Businesses encourage users to create accounts to share discounts and offers, and monitor behavior. Creating an account therefore needs to be quick and easy so that the consumer isn’t deterred. However, it’s equally straightforward for attackers to register for an account that will be used with malicious intent.

Detecting and preventing fake account creation attacks is becoming increasingly difficult as attack techniques evolve. Sophisticated fake account creation attacks are highly distributed and will use fake or stolen identities. These attacks are carried out in short bursts or spread out over prolonged periods, making them difficult to effectively spot and stop using traditional security measures alone.

The challenge for many businesses is that more registered users is a sign of growth, and the rising number of registrations is unlikely to be investigated too rigorously - until it’s too late.

Once an attacker has amassed many fake accounts, some may lay dormant for a long time or, dependent on the type of account, will be used to scalp limited availability items, abuse new customer offers, or validate stolen credit cards.

Fake bot accounts can be used to conduct a variety of different criminal acts, including:

• Free trial abuse: Through fake account creation, fraudsters can take advantage of these offers multiple times.
• Subscription abuse: Cybercriminals resell subscriptions or free trials on third-party sites at discounted rates, swaying potential customers to purchase away from the actual website or web app.
• Money laundering: Bad actors use fake accounts to launder funds from illicit operations.
• Review fraud: Fraudsters use fake account creation to flood review sites with favorable reviews of their product or negative reviews about a competing product.
• Manipulate public opinion: Automated accounts post fake comments on social media to inflate popularity of certain ideas and sway public opinion.
• Distribute spam or malware: Fake accounts can be used to send malware or spam messages.

Detection is becoming increasingly difficult as attack techniques evolve. Sophisticated fake account creation attacks are highly distributed and will use fake or stolen identification details. These attacks are carried out in short bursts or spread out over prolonged periods, making them difficult to effectively spot and stop using traditional security measures alone.

Other attempts to prevent fake accounts being created, such as the use of CAPTCHAs, do so by adding additional friction into the user journey. This necessitates new customers performing additional actions such as completing email validation, or strict rules are applied around data reuse. These methods are unpopular with customers and can be bypassed by most sophisticated bots.

Accurately detecting fake account creation requires a specialist, dedicated bot management tool. Netacea Bot Management provides industry-leading levels of detection accuracy for fake account creation and ensures that any website, mobile app or API can be effectively protected from the impact of attacks.

Netacea enables you to stop this activity at source by detecting fake account creation attacks as they happen, no matter how distributed or ‘low and slow’.

Netacea has created specific detection techniques that monitor all site visits to the registration pages and analyses them in context relative to each of the visitors on the site. Acquiring an understanding of what normal behavior looks like, relative to that unique business, allows us to establish what a typical account creation journey should look like and detect bots trying to automate this process. This allows Netacea to detect known bad actors and attack patterns.

All risk to your customers’ security and privacy is removed with Netacea’s unique JavaScript-less approach to bot detection. Disruption is minimized and there is zero requirement for mobile SDKs or browser/device fingerprinting.