Fake Account Creation (Bots)

Automated mass sign-ups that create accounts to farm incentives, stage mule and cash-out accounts, or launch transaction attacks such as card testing and promo abuse.

At a glance

What it is: Automated, high-volume creation of accounts that don't correspond to a real, distinct customer. They are built to be used for something else.
Who commits it: Third-party operators and organized rings. Also first-party abusers scaling their own Multi-Accounting.
Where it hits: Anywhere a new account earns value: Cashback, Coupons and Rewards, Retail and Ecommerce, Online Marketplaces, Neobanks and Consumer Fintech, Payments and P2P, Brokerage and Investing. Lifecycle: onboarding first, with losses at rewards, transaction and payout.
How the money moves: Sign-up and referral bonuses are redeemed and paid out to shared destinations. Accounts are used as card-testing endpoints, receiving accounts for stolen funds, or inventory for resale.

SeverityMedium

PrevalenceHigh

Detection difficultyMedium

What it is

OWASP catalogs bulk sign-up as OAT-019 Account Creation: creating multiple accounts for later misuse. Its listed aliases include "account pharming" and "massive account registration." OWASP's examples lean toward spam and reputation abuse, which this vault treats as out of scope. In transaction fraud, the misuses that matter are:

Incentive farming. Every account is a new-customer bonus, a referral reward or a first-order discount (Sign-Up Bonus Abuse, Referral Abuse, Promo Code Abuse).
Attack infrastructure. Accounts that run Card Testing against funding endpoints, or file claims at scale (Buyer Protection Claim Abuse (INR and SNAD)).
Money-movement staging. Receiving and pass-through accounts for stolen funds (Money Mules), especially at fintechs with light onboarding.
Inventory. Accounts created to be aged and sold (Account Farming and Resale).

Credential Stuffing (OAT-008) is related, but it attacks existing accounts. Synthetic Identity Fraud is about fabricated identities that pass KYC, which is a higher-effort, lower-volume problem. Many fake-account operations use thin identities (an email and phone only) where no KYC applies.

How it works

Diagram: Identity material: emails, phone numbers, sometimes stolen or synthetic PII, Automated sign-up across web, app and API, Device and network diversity to look like distinct users, Accounts pass onboarding checks, Activation: bonus, referral, card test, receive funds, Cash-out to shared payout destinations

Conceptually:

Supply. Bulk email addresses and phone numbers, and for KYC'd products, stolen or synthetic identity data.
Automation. Scripts or automated mobile clients complete sign-up at volume. OWASP's taxonomy separately lists the supporting automation threats, such as OAT-009 CAPTCHA Defeat and OAT-004 Fingerprinting.
Diversity theater. The operator makes each account look like a distinct person on a distinct device and network. See Device Farms and Emulators.
Activation and cash-out. Each account does the minimum needed to earn value, and the value converges on a small number of payout destinations. OWASP calls the final step OAT-012 Cashing Out.

Transaction footprint

Fake accounts are an onboarding problem, but the loss is booked at the reward, transaction or payout. Score the sign-up, then score the account again at first value.

Stage	What you see in the data	Decision point
Sign-up	Bursts of sign-ups with similar timing, metadata and form behavior; disposable or newly created emails; VoIP or recycled phones	Bot Management and CAPTCHA, Rate Limiting and Throttling, sign-up scoring
Activation	Minimum-qualifying actions (one purchase, one deposit, one referral) shortly after sign-up	Hold bonus until it vests (Reward Vesting and Clawback)
Funding (fintech)	Small, uniform first deposits; funding sources shared across accounts	Funding Source Signals, Bank Account Ownership Verification
Redemption or payout	Many accounts paying out to the same bank, card, wallet or gift card destination	Entity Link Analysis; Withdrawal and Payout Controls
Dormancy	Accounts go idle after the reward, or are held for resale	Cohort monitoring; Account Farming and Resale

Common variants

Variant	What's different	Where it shows up
Promo and bonus farms	Accounts exist only to earn new-user value	Rewards, retail, neobanks, brokerage free-stock offers
Referral loops	Fake referees created by the referrer	Rewards, fintech, marketplaces
Card-testing accounts	Accounts as endpoints for validating stolen cards	Wallet funding, subscriptions, donations
Mule-account creation	Light-KYC accounts to receive and move funds	Neobanks, P2P, payments
Marketplace buyer and seller farms	Accounts used for claim abuse or to make fake sellers look credible	Marketplaces
Hybrid human-plus-bot	Humans complete the hard steps (selfie, KYC) and automation handles the rest	KYC'd products

Where it shows up

Rewards and cashback apps see the highest volume. Per-account value is small, but cash-out is easy.
Retail and ecommerce sites see abuse of first-order discounts and free trials.
Neobanks and P2P apps see sign-up bonus abuse, plus mule staging, which is the costlier problem.
Brokerages see funded-account and free-stock bonus abuse, and staging accounts for ramp-and-dump. FINRA has flagged nominee accounts under "centralized control."
Marketplaces get fake buyers for claim abuse, and fake sellers for Seller Non-Delivery and Fake Listings.

