How to Block Multiple Logins /Sign Up?

Question

So, I have an App where the user needs to sign up to access the app. I'm planning to run an offer where user can order that item only once in a day. But I have the doubt that he may change login Id (if have multiple emails) and can place the order with Different ID's.

I'm thinking of registering the device with an email id:

Pros: - Not able to login with a different email Id.

Cons: - Not able to use the app on a differnt device ( if changed) as it may give an error email Id already registered with another device.Which leads to deregister from the previous device (Chances device may not be available).Or raise a ticket which is time-consuming. this may lead to customer loss.

Have also, read about IP tracking, Phone number, and Credit card details but not satisfied with the answers (somebody already raised for same). So what will be a good method to avoid multiple logins/sign up from the same device?

Answer 1

I would say that a good way would be to use the phone number and SMS confirmation unless it would be advantageous for them to buy a SIM card just to profit off your offer. You could also use credit card but now it's easy to use virtual cards . Are you considering limiting after 1 or more orders ? What happens if there is a family and they all use different accounts ? IP is bad because it changes frequently wifi, 4g, different network etc., device tracking ( many people have a few phones a laptop and a tablet around the house anyway)

Answer 2

If it is just about ordering "once a day", why don't you track the shipping adddress & name of the customer.

Otherwise you could always check the person behind that account. Verify with their bank, credit institues or anyone else that offers ident solutions and fraud & compliance services.

Over here in germany for example, the public post office (Deutsche Post) offers ident methods, also the country wide credit score institute (Schufa).

There are also ways like verifying the mobile phone number (like snapchat does), or even a mix of them combined. IP + # + address + fullname.

Please remember that fraud prevention and preventing multiple accounts for the same person can almost always be breached and abused and always costs a lot of money.

The "only" 99.99% safe way is to verify the users person (Name + Address) before shipping. Though, this would result in a extreme drop of signups, even though it would raise your conversion for people that register with your platform vs. these who actually buy something.

Answer 3

Tools like firebase provide a device id that changes less often [1], maybe you can try to remember the device id that perfomed the purchase instead of (or along with) the user.

But then, if the same user has a tablet and a phone he can still get two orders, or if he uninstall and reinstall the app and the id changes.

In general: security is never absolute, it is always a metter of costs vs risk. You have to find the solution that is optimal in term of costs/benefit ratio. Each solution reduce a bit the risk of abuse, you just have to properly evaluate how much time you spend to implement and maintain each solution and evaluate the best one based on your abuse ratio and impact

You can probably start with very low effort and improve if you smell bad behaviors.

[1] https://firebase.google.com/docs/reference/android/com/google/firebase/iid/FirebaseInstanceId

Answer 4

Possible affordances

• id - basic condition (if id boughts - not access) - it's possible to create new account
• ip address (if ip address bought - not access) - it's possible to change ip/have a changing network
• VISA - (if VISA boughts - not access) - it's possible to create new card
• Cookies
• Telephone Number (Pin system(?))

If you connect those 3 conditions - it's still possible to bought. but the more conditions, the more difficult it is (new account, change of IP and use of a new card - sounds a bit desperate)

I think - it doesn't require that type of prevention.

Also block purchases for 1 day from the moment of registration (cryptocurrency exchange offices do this - to verify the account).