How to defend against users with Multiple Accounts

Question

We have a service where we literally give away free money.

Naturally said service is ripe for abuse. To defend against this we do the following:

• log ip address

• use unique email addresses (only 1 acct/email addy)

• collect more info like st. address, phone number, etc.

• use signup captcha

• BHOs (I've seen poker rooms use these)

Now, let's get real here -- NONE of this will stop a determined user.

Obviously ip addresses can be changed via a proxy (which could be blacklisted via akismet) but change anyways if the user has a dynamic ip or if more than one user is behind a NAT'd network (can we say almost everyone?)

I can sign up for thousands of unique email addresses each hour -- this is no defense.

I can put in fake information taken from lists for street addresses and phone numbers.

I can buy captchas from captcha solving services (1k for $5).

bhos seem only effective for downloadable software -- this is a website

What are some other ways to prevent multiple users from abusing the service? How do all the PPC people control click fraud?

I know we could actually call the person but I don't think we are trying to do that anytime soon.

Thanks,

Answer 1

Re: signing up for new email accounts...

A user doesn't even need to do that. Please feel free to send your mail to [e-mail], or [e-mail], or [e-mail], or [e-mail]. I haven't registered any of those email addresses, but all of them will work.

Those domains are owned by ManyBrain, and they (and probably others as well) set the domain to accept any email user. ManyBrain in particular then makes the inboxes for those emails publicly accessible without any registration (stripping everything by text from the email and deleting old mail). Check it out: [e-mail]'s email inbox!

Others have mentioned ways to try and keep user identities unique. This is just one more reason to not trust email addresses.