Impact

Direct. Bonuses, discounts and rewards paid out to non-customers. Card-testing fees and downstream chargebacks. Funds lost through mule accounts.
Measurement distortion. Fake accounts inflate growth metrics, distort promo ROI, and hide real conversion. Finance and growth teams often learn about the problem late. See New Product and Promo Launch Review.
Regulatory. For fintechs, fake accounts that move illicit funds create BSA/AML exposure. FinCEN's analysis of identity-related BSA filings found that 13% involved circumvention of verification processes, and money services businesses reported that type most often. See BSA-AML and SAR Filing.

Red flags

Sign-up bursts with uniform behavior or automation traits (Automation and Headless Browser Signals, Velocity Signals)
Many accounts per device, device model or network (Device Fingerprinting, Device Reputation and Linkage, IP Reputation and Proxy Detection)
Emulated or tampered devices (Emulator and Rooted Device Detection)
Disposable, newly created or patterned emails; VoIP or recycled phones (Email Risk Signals, Phone Risk Signals)
Shared payout destinations, funding sources or addresses across accounts (Entity Link Analysis)
Activity that stops after the reward (Promo and Reward Redemption Patterns)

Prevention and detection at a glance

Layer	Control or signal	What it does here
Prevent	Bot Management and CAPTCHA, Rate Limiting and Throttling	Raises the cost of each sign-up across web, app and API
Prevent	Promotion Design Guardrails	Pays out only for real customer behavior beyond the sign-up itself
Prevent	KYC and Customer Identification Program (CIP) proportional to what the account can do	Stronger identity checks before money can move
Detect	Graph Analytics, Entity Link Analysis	Clusters accounts by shared attributes and destinations
Detect	Cohort analysis by campaign and acquisition source	Finds farms that look clean one account at a time
Respond	Reward Vesting and Clawback, Velocity and Exposure Limits	Delays value until the account looks real; caps exposure for new accounts

Emerging variants and adversary adaptation

The human-in-the-loop hybrid. Where selfie and document checks stop pure automation, operations split the work: humans or synthetic media handle the KYC step, and automation handles everything else. FinCEN's November 2024 alert (FIN-2024-Alert004) describes GenAI-made identity documents being used to open accounts that then serve as funnel accounts for fraud proceeds. See Generative AI and Deepfake Fraud.
Mobile-first attacks. As web bot defenses mature, sign-up abuse moves to mobile apps and APIs, where device diversity is faked with farms and emulators. See Device Farms and Emulators.
AI-driven variety. Generative tools make names, profiles and form-filling behavior less uniform. Rules that rely on obvious repetition decay, and clustering on what the accounts do with value holds up better.
Slow-burn creation. Operators spread sign-ups over weeks and age the accounts before activating them, so launch-week velocity rules miss them. See Account Farming and Resale.
Coordinated activity. FinCEN's alert lists apparent coordinated activity among multiple similar accounts as a post-opening red flag. Defenses that look at groups of accounts outlast those that score accounts one at a time.

Device Farms and Emulators: the device-diversity layer
Multi-Accounting: one controller, many accounts (often human-scale)
Account Farming and Resale: creating accounts to sell
Synthetic Identity Fraud: fabricated identities that pass KYC
Sign-Up Bonus Abuse, Referral Abuse, Promo Code Abuse: what the accounts are for
Card Testing and Money Mules: transaction-layer uses

Real-world examples

Case Study - Pinduoduo Coupon Exploit (2019): a promotion flaw exploited at scale overnight; shows how fast incentive value can drain.

Sources and further reading

OWASP OAT-019 Account Creation: definition; aliases including account pharming; contrast with OAT-007 and OAT-008
OWASP Automated Threats list (OATv2 mirror): OAT-004 Fingerprinting, OAT-009 CAPTCHA Defeat, OAT-012 Cashing Out
FinCEN Alert FIN-2024-Alert004 (deepfakes): GenAI documents for account opening; funnel accounts; coordinated-account red flags
FinCEN Financial Trend Analysis: Identity-Related Suspicious Activity: verification circumvention share; MSB reporting
ABA Banking Journal on FinCEN identity analysis: summary of circumvention findings
FINRA Regulatory Notice 22-25: nominee accounts and indicators of centralized control in brokerage