One hundred accounts open in an hour. Different names, one device, each claiming the welcome bonus and cashing out within minutes. Your onboarding flow approved every one.
Fraudulent sign-up detection is the practice of scoring each registration in real time to separate a genuine new customer from a fake or coordinated account. In fintech, that decision has to land at signup, before any value moves.
Key takeaways:
What Is Fraudulent Sign-Up Detection?
Fraudulent sign-up detection is the real-time assessment of a registration to decide whether the person creating the account is genuine, before onboarding completes. It reads signals the applicant cannot easily fake, then returns a risk score the team can act on in the moment.
This sits inside the wider problem of new account fraud, and it targets one of its hardest forms: coordinated creation, where a single operator runs many accounts at once. That pattern is also known as multi-accounting. It differs from account takeover fraud, which seizes accounts that already exist rather than manufacturing new ones.
The distinction matters because most onboarding checks verify identity, and identity verification says nothing about whether ten “different” applicants are really one actor behind one device.
What Coordinated Fake Sign-Ups Look Like in Fintech
A coordinated attack almost never shows up as one dodgy application. It shows up as volume. You get a run of registrations that each look fine on their own, and the problem only appears once you connect them and see the same device, IP range or funding source underneath.
Most of what fintech teams catch at onboarding falls into three buckets.
- The first is batch or multi-account creation. One device, or a few devices sharing the same hardware traits, opens dozens or hundreds of accounts in a short window. The personal details change from account to account, but the device, IP and network profile give the operator away.
- The second is bonus and referral abuse, where the aim is to extract value rather than take over anyone. The playbook is register, claim the reward, withdraw and move on. Referral programs get hit hardest, because one person can refer their own accounts and collect both halves of the payout. It is the same behavior SEON sees in bonus abuse across other verticals.
- The third is synthetic and aged accounts. Here fraudsters mix real and fake data to clear a basic Know Your Customer (KYC) check, then leave the account alone for a week or two and run small test transactions to bring its risk rating down before they cash out.
Automation makes all three cheaper to run at scale. A single operator can buy fabricated identity documents in bulk and script the signups, ending up in control of a thousand accounts that each pass inspection on their own.
Why Fintech Onboarding Is the Easiest Target
Onboarding in fintech is a conversion funnel, and every step that adds friction costs signups. Growth teams optimize relentlessly to remove that friction, and the same pressure creates the opening fraudsters exploit.
New platforms carry an extra weakness: no historical baseline. A fraud model needs data to calibrate against, and a platform with six months of history has very little, so fraudsters deliberately target new entrants before the rules are tuned.
Lending shows the pattern clearly. Groups of applicants with no credit history onboard quickly, take out loans and disappear, linked only by shared IP addresses and applications filed within minutes of each other. The same tension appears anywhere funds move before settlement clears, including buy now pay later (BNPL), instant transfers and early wage access, where a faster disbursement means a shorter window to catch the fraud.
How to Detect Fraudulent Sign-Ups
Fraudsters exploit those gaps precisely because the signals they leave behind fall outside standard onboarding checks. Understanding what those signals are is the first step to catching them.
Fingerprint the device
Device intelligence is the first layer. Modern device fingerprinting uses more than 200 data points (including hardware characteristics, browser attributes and network configuration) to reliably identify a device, even when cookies are cleared, incognito mode is active or the app has been reinstalled. When the same device appears across 40 registrations in 90 minutes, the pattern is visible; where document verification sees 40 different people, device intelligence sees one.
Screen the email footprint
Email age and digital footprint are sharper signals than most onboarding flows account for. An email address created four minutes before signup has no associated digital presence: no social profiles, no forum activity, no platform registrations. This absence is informative. An email used across GitHub, LinkedIn and a decade of online activity presents a fundamentally different risk profile. Email risk assessment tools check hundreds of online platforms to surface that footprint difference in real time.
Score the IP and network
IP history is where coordination becomes visible. A residential IP that has appeared in prior fraud cases, or a data center IP routed through a residential proxy to defeat geo-detection, falls into a different risk category than a clean ISP connection. IP fraud scoring evaluates connection type, VPN/proxy likelihood, geo-mismatch against device location and prior fraud association.
Enrich the phone number
Phone enrichment adds another layer. A phone number registered two days ago, on a carrier known for disposable SIMs, with no associated accounts on any major platform, is a weak identity signal regardless of whether the number is technically valid.
