How Cashback and Rebate Portals Detect Multi-Accounting (and What to Do If Your Account Is Flagged)

Multi-accounting detection at a cashback portal almost never announces itself in advance. The sequence usually goes something like this. A cashback balance sits in "pending" for months, finally clears, and is due to land in PayPal on Thursday. Thursday arrives. The dashboard says: "Account under review. Payout suspended pending investigation."

Then it gets worse. A few days later every account that person had opened on the portal freezes at once, and the notice mentions "duplicate device indicators" and "payout clustering" — two phrases that explain nothing and are clearly not meant to. The fraud team didn't catch one slip. It caught a shape.

If you landed here because that happened to you, or because you're wondering whether it could: below is how cashback portals detect multi-accounting, why they treat it as abuse rather than a clever hack, the honest route once an account is flagged, and where antidetect browsers belong in all this. Spoiler: merchant and fraud-team side, not shopper side.

Why Portals Care So Much

Start with where the money comes from.

A cashback portal earns an affiliate commission when you buy through its link, then passes part of it back to you. The sign-up bonus is different — a marketing cost the portal pays to acquire a new member, on the bet that you'll shop through them for years.

Multi-accounting breaks that bet. Ten accounts collecting ten sign-up bonuses isn't ten customers. It's one customer billing the marketing budget ten times. Self-referrals do the same to the referral budget. Merchants care too: a portal paying out on manufactured activity is a portal whose traffic quality they start to question — and once that happens, the rates everyone gets go down.

So when a portal spends money on detection, it isn't being petty. It's protecting the incentive that funds everyone else's cashback.

What the Rules Usually Say

Every portal writes its own terms, so I won't pretend to quote them. But the common shape across the big US and UK programs — Rakuten, TopCashback, Ibotta and similar — looks like this:

One account per person. Some programs also look at linked accounts together: referrals sharing an address or PayPal account can be flagged, accounts in one household may be assessed jointly, and some apps limit how many accounts one device can be used with. Check your portal's current terms for the exact wording.
Bonuses are for genuinely new members. A second account for a second welcome bonus is the textbook violation.
No self-referrals. Referring an account you control isn't a referral.
Payouts go to your own account. Routing several members' cashback to one destination, or to accounts in other people's names, is a red flag on its own.
The portal decides. Terms usually reserve the right to void rewards, reverse paid bonuses and close accounts it believes are abusing the program — and the bar for "believes" is theirs, not a court's.

Read the terms page of the portal you use, not the one you read about on a forum. The details differ, and they change.

Rules on households and shared devices differ the most between portals, and they aren't always in the obvious section, so read the whole terms page, including the referral and payout sections.

How Cashback Portals Detect Multi-Accounting in Practice

None of this is secret — fraud vendors describe their approach in public documentation, and the picture is consistent across the industry. What matters: no single signal decides anything. Portals stack them.

Device signals. Load a portal and scripts can read characteristics of your browser and hardware: canvas and WebGL rendering output, audio processing, installed fonts, screen size, timezone. Services such as FingerprintJS turn that into a visitor identifier that survives cookie clears. Audio, font and hardware signals are tied to the physical machine more than to the browser, so clearing cookies or switching browsers doesn't change them. There's a network-level equivalent too — TLS fingerprinting reads how a client negotiates its encrypted connection.

Payout destinations. My strong opinion on this topic: fingerprinting gets the column inches and it is nowhere near the most decisive signal a cashback portal holds. The payout is. Accounts cashing out to the same PayPal account, the same bank account, or payment accounts sharing a funding source get linked — and that link isn't probabilistic the way a device match is. It's a name and a routing number. Money has to land somewhere real, which is where an account stops being anonymous.

Referral graphs. Accounts referring each other in a loop, or referral chains that all end at the same payout destination, are the easiest patterns on this list to spot. The referral system is the one place where people hand the fraud team a drawn diagram of the relationship.

Network and location. Several accounts on one IP proves nothing on its own — families, offices and dorms share connections — but it adds weight to everything else. Accounts claiming different cities while behaving identically add more.

Behaviour and timing. Real shoppers browse, compare, abandon carts, come back. Duplicate accounts tend to click straight through to the same merchants, in the same order, and request payouts the same day. Those patterns are exactly what fraud teams look for, which is much of why behavioural signals keep gaining weight across platforms.

