So let us suppose that I am designing a service that allow user to buy options on their account. And that they will keep those option indefinitely.
What measure should I take to reduce the likelihood for user to sell and buy account?
2 Answers
Unless this represents a HUGE difference ( and I mean HUGE), I'd recommend not to care about it. You'll waste time and resources and look quite desperate.
However, if you still want to do it, you can tie the account to a mail account. Then if you notice IP blocks have changed radically, send a mail like
"some suspicious activity has been detected with regards to your account, please [do something] in your profile"
since it will be highly unlikely the user sells the account AND the mail, you'll catch most cases of this.
You can do this with a phone instead of a mail, and it's way easier: just detect the location and match it with the phone's number (including country and city) and you'll catch these accounts in a snap.
Finally, if you want to go hard on this, you could use CC number. While mail account can be sold and phone # calls can be cheated (if the seller has good will), nobody will give CC number information. Just tell them
"for security reasons, we'll make a small charge to your card, just [do something] and we'll refund it immediately"
Don't forget to add the whole "this is for you, we're worried about your safety, we love you, yadda yadda yadda" gibberish and you'll be OK.
I think the best way to prevent a user from being able to sell the account is change of name, followed by preventing the user from changing their email address on their own. Then, the user would have to contact support to request an email change. But you may run into issues where you prevent them from changing their email address, because people have a tendency to use their work-related email address - email addresses can be changed by a user at will when they so choose. A user may want to switch from Outlook to Gmail or some other service. If you would require them to contact you with a request for email address change on their account, this would create additional overhead, and thus additional headache for you as the site admin.
But overall, there is no foolproof way of preventing them from selling the account. Even with a specific name bound to the account, a user may not care about the user name but moreso about the content. And it's the content that would be the reason for the purchase.
You could also perhaps put regional IP address restrictions on the account, but you run into issues with this as well in which a user may be traveling. Even though the user acquired the account in the United States, they may travel to Europe for the Summer and would like to access their account. If you bind the account to a particular region and block it elsewhere, then the account cannot be accessed by the valid user.