Watch velocity across accounts
Velocity patterns tie the signals together. A maximum-bonus withdrawal 22 minutes after registration is one data point. Combined with a fresh email, a proxy IP and a device that opened four other accounts in the last hour, it becomes a coordinated ring with a clear interpretation. Network analysis links those accounts through the data points they share.
Checked individually, each of these signals has a plausible explanation. Checked together, they describe a fraud operation.
How to Detect Bot and Automated Sign-Ups
Coordinated sign-ups at fintech scale are rarely typed by hand. They run through automation, and the automation is where you catch them, because bots and emulated environments behave in ways real users do not.
Cloud device farms now let a single operator control large numbers of real phones remotely, configuring each one to look like a fresh device and using them to get past phone verification and mass-produce accounts. Emulators and virtual machines do the same job more cheaply. The defense is to detect those environments directly, spotting emulators, jailbroken or rooted devices and spoofed setups, then reading behavioral biometrics, because a script that jumps straight to the submit button with no natural cursor movement is not a person.
Device and behavioral signals catch what identity data cannot, since a farmed account can present a valid email and a real phone number while the environment creating it is entirely automated.
Why Most Onboarding Checks Miss It
Standard onboarding checks answer only half the question. Confirming that identity data is real and consistent matters, but it reveals nothing about whether the account creation is isolated or coordinated, and coordination is the whole game here.
Blackbox fraud models make this worse. A score with no reasoning is an operational dead end: support has no explanation for a declined customer, and the risk team has no lever to adjust the threshold. The result is false positives that quietly erode conversion, a familiar problem across fintech platforms of every size.
Static blocklists fail differently. They catch known-bad indicators, but fraudsters burn through email domains, phone prefixes and IP ranges fast, so a domain you block today was likely abandoned yesterday while the operation moved to fresh infrastructure.
How to Block It Without Hurting Legitimate Users
Blocking coordinated sign-ups is a three-move sequence: catch the coordination, sort it by severity, then tune as you learn.
Start with velocity rules. They flag coordination as it happens, firing whenever a pattern crosses a threshold inside a time window, say more than three signups from one device in an hour. Keep the threshold and window editable so the rule tracks each attack as it shifts, because a promotion-driven burst behaves differently from a slow, aged-account campaign.
Then route each flag into approve, review or decline instead of blocking on sight. A footprint-free email goes to step-up verification, while a device seen in five prior fraud cases gets an outright decline. Reviewing borderline cases rather than blocking them is what keeps false positives, and lost genuine customers, down.
Finally, tune with explainable scoring. A score of 74 tells you nothing alone, but a score that shows its drivers, email age three days, data center proxy, device on two prior declines, lets an analyst see why it fired and move the threshold without rebuilding the model. The shift underneath all of this is treating signup as a risk event, not just a conversion step.
FAQ
How do you detect multi-account fraud during signup?
Link registrations by the infrastructure they share. Even when names, emails and phone numbers differ, a device fingerprint, IP range, network profile or funding source repeats across the accounts. Real-time device intelligence and network analysis expose that shared layer at the point of signup, before the accounts transact.
What is fraudulent sign-up detection?
It is the real-time assessment of a registration to decide whether the applicant is a genuine new customer or a fake, bot or coordinated account. It reads device, email, IP and phone signals the applicant cannot easily fake, then returns a risk score used to approve, review or decline the signup.
How do you detect fake accounts in fintech?
Score the signals that fake accounts cannot fabricate cheaply: email age and digital footprint, phone type and history, IP reputation and device characteristics. A registration with a brand-new email, a disposable phone, a proxy IP and a reused device profile is high risk even when every field is technically valid.
How do you detect bot or automated sign-ups?
Look for emulators, virtual machines, jailbroken devices and spoofed environments, then add behavioral biometrics. Automated sign-ups skip the natural cursor movement, typing rhythm and timing of a real user, and cloud device farms leave device inconsistencies that a genuine phone does not.
What is a velocity rule, and how does it catch coordinated signups?
A velocity rule counts events across a data point inside a time window, for example more than three registrations from one device in an hour, or several accounts sharing an IP within a day. When the count crosses your threshold, the rule flags the pattern in real time, which is how batch and coordinated sign-ups surface as they happen.
