1

So, I have an App where the user needs to sign up to access the app. I'm planning to run an offer where user can order that item only once in a day. But I have the doubt that he may change login Id (if have multiple emails) and can place the order with Different ID's.

I'm thinking of registering the device with an email id:

Pros: - Not able to login with a different email Id.

Cons: - Not able to use the app on a differnt device ( if changed) as it may give an error email Id already registered with another device.Which leads to deregister from the previous device (Chances device may not be available).Or raise a ticket which is time-consuming. this may lead to customer loss.

Have also, read about IP tracking, Phone number, and Credit card details but not satisfied with the answers (somebody already raised for same). So what will be a good method to avoid multiple logins/sign up from the same device?

Improve this question
1
  • you can't use IP address to track mobile users, they'll switch between connections several times a day (like when they go to the pub). I have 3 real credit cards, plus one for emergencies only, plus 2 or 3 debit cards. Device IDs can change from things like OS upgrades too, and you've spotted that broken devices won't be able to sign out. One option you do have is to ask "New device detected for this account. Log out old device?". Phone number restricts to a phone but might be your best bet
    – Chris H
    Commented Jul 14, 2021 at 13:33

4 Answers 4

Reset to default
1

I would say that a good way would be to use the phone number and SMS confirmation unless it would be advantageous for them to buy a SIM card just to profit off your offer. You could also use credit card but now it's easy to use virtual cards . Are you considering limiting after 1 or more orders ? What happens if there is a family and they all use different accounts ? IP is bad because it changes frequently wifi, 4g, different network etc., device tracking ( many people have a few phones a laptop and a tablet around the house anyway)

Improve this answer
0

If it is just about ordering "once a day", why don't you track the shipping adddress & name of the customer.

Otherwise you could always check the person behind that account. Verify with their bank, credit institues or anyone else that offers ident solutions and fraud & compliance services.

Over here in germany for example, the public post office (Deutsche Post) offers ident methods, also the country wide credit score institute (Schufa).

There are also ways like verifying the mobile phone number (like snapchat does), or even a mix of them combined. IP + # + address + fullname.

Please remember that fraud prevention and preventing multiple accounts for the same person can almost always be breached and abused and always costs a lot of money.

The "only" 99.99% safe way is to verify the users person (Name + Address) before shipping. Though, this would result in a extreme drop of signups, even though it would raise your conversion for people that register with your platform vs. these who actually buy something.

Improve this answer
7
  • We don't do shipping, the app is used for food and drink order in pubs.
    – Anas Idris
    Commented Aug 22, 2019 at 9:43
  • IP Address Pro: I can utilize this without even letting the user know. Pro: There's no way they'll forget it. Pro: Similar to phone numbers, getting more IP Addresses costs more than my service does. Con: Multiple users sharing a single internet connection can't sign up. Con: Users can't log in if they aren't at home. Con: Cell users can't sign up/log in if they're on cellular internet.
    – Anas Idris
    Commented Aug 22, 2019 at 9:43
  • Credit Card Number Pro: I need to get this sooner or later since I'm going to be charging them for this service when the trial period is over. Pro: Similar to the above two, getting more credit cards isn't particularly easy. Possible Con: Asking for this would definitely disturb some users, since it would disturb me. When I'm signing up, I have no idea if this is a legitimately useful website. For all I know, it's just a phishing attempt where they just steal credit cards.
    – Anas Idris
    Commented Aug 22, 2019 at 9:43
  • 1
    @AnasIdris About IP Addresses: You forget that the US isn't the only country on this planet. It is unusual world wide to have a fixed IP Address. In the EU as example, ISP's aren't even allowed to give their customers fixed IPs. Creditcards: These days it is very easy to get multiple credit cards. Especially with services like "mycard2go" and others, that let you create temporarily single use credit cards.
    – marvinpoo
    Commented Aug 23, 2019 at 8:13
  • The easiest but uncomfortable way is verifying the person behind the user.
    – marvinpoo
    Commented Aug 23, 2019 at 8:14
0

Tools like firebase provide a device id that changes less often [1], maybe you can try to remember the device id that perfomed the purchase instead of (or along with) the user.

But then, if the same user has a tablet and a phone he can still get two orders, or if he uninstall and reinstall the app and the id changes.

In general: security is never absolute, it is always a metter of costs vs risk. You have to find the solution that is optimal in term of costs/benefit ratio. Each solution reduce a bit the risk of abuse, you just have to properly evaluate how much time you spend to implement and maintain each solution and evaluate the best one based on your abuse ratio and impact

You can probably start with very low effort and improve if you smell bad behaviors.

[1] https://firebase.google.com/docs/reference/android/com/google/firebase/iid/FirebaseInstanceId

Improve this answer
0

Possible affordances

  • id - basic condition (if id boughts - not access) - it's possible to create new account
  • ip address (if ip address bought - not access) - it's possible to change ip/have a changing network
  • VISA - (if VISA boughts - not access) - it's possible to create new card
  • Cookies
  • Telephone Number (Pin system(?))

If you connect those 3 conditions - it's still possible to bought. but the more conditions, the more difficult it is (new account, change of IP and use of a new card - sounds a bit desperate)

I think - it doesn't require that type of prevention.

Also block purchases for 1 day from the moment of registration (cryptocurrency exchange offices do this - to verify the account).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.