How Loyalty Programs Detect Multi-Accounting

The email usually has a dull subject line. "Account Review Required." Inside, a few paragraphs of careful legal language that boil down to one thing: the loyalty program thinks two or more accounts belong to the same person — multi-accounting, in its own language — and it has frozen all of them until someone in fraud review decides otherwise.

No phone number in the footer. No explanation of what tripped it.

If you landed here because that email arrived — or because you've been wondering whether a second account for another sign-up bonus would get noticed — this is the part nobody selling you a workaround will tell you. How detection actually works, what the program's terms let it do, the legitimate ways to get more out of points, and what to do if you're a genuine member caught in the net.

I'll say the uncomfortable part early. Running several accounts in one loyalty program to collect bonuses more than once is against the rules of nearly every major program. It isn't a grey area that better tooling turns white. And no browser, ours included, changes that.

What the rules actually say

Start with the document most people never read: the program terms.

They aren't easy reading. They cross-reference each other, bury the clause that matters three sections from the heading you'd look under, and put the enforcement language in the driest paragraph on the page.

Most airline, hotel and retail rewards programs allow one account per person. Welcome offers are usually limited to new members, and often to one per household or address. The terms almost always reserve the program's right to close duplicate accounts, cancel the points in them, reverse redemptions, and in some cases refuse future membership. Exact wording differs program to program — so read yours rather than trusting a forum summary (or this article).

Credit-card welcome bonuses tied to loyalty programs carry a second set of rules. Those come from the card issuer, sit in the offer's own terms, and often limit how many times one person can earn the bonus. That's a separate relationship with a separate company, and breaking it has separate consequences.

Here's what people miss. The terms usually let the program act whenever it finds the problem. Not just at sign-up. Points you earned two years ago in a duplicate account are still, by the program's reading, points it never owed you.

Understanding how a loyalty program builds that picture explains why detection lands so late, and why "I used a different email" never mattered much.

Fraud teams at large programs don't rely on one signal. They score many weak ones together.

Device signals

When you log in, scripts on the page can read dozens of browser and hardware characteristics: how your machine renders a canvas fingerprint, the WebGL renderer, installed fonts, screen size, timezone, language settings, audio processing quirks. Combined, they form a device fingerprint that stays fairly stable across cookie clears and private windows. Some vendors add network-level signals too, like TLS fingerprinting.

The vendors who sell this into travel, retail and financial services describe their products publicly. TransUnion's device-risk products grew out of its acquisition of iovation. Sift sells what it calls a fraud prevention platform. Fingerprint sells browser identification. Mastercard owns NuData, and BioCatch focuses on behavioural biometrics. I'm not going to claim which program uses which vendor — that's rarely public — but the category is mature and well funded.

The important bit is consortium data. Several of these vendors run networks where a device's reputation travels between their clients. A device that opened accounts at many unrelated programs in a short window looks different from one that didn't, even if each program only saw one account.

Which is where I should admit something. We build browser fingerprinting technology for a living, and I still catch myself overrating how much of this is a browser problem. It's the layer I understand best, so it's the layer my brain reaches for first — and on this particular question it's close to the least important one.

Identity and payment signals

This is where most duplicate accounts actually get caught, and it has nothing to do with browsers.

A payment card used on two "unrelated" accounts.
The same phone number, or numbers from the same small block.
Mailing addresses that differ only in apartment number or spelling.
Names that match travel documents on one account but not the other.
Credit-card applications that share an applicant, an address or a bank.

Airlines and hotels also see real-world identity: a passport at check-in, an ID at the front desk. A hotel program doesn't need a fingerprint to notice four "different" members checking in as the same person.

Redemption graphs

Points have to go somewhere. Flights in the same names, hotel stays booked to the same email, gift cards shipped to the same address, transfers that all converge on one account. Fraud teams build a graph of where value flows, and duplicate accounts tend to drain into the same place.

Behaviour

Behavioural biometrics — typing rhythm, mouse movement — is newer in loyalty, but it's out there. So is plain clustering: accounts that log in at the same minute and redeem in the same week.

