How to prevent creation of multiple accounts under the same company?

Question

Let's say there's Company ABC and Employee A signed-up for an account under his own email address (e.g. [email protected]). However, let's say Employee B signed-up under the same company but using his own email (e.g. [email protected] or [email protected]).

Our system must be able to detect that Employee B cannot create an account anymore because the Company he belongs to is already signed-up. It's one account only per Company.

What fields should we require on the registration form that will prevent this from happening? They may enter the same company name differently also so we cannot rely merely on the company name (e.g. some may refer to their company as Company ABC or Company abc or ABC only.. but they're actually referring to the same corporation).

Answer 1

Others have mentioned that there is no technical way to enforce this restriction 100%. People can be clever, people will find ways around this.

One approach would be to legally enforce this, by adding it to the contract people agree to when they sign up to your service.

But why do you want to enforce this restriction? Do you just want to prevent the same company from accidentally signing up with several accounts that you'd then have to merge?

Don't you think that having only one set of login credentials for what could be a 100-user company might be a security issue?

Have you considered reversing the requirement? What if you allow people to specify a company, and then permit several accounts but have them all connected to the same company? Depending on your reasons behind only wanting one company account (e.g. preventing them from claiming free benefits more than once), this might be a workable approach.

Without knowing why this restriction is needed, it is hard to suggest a good solution.

Answer 2

You can never prevent this for 100%. There will always be ways to move around the technical restrictions you might apply. For example, can someone register for his company using something like @gmail.com?

In addition to that I think you can check afterwards. Maybe let users register but only give full access after verification? Adding T&Cs is also a good idea.

Side note

One might hope companies have had a meeting about who registers the company but you never know. Oh, wel...

What to do?

The best thing you can do is think of all the possible ways someone might submit something you do not want to be submitted and try and prevent that.

I've thought of one to start with;

• User uses personal mail account

You could check the domain to prevent this from happening.

@companyabc.com will always be part of the address used in the form. Another idea might be to ask for the company name and check it with the domain used in the address to see if it is the same. This way you might prevent use of personal mail addresses.

Try and add to this list, but also think of the human factor in all of this.

Answer 3

Let's reduce the chances of duplication one by one.

First of all, if your requirement is NO DUPLICATION, then email should not be your primary key, you can ask for a mobile number.

That will reduce many cases already as very few number of people have 2 active mobile numbers. Secondly, there are lots of ways to verify an identity with a mobile number. The verification can be done by Calling, OTP, video calling. All depends on the level of a surety you want to go for.

With Email, it's a lot more difficult, even if somehow you pull it off, the mobile number verification will always be the more optimized way.

Maybe you can use the combination of email and mobile number. Hope I have given you some new set of solutions for this problem. Cheers.

Answer 4

Rather than give you the solution specifically, here's a process to use tosolve it for yourself.

1. Define a successful outcome for the human/computer interaction you are describing.

   An example might be: "System prevents employee from creating a duplicate account without scaring him/her off the API."

2. Go back to whichever persona represents your basic corporate employee.
3. Create a Customer Journey Map for them in the form of a swim lane diagram
4. In your diagram, create three swim lanes and label them
   • "Employee"
   • "Back End Process"
   • "Front End Interaction"
5. In the "Employee" lane, use standard flowchart shapes to depict his/her process as he/she attempts to create a personal account on top of the one owned by his/her employer.
6. In the "Back End Process" lane, use flow chart symbols to document the error or duplication checking process the system would undertake to prevent the unwanted outcome you described.
7. If the system needs to get more information from the user, prompt an action or alert them to a problem it has uncovered, put those messages (e.g. "We need a bit more information to proceed. Can you please give us the name of your employer? We won't share this with anyone.") put those in the "Front End Interaction" column or horizontal lane.
8. Keep running the process through the flowchart vectors until you arrive at the desired outcome you defined at the beginning.