Do not sample from flagged accounts, because that measures your detector rather than your platform.
Review each one by hand against a written definition. Decide in advance what counts as fake. Multi-accounting, resale, sharing and automation are separate labels.
Calculate the rate by category. A 6% rate that is 5% bulk registration and 1% bots needs a different fix than the reverse.
Compare against your detection stack's catch rate. The gap between the hand-reviewed rate and the flagged rate is the part you currently cannot see.
Re-measure quarterly, and track reversals alongside it. A falling fake account rate with a rising reversal rate means you are catching real users.

The friction and conversion trade-off

Every check you add at signup costs conversions, and the honest version of the trade-off has three parts.

Where the check sits matters more than how hard it is. A check at the front door is paid for by every visitor, including those who would never have abused anything. A check before payout, before a high-value purchase or at reinstatement is paid for only by committed users.

Length matters more than presence. Users abandon long onboarding flows, not short ones. A liveness check that takes about 3 seconds in a mobile browser with no app download is a different conversion question from a multi-step onboarding process.

Targeting recovers most of the loss. Trigger the check on device, network and velocity signals you already collect, so most signups see nothing and the check lands on the cohort where your fake account rate is concentrated.

There is a cost on the other side that teams routinely leave out. DataDome's 2025 Global Bot Security Report found only 2.8% of the nearly 17,000 sites it tested were fully protected against bots, down from 8.4% the year before, which suggests most platforms already absorb the cost of fake accounts as degraded metrics, wasted spend and moderation load.

Where unique human verification fits

VerifyYou's HumanCheck is an API that anonymously confirms whether a unique human is present, through a liveness check in a mobile browser in about 3 seconds, with no app download. Each verified person receives one unique anonymous credential, so the same person resolves to the same verified person across every account they try to open, on any device. It can run at signup, at payout, at reinstatement and before high-value actions.

That covers the categories registration signals cannot reach. A purchased account fails the moment the buyer is asked to verify, because the buyer is not the person who verified. A shared account fails at payout for the same reason. Bulk registration fails at the second account. VerifyYou was built by Marty Weiner, co-founder and CTO, formerly CTO of Reddit and a founding engineer at Pinterest, under the tagline "Keep the internet human."

Frequently asked questions

What is the fastest way to find fake accounts already on my platform?

Start with payout and referral graphs. Accounts that share a payout destination, a referral chain or a delivery address are the cheapest cluster to find and usually the most expensive to leave in place. Hand-review a sample of each cluster before you act on it.

Can CAPTCHA detect fake accounts?

A challenge detects automation at the moment it runs, and it does not tell you whether the person solving it already holds twenty accounts. A Dartmouth study found an AI agent passed 99.8% of attention checks across 43,000 tests, so challenges are now better at raising the cost of bulk automation than at separating people from agents.

What is a normal fake account rate?

No published benchmark transfers across platforms, because definitions differ. Meta estimates around 4% of its monthly active users are fake, which is a useful reference for a large open consumer platform and a poor one for a paid marketplace. Measure your own rate from a hand-reviewed sample.

How do I detect accounts that were bought rather than created?

Look for discontinuity. A purchased account changes device, location, session schedule and writing style at a single point in time and never changes back. Registration signals will never flag it, because the account was created legitimately by someone else.

Sources

Arkose Labs Q4 2025 threat report, fake account creation at 46% of fraudulent activity and the leading attack type across nine industries (Dec 17, 2025): https://secure.businesswire.com/news/home/20251217521684/en/Arkose-Labs-Report-Reveals-Explosive-Growth-in-SMS-Toll-Fraud-and-Precision-Targeted-Attacks
Arkose Labs fake account creation solution: https://www.arkoselabs.com/solutions/fake-account-creation/
Thales Bad Bot Report 2026, bots at more than 53% of web traffic and AI-driven attacks up 12.5x (Apr 29, 2026): https://cpl.thalesgroup.com/about-us/newsroom/ai-driven-bot-attacks-surged-according-to-bad-bot-report
Westwood, "The potential existential threat of large language models to online survey research," PNAS (Nov 17, 2025): https://www.pnas.org/doi/10.1073/pnas.2518075122
Dartmouth summary of the PNAS study, 99.8% of attention checks passed across 43,000 tests: https://www.eurekalert.org/news-releases/1106172
Social Media Today on Meta's estimate that around 4% of monthly active users are fake (Dec 11, 2025): https://www.socialmediatoday.com/news/meta-outlines-latest-data-on-content-removals-and-fake-accounts/807727/
Mobile Ecosystem Forum analysis of Meta's fake account enforcement volumes, 2017 to 2025: https://mobileecosystemforum.com/2025/10/13/trends-in-metas-content-moderation-2017-2025-spam-fake-accounts-and-community-standards/
Meta Community Standards Enforcement Report, fake accounts: https://transparency.meta.com/reports/community-standards-enforcement/fake-accounts/facebook
DataDome 2025 Global Bot Security Report, 2.8% of sites fully protected: https://datadome.co/resources/bot-security-report/