Five hundred accounts. Twenty people.
Multi-accounting never looks like fraud from inside a single session — each account signs up cleanly, one at a time. Fraud Rings answers the question a per-session check cannot: how many of your users are actually the same person?
graph rebuild interval
rolling analysis window
risk score per ring
One person, many accounts
Every signup looked clean because every signup was clean. The damage lives in the pattern across accounts — and that pattern is invisible to any check that only ever sees one account at a time.
Promo and bonus abuse
Welcome credit, referral bonus, first-order discount — claimed once per account by someone holding forty accounts. The campaign budget drains into a single wallet while the acquisition numbers look healthy.
Ban evasion
A suspended user is back in ten minutes with a new email and a clean profile. Without link analysis the new account has no history, no reason to be stopped, and no way to be tied to the decision you already made.
Inflated affiliate payouts
Partners refer their own traffic — self-signups dressed as new customers. The payouts go out for conversions that were never new customers at all, and each one passes review in isolation.
Refund and chargeback laundering
The same person cycles orders, refunds and chargebacks across separate accounts, keeping every individual account below the threshold that would trigger a manual review.
Four kinds of link, one graph
Every 6 hours the link graph is rebuilt across a rolling 90-day window. Accounts are nodes, evidence of a shared origin becomes an edge, and each connected group of accounts is a ring with a risk score from 0 to 100.
acct_2841 ────── acct_7719 ────── acct_8804
│ │
│ │
acct_0192 ────── acct_5533 ────── acct_1170Accounts connected by shared evidence form a ring; the rebuild happens every 6 hours across the last 90 days.
The same browser
Two accounts used the same browser profile, identified by more than 300 signals rather than a cookie that clears on a whim. Incognito windows and cleared storage do not break the match.
The same device
Different browsers, one machine. Hardware and OS-level traits line up even when the browser profiles look nothing alike, which is what separates a determined multi-accounter from an ordinary repeat visitor.
The same home network
Accounts that keep appearing on one residential connection over time. Offices, campuses and carrier NAT put strangers behind a single address, so this counts as supporting evidence rather than proof on its own.
A matching behavioural pattern
How a person moves a pointer, types and scrolls. It is one of the four kinds of evidence in the graph and it reinforces a link — a ring is never built on behavioural similarity alone.
A ring is an accusation. We treat it like one.
Saying two accounts are the same person is a claim about somebody's behaviour, and your team will act on it — holding a payout, freezing a balance, closing an account. A false ring is worse than a missed one: it costs you a real customer and it costs your team's trust in the tool. So the graph is built to throw away evidence it cannot stand behind.
Geographically impossible devices are dropped whole
When one device shows a location trail no single person could have produced, that is not weak evidence to be discounted — it is a shared or spoofed identifier. Every link that device would have created is removed from the graph, not merely down-weighted.
Bucket identifiers are filtered out
Some technical identifiers accumulate dozens of unrelated profiles behind them. Left in place, a single bucket links everyone who ever touched it into one enormous ring that means nothing. They are detected and excluded before rings are formed.
New filters run in the dark first
Hygiene layers are evaluated against the existing graph before they are allowed to change what you see. The test is not that the ring count went down — it is that genuine cores came through untouched.
What that cleanup actually does
accounts in the largest false ring
accounts left after hygiene
The effect is not subtle. In our own data the largest false ring collapsed from 1,188 accounts to 77 once geographically impossible devices were pulled out of the graph — and the genuine cores in the same dataset stayed exactly where they were. That is the trade we make on purpose: a smaller set of rings we are ready to defend, rather than a large one your analysts have to second-guess.
What you will not get from us is a precision figure. Ring accuracy depends on your traffic mix, and hygiene layers are still being rolled out one at a time. What you do get is the evidence behind every single link, so each ring can be judged on what it is made of.
Rings, evidence, and a graph you can pull apart
Nothing is blocked on your behalf and no verdict arrives without its reasoning. The dashboard is built for the analyst who has to justify the decision afterwards.
The ring list
Every ring in your workspace with its size, its risk score from 0 to 100 and the time it was last rebuilt. Sort by risk and go straight to the handful that deserve a human look.
Evidence breakdown
For each link: what kind of evidence it is, which accounts it joins and what the graph actually saw. The reason the system believes these accounts belong together is on the screen, not behind an opaque score.
Interactive graph
Expand a ring node by node. Follow one account out to its neighbours, find the single link holding two clusters together, and decide for yourself whether that link carries the weight.
Built for the places one person becomes a crowd
Marketplaces
Seller rings running their own buyer accounts to lift ratings, and buyers cycling accounts to claim the first-order discount again and again.
iGaming and betting
Bonus hunters operating dozens of accounts, and self-excluded players returning under a new name. Both surface as one connected group instead of unrelated signups.
Fintech and lending
Applicants spread across accounts to slip past per-customer limits, and refund cycles that only look ordinary while each account is read in isolation.
Affiliate and referral programs
Self-referral rings where the partner, the supposedly new users and the payout account all sit inside the same cluster of the graph.
Available on Business and above
Fraud Rings is included with the Business plan and above. On Pro you can see that rings exist in your data — how many there are and how large they get — without the account-level breakdown.
Frequently asked questions
Find out how many of your users are one person
Connect your traffic, let the graph build, and look at your first set of rings with the evidence behind each link in front of you.