Detecting Fake Account Signups

A clean customer list is a quiet asset. It powers accurate email segments, honest lifetime-value math, and welcome discounts that actually reach humans. But the moment your store starts ranking, offering a first-order coupon, or running a giveaway, the fake signups arrive—hundreds of accounts created in minutes, each one a disposable email attached to nothing.

Fake registrations are rarely random noise. They are the setup step for something else: farming welcome codes, testing stolen card numbers against a real account, or building a base of "aged" accounts to resell. Learning to read the signals early saves you from a bloated list and a fraud problem you can't see yet.

Why fake accounts are worth someone's time

The economics are simple. If your store hands every new account a 15% welcome coupon, a bot that registers 500 accounts just minted 500 coupons. Some get used immediately on cheap items shipped to a reshipper; others get sold in bulk on marketplaces. Even without a coupon, a fresh account gives a fraudster a place to save a card, run a $1 authorization, and confirm the number is live before hitting a bigger target elsewhere.

The damage compounds quietly:

• Skewed metrics. Signup conversion and CAC look great until you realize a third of registrations never open an email.
• Deliverability drops. Disposable and invalid addresses spike your bounce rate, which drags your sender reputation down for real customers.
• Discount leakage. Welcome and referral programs bleed margin to accounts that were never going to buy at full price.
• Hidden card testing. A wave of signups often precedes a wave of tiny, failed authorizations.

The signals that reveal a throwaway account

No single flag is proof. Fake signups reveal themselves through clusters of weak signals that rarely appear together on a legitimate shopper.

Signals.

• Disposable or suspicious email domains. Addresses at throwaway providers, or patterns like name+tag@, long random local parts (kd83jf9s@), and dozens of variations on one Gmail address using dots and plus-tags.
• Velocity from one source. Twenty accounts from the same IP or /24 subnet inside a few minutes. Humans don't register in bursts.
• Impossible timing. A form submitted 400 milliseconds after page load, faster than any person can type an email and password.
• Datacenter and anonymizing networks. Signups arriving from hosting-provider ranges, VPNs, proxies, or Tor exit nodes instead of residential ISPs.
• Sequential or templated data. First names like asdf, test, or user1, user2, and phone numbers that increment by one.
• No engagement footprint. Accounts that never open an email, never browse a product, and go dormant the instant they've grabbed a code.

Real customers are messy in human ways—typos, a slow form fill, a return visit from a phone. Bots are messy in machine ways—too fast, too uniform, too clustered.

Defenses that work without punishing real shoppers

The goal is friction that a bot trips over and a human never notices.

Honeypot fields. Add a hidden form field—styled off-screen, never shown to users. Real browsers leave it empty; naive bots fill every field they find. Any submission with that field populated gets silently rejected. It's invisible, free, and catches a surprising share of low-effort scripts.

Rate limits per IP and per fingerprint. Cap registrations from a single IP or device to something a household would never exceed—say, three accounts per hour. Legitimate families sharing an IP stay under it; a script hammering the endpoint hits the wall fast.

Email validation before acceptance. Verify that the domain has valid mail records and isn't a known disposable provider. This alone removes a large slice of junk before it ever lands in your list.

Timing checks. Record when the form was rendered and reject anything submitted implausibly fast. A minimum of a second or two is invisible to people and lethal to bots.

Progressive challenges. Reserve a CAPTCHA or verification step for sessions that already look suspicious—datacenter IP, high velocity, honeypot triggered—rather than showing it to everyone. Blanket challenges hurt conversion; targeted ones don't.

Where checkout-level blocking fits

The strongest layer isn't the signup form at all—it's the network the request comes from. If you can identify that a visitor is on a VPN, proxy, Tor node, or datacenter range before they register, you can stop the fake account at the door instead of cleaning it up later.

This is where Shieldy — Fraud Filter does the heavy lifting. It evaluates IP reputation, country, and anonymizing-network signals, and can block or challenge visitors before they ever complete a registration or reach checkout. Because the same visitors who mass-create accounts are usually the ones attempting fraudulent orders, filtering them at the network level protects both your customer list and your order flow at once. AI fraud scoring adds a layer that weighs these signals together instead of relying on any single rule.

A practical starting configuration:

• Block or challenge signups and checkouts from known VPN, proxy, and Tor sources.
• Restrict or add friction for high-risk countries you don't sell to.
• Let residential traffic through untouched so real customers feel nothing.

A simple weekly hygiene routine

Detection isn't only automated. A short manual pass keeps you honest:

1. Sort new accounts by creation time and look for bursts. Ten accounts in one minute is a story.
2. Scan email domains for disposable providers and near-duplicate patterns.
3. Cross-check IPs against your recent order and chargeback logs—fake signups often share ranges with fraud attempts.
4. Purge and suppress confirmed junk so it stops distorting your metrics and deliverability.

Over a few weeks you'll build an instinct for what your store's real signup pattern looks like, which makes the abnormal jump out immediately.

The payoff

Every fake account you block is a coupon you keep, a bounce you avoid, and a card-testing attempt you cut off early. The list you're left with is smaller but honest—and an honest list is one you can actually build a business on.

Start with the free, invisible layers—honeypots, timing checks, email validation—then add network-level filtering so the bots never reach your form in the first place. If you want that filtering handled at the checkout and account level automatically, see how Shieldy stops fraudulent traffic before it costs you anything.