How to stop spam signups and fake accounts
Contents
Share
A spam signup is mass creation of new accounts through the ordinary registration form, sometimes with a filled profile, so those accounts can be abused later. The OWASP catalog (OAT-019) says these are new accounts. Guessing and checking login-password pairs that already exist are different events. Click fraud is not the same as creating an account.
You need this if signups are rising and support is getting empty profiles. Below: how those accounts differ from signing in with someone else’s password, and an order that stops them without cutting off live people.
A new account and someone else’s password are different events
Among the later uses of mass account creation, the catalog names spam, reputation, search manipulation, reviews, and polls. The account appears where the site itself offers registration. The catalog does not describe how your particular signup is built. It names the kind of event.
Checking someone else’s pairs is different. OWASP separates three attacks on sign-in. Credential cracking is many passwords against one account. Credential stuffing is testing login-password pairs leaked from another site. Password spraying is one weak password across many accounts. OWASP calls a second factor the best defense against most of these attacks. A figure for the share of compromises a second factor would have stopped is not used here: the source has no year and no sample.
If you close registration the same way you close the sign-in form, you are blocking the wrong event. At registration there is no stolen pair yet. There is a new mailbox and a new profile.
Confirm email before the account is live
For account creation, OWASP says the email has to be confirmed before the account becomes usable, not merely followed by a “you are registered” message. Until the link in the message is used, the account should not receive rights: reviews, mailings, reputation.
For a phone number, look at the carrier line type. VoIP numbers are numerous and cheap — a remark with no year and no sample, so it is not a share of your signups. Disposable email domains are checked against a list. A threshold of “how many registrations from one address” is not set here. This is also not Yandex Direct’s rule about a wrong phone on an advertising lead.
A browser email field, according to MDN, checks format only: an empty string or an address shaped like name@domain. That does not mean the mailbox exists, belongs to this person, or is acceptable to the site. A user can change the HTML locally, so a decision that security depends on is made on the server. A browser format check is not that boundary by itself.
Do not refuse on the first weak signal
The OWASP job for bots is not to stop all of them. Search crawlers, monitoring, and accessibility tools are legitimate. The job is to raise the cost of malicious automation. A single trick is fragile. Protection is assembled from the network edge, the application, and business rules. Before you pick a trick, sort the points: sign-in, registration, the catalog, and checkout are built differently. Registration is its own point.
A hard refusal on the first signal is a mistake. So is refusing everyone whose browser is hardened for privacy: those visitors often look like a bot. The preference is a check, not a refusal.
A weak suspicion — record it and still serve the visitor.
Medium confidence — an extra check.
Confirmed abuse — a manual review.
Tricks that corrupt the response or deliberately slow it are not part of this order.
Order for registration
Separate creation of a new account from sign-in. On sign-in, think about stolen pairs and a second factor. On registration, think about the account not being live yet.
Do not trust the green check on the browser email field. Check the format on the server and do not treat that as proof the mailbox exists.
Confirm email before rights. Check disposable domains against a list. For a phone, look at line type.
Record the first weak signal and let the person continue to confirmation, rather than a ban. Turn on an extra check at medium confidence.
Add a second layer besides one form field: the network edge, or a business rule that no confirmation means no rights. One trick is not enough.
By hand you can read a dozen profiles. A stream of new accounts on disposable domains cannot be read by hand: while you open one profile, the next account already has rights if the “you are registered” message granted them immediately. Confirmation before rights closes that gap without a captcha on every step. A second factor on sign-in stays separate: it is about pairs that already exist, not about a new profile.
Walk one signup through the layers so you can see where a control already sits and where it does not. The network edge can limit how often the registration address is requested, but OWASP does not put a frequency threshold in this description: what matters is the layer, not a number. The application checks the format on the server and withholds rights until the link in the message is opened. A business rule decides that a profile with unconfirmed email does not publish a review and does not accumulate reputation. If all three layers are missing and the only check is a green mark in the browser, the account becomes live at the moment of submit.
Then walk the phone. Carrier line type is a signal from the OWASP description, not a ban on every number that “does not look mobile.” VoIP is called numerous and cheap with no sample, so you do not compute a weekly share of fake accounts from that sentence. You check disposable domains against a list before rights are granted. A domain missing from the list is not proof of a live person: the list can be behind, and the mailbox can still fail to exist. A server-side format check and a confirmation link close different holes. The format rejects a string with no “@”. The link rejects a mailbox nobody opens.
A weak signal on registration looks like this: an unusual client, one address, one profile. You record it and send the person to the message. Medium confidence is when the unusual client is joined by a disposable domain or a line you have already classed as cheap. Then you turn on an extra check, not an instant ban. Confirmed abuse is a pack of new accounts with the same later purpose from the catalog: spam, review inflation, polls. That pack is reviewed by hand. A hard refusal of everyone with a privacy-hardened browser is not part of that review: those visitors often look like a bot and are still people.
Do not copy the whole sign-in defense onto registration. A second factor stops most attacks on pairs that already exist. A new account has no pair yet, so there is nothing to attach the factor to until the person has confirmed email and set a password. The other way around is also true: email confirmation does not replace a factor on the sign-in form. The catalog explicitly separates new accounts from checks of pairs that already exist.
Who clicks ads, how click fraud differs from sklikivanie, why invalid clicks are not always refunded, and whether Yandex returns the money are not decided by registration. An ad click and a new account are different losses.