What's the best way to catch account sharers?

I thought about:

  1. See how many people are currently logged in with it (cookies)
  2. See how many logins there were in the past 24 hours
  3. See how many different IPs logged in the past 24 hours

How do I catch account sharers on a website?

  • None of those because: 1: what if the legitimate person logs in on more than one device? 2: That is no test for legitimate/shared logins 3: This will give false positives for people with dynamic IP addresses or multiple devices on different networks.
    – Steve
    Jan 23 '18 at 22:35
  • @Steve do you have an alternative idea on how to deal with this?
    – Bob
    Feb 8 '18 at 9:11
  • Yep, relax. Some people will share accounts, I do. There is little you can do about it.
    – Steve
    Feb 10 '18 at 22:56

Below are some ways to catch account sharers:

  1. Capture MAC, IP Address, Time-in when the user logins to the account
  2. Limit the number of sessions for a particular account/login. If this is a one-one service, limit the login to 1. Whenever, user tries to login from a different device, force logout the other device or show a notification to the original device that somebody else logged in and will be logged out.
  3. When you find a new session being logged, compare the IP range. If it falls from one county to another, chances are it is being shared. You can block the account based on this trigger.

I would write an algo with reinforced learning to make changes over time and adapt for the better.

Notes: Wouldn't recommend this if your users get frustrated by false-positives. You will have to define your T&C based on the services and guidelines forehand.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.