Shared fraud intelligence. Vendors such as iovation (part of TransUnion since 2018) and Sift sell fraud-signal networks spanning many of their customers. What a given portal subscribes to isn't public. The upshot: a device or payout method flagged in one place can carry weight somewhere you've never been a customer.

That last one bothers me more than the rest of the list combined. There's no dashboard where you can read what a fraud network holds on your device, no queue to appeal it, and usually no way to learn the record exists except by getting declined somewhere and never being told why. Credit files come with statutory access rights in most countries. Device-reputation files, mostly, don't.

Why it surfaces at payout

Signals get collected from day one. The expensive human review happens when money is about to leave. That gap explains the sequence so many people report: sign-up fine, months of cashback accruing fine, first withdrawal and the shutters come down. Nothing was missed along the way. The review was waiting for a reason to run, and a withdrawal is that reason.

Why "Better Isolation" Is the Wrong Question

Most writing on this subject takes the list above and works through it layer by layer, each signal a problem to be separated. That framing helps nobody, and here's the honest reason.

Hiding the link between accounts doesn't make the accounts allowed. The terms say one account per person; they don't say one account per detectable person. Every hour spent making duplicate accounts look unrelated is an hour spent deceiving the business that pays you, and that's the step which moves this from "bending a promo rule" toward fraud.

The practical side is just as bleak:

The payout ties back to a real person. Getting paid means a verified PayPal or bank account. Using accounts in other people's names, or invented identities, swaps a terms violation for something far more serious.
The downside is total. When linked accounts close, portals typically void pending cashback across all of them — including cashback earned on perfectly genuine purchases — and may reverse bonuses already paid.
It doesn't stay contained. Shared fraud signals and payout-method flags travel, so the cost can surface on a service you never abused.
The math was never good. Welcome bonuses are one-time. The risk is to everything you've accrued. Small-scale multi-accounting trades a handful of one-off bonuses against your legitimate cashback history.

That last point is the one I'd push hardest. A welcome bonus is the worst-value thing on a cashback portal to chase — it pays once and never again, while one clean account you shop through for years quietly out-earns a stack of them. Which makes it a bad trade on the arithmetic alone, before anyone opens the terms.

If Your Cashback Account Has Been Flagged

Here's the route that actually exists.

Read the notice carefully. Note what it says was found and what it asks you to send. Some reviews fire because a merchant reversed a transaction — a return, a cancelled order — which is a different problem with its own claim process.
Use the official channel. The help center, or the support address in the notice. One clear, factual message.
Tell the truth, including the innocent explanations. False positives happen. Two adults in one home sharing a laptop and a Wi-Fi network can look like one person running two accounts. If that's your situation, say so and offer whatever verification they ask for — ID, proof the payout account belongs to the right person.
Don't open a new account. Re-registering during a review, or after a closure, is typically its own violation and the fastest way to turn a reversible decision into a permanent one.
Accept the outcome if you did break the rules. If you ran duplicate accounts, the realistic best case is keeping one account and losing the bonuses. Arguing that you "weren't caught properly" doesn't help.

Now the part that irritates me, and portals don't get enough stick for it. Those notices are deliberately vague. "Duplicate device indicators" isn't a finding, it's a category, and a shared household laptop produces it as readily as deliberate abuse does. So someone with a real false positive is asked to disprove an allegation nobody will state plainly, with the money frozen and the ticket queue running for weeks. A portal confident in its linking logic could name the accounts it thinks are connected. Most won't, and the stated reason — tipping off the people gaming it — reads like a convenient one.

If two people in your household both want the same portal, the time to ask how shared devices are handled is before the second person signs up. A short support ticket now beats an appeal later.

Legitimate Ways to Get More Out of Cashback

If the goal is simply more money back, the boring options beat any duplicate account over time:

Refer real people. Friends and family who'll genuinely shop through the portal are what referral bonuses are for — and it's the only lever on this list that compounds, because a referral who keeps using the portal keeps paying you. A bonus pays once.
Stack within the rules. Many people combine portal cashback with card rewards or a store's loyalty program. Whether a given combination is allowed depends on each program's terms, so check before you count on it.
Track your purchases. Plenty of "lost" cashback is just untracked cashback. Keep order confirmations and file the portal's missing-cashback claim inside its deadline. The deadlines are often short and nobody emails to remind you.
Use the bonus categories. Portals regularly run boosted rates for specific merchants. One account, used well, out-earns a pile of frozen ones.

