How to Stop Ban Evaders From Rejoining Your Platform

Short answer: You stop ban evaders by attaching the ban to a verified person instead of to an account, an email address, a phone number, a device or an IP address. Every one of those account-level signals is cheap to replace, and each replacement resets your enforcement record to zero. A check that confirms the person behind a new signup is a real, unique human, and resolves that person to the same verified person they were before the ban, is the only layer that survives a new email address, a new phone number, a factory reset and a residential proxy at the same time.

Key takeaways

• Ban evasion succeeds because the thing you banned is not the thing that came back. You banned an account. A person returned.
• Researchers who studied 8,551 confirmed ban evasion pairs on Wikipedia found that evasion accounts stayed active for a median of 3 days and 12 hours before being blocked, and that they toned down the behavior that got the original account banned.
• The same research reached an AUC of 0.853 for early detection and an MRR of 0.969 for matching a new account to its banned parent, so detection works, but only after the evader has been active for a while.
• Device and network signals decay in hours. Behavioral signals decay in weeks, because evaders change their posting patterns on purpose.
• The Appeals Centre Europe received more than 14,000 complaints about account suspensions in its first year, and platforms failed to supply evidence often enough that the Centre issued more than 7,000 default decisions.
• A ban that attaches to a verified person turns an ongoing detection problem into a check at signup, at reinstatement and before high-value actions.

How ban evasion works in 2026

Ban evasion follows a predictable sequence, and none of the steps require special skill.

Step one: replace the account details. A new email address on a disposable mail service costs nothing, and a new phone number from a virtual number service or a prepaid SIM costs a few dollars. Both clear the checks most platforms run at signup.

Step two: replace the device picture. A factory reset or an app reinstall produces a new advertising identifier and clears local storage. On desktop, an antidetect browser generates a fresh combination of canvas output, font list, screen resolution and time zone, so the browser presents as hardware your system has never seen.

Step three: replace the network picture. Residential proxy networks route traffic through consumer connections in the region the evader wants to appear from. In your logs the session looks like a home broadband user, because it is one.

Step four: skip the first three steps. Aged accounts with posting history, karma or completed transactions are sold in bulk on forums and messaging channels. An evader who buys a two-year-old account inherits every trust signal that account earned.

Step five: behave differently. The most effective evaders change what got them banned. They post less often, at different hours, in different parts of the platform, and they alter their writing style on purpose. Our earlier piece on the ban evader's playbook covers how account warming works.

Why device and network signals decay

Every enforcement signal has a half-life. The useful question is how long each one keeps working after a ban lands.

Every row above the last one tracks something the evader controls and can replace. The last row tracks something they cannot replace, because it is them.

What the research says about detecting ban evasion

The most useful public work on this is the ACM Web Conference 2022 paper "Characterizing, Detecting, and Predicting Online Ban Evasion" by Niverthi, Verma and Kumar. It used Wikipedia sockpuppet investigations to build a labeled dataset of 8,551 ban evasion pairs, each a banned parent account matched to the account the same person opened afterward. Three findings matter for a trust and safety team.

Evaders behave less badly on the new account. Evasion accounts used fewer swear words, fewer informal words and fewer sexual terms than non-evading malicious accounts. They stay under the threshold that caught them, so the content signals your classifiers are tuned on get weaker rather than stronger.

Evaders still leave structural traces. Evasion pairs shared far more edited pages than random matched pairs, with a Jaccard overlap of 0.12 against 0.0001, and their usernames were measurably more similar. People return to the same topics and the same arguments.

Detection works, but it works late. The authors reported an AUC of 0.778 for predicting which accounts would go on to evade, an AUC of 0.853 for early detection, and an MRR of 0.969 for matching a suspected evader to the right parent account. Those are strong numbers, and they all require the evader to generate behavior first. Evasion accounts in the study were active for a median of 3 days and 12 hours and made a median of 6 edits before they were blocked.

That gap is the cost of detection-only enforcement. Every evader gets a free window, and where the abuse is harassment, scalping, promo abuse or payout fraud, that window is where the damage happens.

Appeals and false positives

Tightening detection creates the opposite failure. When a model links a new account to a banned one on circumstantial evidence, real users lose access and escalate.

The Appeals Centre Europe, the out-of-court dispute settlement body certified under the EU Digital Services Act, published its first annual transparency report in May 2026 covering April 2025 to March 2026. It received more than 24,000 complaints, of which more than 14,000 concerned account suspensions. More than 5,000 of those suspension disputes were eligible for review, but fewer than 150 were fully assessed on the merits, because platforms failed to provide evidence often enough that the Centre issued more than 7,000 default decisions.

