Multi-accounting detection: linking accounts across wallets

Multi-accounting is when one actor runs several accounts on the same platform to farm incentives that are meant to be claimed once per user. Each account can look clean on its own and pass KYC. Multi-accounting detection links the wallets and funding behind those accounts, so you can review whether they belong to the same actor.

What is multi-accounting?

Multi-accounting is one actor opening and running several accounts so that limits and incentives meant for one user pay out many times. Each account has its own email, its own device and its own KYC check. What ties them together sits in the wallets that fund them and the wallets that receive their withdrawals.

The goal is repeat value, not a single grab. Reload bonuses, rakeback, weekly promos and per-account limits all reset for each account, so every extra account multiplies what the actor can take. The accounts stay open and active for weeks or months. That is why multi-account farming is better described as an ongoing operation than as a single event.

This is the difference from signup-bonus abuse. Signup-bonus abuse is one-shot: accounts are created to collect a welcome offer and exit. Multi-accounting keeps the accounts alive and keeps claiming. The two can overlap, but they leave different traces and call for different reviews.

How does multi-account farming work, step by step?

Most operations follow the same sequence. The details change from actor to actor, but the shape stays the same:

1. Open the accounts. The actor opens several accounts, each with a different email and device, spread out over days or weeks. Each one passes KYC.
2. Fund them from a common source. Deposits arrive from different deposit addresses, but those addresses were funded by the same wallet, directly or after a few transfers.
3. Wager just enough. Each account does the minimum needed to unlock reload bonuses, rakeback and promos, and stays below the per-account review thresholds.
4. Claim on a schedule. Incentives are claimed account by account, often on the same rhythm.
5. Cash out to one place. Withdrawals leave to separate wallets, then move on to one collection wallet within days.

A worked example (illustrative numbers)

The figures below are invented to show the pattern. They do not describe any real platform, user or client.

One actor opens six accounts over eight weeks. Every account has a different email and a different device, and every account passes KYC. The platform has a rule (also illustrative) that sends an account to review if its net gain passes $500 in 90 days.

Seen one at a time, no account reaches the $500 line. The highest is $340. Now add the wallet view. The first deposit for all six accounts traces back to one funding wallet. All six withdrawals reach one collection wallet within two days of each cash-out.

Linked, the six accounts are one actor with $1,670 in net gain, more than three times the per-account threshold. That actor also claimed $2,450 in incentives that were meant to be paid once per user, and the accounts are still open and claiming.

Why do standard checks miss multi-accounting?

Standard checks look at one account at a time, and each account in a ring is built to pass on its own. KYC checks the details each account submits. It does not tell you that six valid accounts send their withdrawals to the same wallet.

Device and session checks catch some reuse, but a careful actor changes devices, browsers and networks for each account. As we explain in why device fingerprinting misses crypto fraud, device-first tools watch the session but never the wallets behind it. Chain analytics has the opposite gap: it watches wallets but never the actor behind the account.

Per-account rules have the last gap. A rule that flags net gain over a threshold runs on each account and clears each one, as in the example above. The rule is not wrong. It only ever sees the parts, never the whole.

What wallet-level signals give multi-accounting away?

The strongest signals come from where money enters and leaves the accounts, because that is the hardest part for one actor to keep separate. Emails and devices are cheap to change. Funding and cash-out routes are not.

• Shared funding source. Deposit addresses for different accounts were funded by the same wallet, directly or after a few transfers.
• Converging cash-outs. Withdrawals from different accounts end up in one collection wallet.
• Shared timing. Accounts are funded, claim incentives and cash out on the same rhythm.
• Incentive-shaped activity. Each account does the minimum needed to unlock a reload bonus, rakeback or a promo, then withdraws.
• Risky counterparties. Funding arrives through transfers from a known-risky entity.
• Activity on other platforms. The same wallets deposit on other platforms too.

No single signal settles the question. Together, they show whether a set of accounts behaves like one actor. Addressable's crypto fraud detection works through them in four stages:

1. Surface. On-chain rules flag a candidate wallet from public activity alone.
2. Expand. The graph pulls in every other wallet and session belonging to the same actor.
3. Re-score. Your existing rules re-run across the whole cluster: total gain, deposit addresses, platforms hit. In the example, this is where $290 becomes $1,670.
4. Classify. The pattern gets named, here multi-account farming, and independent signals have to agree before anything is flagged.

What should you do when multi-accounting detection flags a ring?

Treat the flag as a reason to review, not as a verdict. Each flag arrives named, with reason codes an analyst can check against the wallet-level evidence, such as a shared funding wallet or converging cash-outs. The analyst verifies it and acts, or clears it, and a cleared case becomes a label the system learns from.

Uncertain cases go to your review queue, not to an automatic decision. Review the linked accounts together rather than one by one. Look at the combined gain, the incentives claimed across the group, the funding source and where the cash-outs went. A shared funding wallet on its own can have an ordinary explanation. Six accounts claiming the same reload bonus in the same week and cashing out to one wallet is a stronger reason to look closely.

What happens next is set by your policy. You choose the thresholds, weights and bands, and what each one triggers: allow, monitor, hold or deny. A cluster might move to monitor at one score and to hold at another. Before a change goes live, test it in a dry run against the last 30 days, so you can see which accounts it would have caught.

The network adds a head start. When an actor is flagged anywhere in the network, their risk on your platform rises the same day, before they have done anything to you. Your data stays in your tenant. Only the derived risk state is shared.