Where Antidetect Browsers Actually Fit

Here's where a tool like JustBrowser earns its place in the cashback world, and none of it involves running extra member accounts.

Merchants and affiliates testing tracking. If you're a retailer or affiliate with offers listed on cashback portals, you need to know whether tracking fires when a shopper arrives from Chrome on Windows in Texas versus a Mac in London. Isolated profiles with their own cookies, timezone and locale make that repeatable. Full workflow: affiliate cookie and attribution testing.

A common cause of false "tracking is broken" reports is an ad blocker or leftover cookies in the tester's everyday browser. A clean, isolated profile rules that out.

Fraud teams testing their own detection. If you build or run a rewards program, you need to see what your fingerprinting and linking logic catches. Running controlled test profiles against your own system — the same way teams test their setups against FingerprintJS Pro — tells you where coverage is thin before someone else finds out. If you're on the detection side of ad traffic specifically, ClickzProtect is our product for that.

Ad verification. Checking ads and landing pages render correctly across regions and device types — covered in our ad verification workflow.

Teams and privacy. One person keeping work, personal and testing browsing apart. An agency giving staff launch access to shared client profiles, with the client's permission. Neither involves pretending to be more people than you are.

What JustBrowser brings to those jobs: a custom Chromium engine with native C++ integration (not an extension), patched on every upstream Chromium release, with 40+ identity parameters rendered consistently by the engine itself. You get per-profile proxy routing (bring your own proxy — none are included), per-profile DNS-over-HTTPS, team sharing with free seats, and a local REST API plus CDP for Playwright, Puppeteer and Selenium. Windows x64 and macOS on Apple Silicon. No Linux build.

And to be plain about it: using JustBrowser to hold extra accounts on a portal that allows one per person is the exact behaviour those portals' terms forbid. It isn't a use we support, and nothing here is meant to help with it.

(Related: if you run a site and want visitor analytics without dropping cookies on everyone, JustAnalytics is the cookieless option in our family. Different problem, same neighbourhood.)

Frequently Asked Questions

How do cashback portals detect that multiple accounts belong to the same person?

They combine several signals rather than relying on one. Device fingerprinting links accounts opened from the same machine, payout destinations link accounts that cash out to the same or connected PayPal or bank accounts, referral graphs show accounts referring each other, and shopping behaviour and timing show accounts acting in lockstep. Most of this is reviewed when money moves, which is why accounts often get flagged at the first payout request rather than at sign-up.

Is it against the rules to have more than one cashback account?

On most portals, yes. Member terms commonly limit each person to one account and treat sign-up bonuses and referral rewards as one-time incentives for genuinely new members. Some also assess linked accounts together, such as ones sharing an address, payout account or device. The exact rule varies, so read the terms page of the portal you use before anyone in your household signs up.

Is cashback multi-accounting illegal?

At minimum it breaks the portal's terms, which lets the portal void rewards, claw back bonuses and close every linked account. Where it involves false or borrowed identities, or deliberately deceiving the portal to collect money it would not otherwise pay, it can also be treated as fraud depending on where you live. This is not legal advice — if you are worried about exposure, talk to a lawyer.

What should I do if my cashback account is frozen for suspected multi-accounting?

Use the portal's official support or help-center channel, read exactly what the review notice asks for, and answer it truthfully. If there is an innocent explanation, such as two family members sharing a laptop or a home network, say so and provide whatever verification they request. Do not open a new account while the review is open or after a closure; that is usually a further violation and tends to end any chance of a reversal.

Where do antidetect browsers fit if not for running extra portal accounts?

Legitimate uses include merchants and affiliates testing that cashback and affiliate tracking fires correctly across browsers and regions, fraud teams testing their own detection, ad verification, and team access to shared profiles. Using one to run extra accounts on a portal that allows one per person is exactly what the portal's terms forbid, and it is not a use JustBrowser supports.

Try JustBrowser

Native Chromium antidetect browser — not extension-based. Real C++ engine patches at the canvas / WebGL / audio / font / screen layer, with 40+ identity parameters rendered by the engine itself. Local REST API + CDP for Playwright, Puppeteer and Selenium. Windows x64 and macOS (Apple Silicon). $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles, unlimited cloud sync, unlimited team seats.

Get started → · How it differs from Multilogin / GoLogin / AdsPower