Two lessons follow. Account-level enforcement generates appeal volume platforms already struggle to service, and a platform that cannot explain why it linked two accounts will lose the appeal whether or not the link was correct. A shared IP range or a similar device fingerprint is hard to explain to a user and harder to defend to a regulator. A verified person check changes the evidence available on appeal, because a wrongly flagged user can clear the flag in seconds.

What enforcement looks like when a ban attaches to a person

VerifyYou's HumanCheck is an API that confirms a person is a real, unique human in seconds, right in a mobile browser. Each verified person receives one unique anonymous credential, so the same person resolves to the same verified person across every account they try to open, on any device. That changes four things about enforcement.

Bans stop expiring. When you ban a verified person, the next signup attempt from that person resolves to the banned credential regardless of the email address, phone number, device or network they arrive on.

Enforcement moves to signup. Instead of detecting the evader after three days of activity, you block the account before it exists.

Appeals get a clean resolution path. A user who believes they were wrongly banned can complete a check, and the result either confirms or clears the link. There is no argument about IP ranges.

Sanctions can be proportionate. Because the credential is anonymous, a person-level ban does not have to mean permanent exile. You can set a timed suspension against the verified person and re-check at reinstatement. HumanCheck runs at signup, at payout, at reinstatement and before high-value actions, so you can place the check where the abuse costs you rather than in front of every visitor.

How to roll this out without wrecking signup conversion

1. Measure your baseline. Count how many banned accounts are followed by a new account that trips the same enforcement rule within 30 days. That is your working ban evasion rate.
2. Start at reinstatement. Users appealing a ban are already motivated to complete a step, so this is the lowest-risk place to test a check.
3. Add the check at signup for high-risk cohorts first. Trigger it on the device and network signals you already collect, so most signups see nothing.
4. Add it before the actions that carry cost. Payouts, ticket purchases, reward claims and a first post in a sensitive area are better gates than the front door.
5. Keep your behavioral detection running. Person-level verification stops the same human returning. It does not stop a real, unique person breaking your rules for the first time.

Frequently asked questions

Does IP banning stop ban evaders?

IP banning stops the least determined evaders and creates collateral damage for everyone else. Residential proxies and mobile carrier networks give an evader a new address in seconds, while a shared office, campus or carrier-grade NAT range can put thousands of innocent users behind one banned address.

Can device fingerprinting alone stop ban evasion?

Device fingerprinting catches repeat signups from the same hardware and browser, which covers a meaningful share of casual evasion. It loses to factory resets, antidetect browsers and second devices, so platforms relying on it alone see evasion rates fall and then plateau.

How long does it take to detect a ban evader with behavioral signals?

In the Wikipedia dataset studied at ACM WWW 2022, evasion accounts were active for a median of 3 days and 12 hours before they were blocked. Behavioral detection needs behavior, so activity always precedes the block.

How do you handle a user who says they were wrongly flagged as a ban evader?

Give them a way to clear the flag that does not depend on your internal signals. A check confirming whether they are the same verified person behind the banned account produces an answer in seconds, which is easier to explain than a device or network match.

Sources

• Niverthi, Verma and Kumar, "Characterizing, Detecting, and Predicting Online Ban Evasion," Proceedings of the ACM Web Conference 2022: https://dl.acm.org/doi/10.1145/3485447.3512133
• Preprint of the same paper with full result tables: https://arxiv.org/abs/2202.05257
• Georgia Tech research summary of the ban evasion paper: https://research.gatech.edu/computer-scientists-build-test-and-present-model-curb-online-ban-evasion
• Appeals Centre Europe, first annual transparency report coverage (May 27, 2026): https://courthousenews.com/big-techs-moderation-mistakes-are-piling-up-in-europes-appeals-system/
• Appeals Centre Europe transparency report announcement: https://www.appealscentre.eu/transparency-report-shows-big-increase-in-users-challenging-social-media-decisions/
• Imprivata on ban evasion and its impact on online platforms: https://www.imprivata.com/blog/ban-evasion-and-its-impact-on-online-platforms
• Incognia, "The Ban Evasion Toolkit," on reinstalls, emulators, proxies and purchased accounts: https://www.incognia.com/blog/toolkit-to-fight-ban-evading
• Fingerprint, "Strategies to Detect Ban Evasion," on proxies, antidetect browsers and aged accounts: https://fingerprint.com/blog/how-to-detect-ban-evasion/
• Arkose Labs Q4 2025 threat report, fake account creation as the leading attack type: https://secure.businesswire.com/news/home/20251217521684/en/Arkose-Labs-Report-Reveals-Explosive-Growth-in-SMS-Toll-Fraud-and-Precision-Targeted-Attacks
• VerifyYou, "The Ban Evader's Playbook": https://verifyyou.com/blog/the-ban-evader-s-playbook-why-90-get-away-with-it