Why enforcement arrives late

Programs frequently wait. Reviews tend to trigger at redemption, especially high-value redemption, because that's when the program is about to hand over something real. Waiting also lets the graph fill in. That's why the frozen-account emails you read about so often arrive months after sign-up, right as someone tries to book the big trip — and why they freeze every account at once.

That isn't a bug in the system. It's the design.

Why "hiding the link" makes things worse

Concealment is itself a signal.

A VPN exit node, a virtual machine artifact, a prepaid card bought for exactly one account — none of those prove multi-accounting on their own. But each one tells the person reading your file that you were working at not being connected. A shared family laptop is an innocent explanation. Working at it isn't, and the cost of looking like you did is the only asset you actually had in review: the benefit of the doubt.

The browser was never the main problem anyway. Identity, payment, address, travel documents and redemption destinations link duplicate accounts no matter what any browser does, and hiding a device only adds to the concealment signal described above. There is no browser fix for breaking the program's terms. Anyone selling you an "undetectable" loyalty setup is selling a story that ends in a closure email.

The real cost of getting caught

Points are the obvious loss when a loyalty program finds multi-accounting, but they're rarely the only one.

Every linked account goes. Programs usually freeze and close all accounts they connect, including the one you'd have kept anyway. Points you earned legitimately in your main account can be cancelled alongside the duplicates. It's the sharpest edge of the whole thing.

Redemptions can be reversed. Some terms let the program cancel bookings already made with points, or charge you the cash value of rewards already used.

Card consequences. If card welcome bonuses were involved, the issuer can claw back the bonus and may close cards — a separate hit that can affect your credit relationship with that bank.

It can stop being "just a terms issue." Breaking program terms is the floor. Opening accounts under false names, fabricated addresses, or someone else's identity — and above all, doing that on credit-card applications — can move into fraud. Where that line sits depends on your country and the facts, and I'm not a lawyer, so take that question to one if it applies to you.

The record follows you. Some programs refuse future membership, and device and identity reputation can travel through vendor networks to other companies.

Honestly, the maths rarely works even before the risk. Sign-up bonuses are front-loaded; the downside is everything you've ever earned.

What legitimate points earners do instead

The good news: loyalty programs have spent years building official ways to do most of what people try to hack around. They're slower than a second account. They also don't end in a closure email.

One account per real person. If your partner travels too, they get their own account in their own name. That's allowed everywhere, and each of you earns on your own stays and flights.

Pool or transfer through the program. Many programs now let members combine points. As of writing, Hilton Honors publishes free points pooling between members, and Marriott Bonvoy allows member-to-member transfers within annual limits. Airline programs vary much more — some have family or household pooling, some charge transfer fees, some don't allow it at all. Check the current rules on the program's own site rather than on mine, because these change without anyone announcing it.

Earn properly in your own account. Card welcome offers in your own name (within the issuer's eligibility rules), shopping portals, dining programs and partner earning all credit one account legitimately. Slower. Real.

Use business and corporate programs for business travel. Several hotel and airline groups run programs for companies that sit alongside the traveller's own membership. If you're booking for a team, ask the program — that's what those schemes exist for.

Ask before you assume. Unsure whether something is allowed (say, a dependent's account you manage)? Ask member services and get the answer in writing.

If your account was frozen and you only have one

This happens. Families share computers. Couples share cards. People move into an apartment where the last tenant ran a dozen accounts. Fraud scoring produces false positives, and the appeal route exists for exactly this.

Here's the bit that genuinely annoys me about how programs run this: the freeze is instant and automated, and the unfreeze is a human reading a queue. One side of that transaction takes milliseconds and the other takes weeks, and the member absorbs the whole gap. Knowing that doesn't speed it up. It does tell you to start the paperwork the day the email lands instead of waiting to see whether it resolves itself, because it won't.

Respond through official channels — member services or the address in the review email — and keep a written record.
Ask what triggered the review. You may not get specifics, but asking signals you're engaging in good faith.
Offer verification. ID, proof of address, the card statement for the card on file.
Explain the innocent overlap plainly. "My spouse and I both use this laptop and both have accounts" is a normal sentence for a reviewer to read.
Don't open a new account while it's open. Most programs prohibit it, and it looks exactly like what they suspect.
Escalate in writing if you get nowhere. Ask for a supervisor or the program's complaints process; if the program runs a co-branded card, the bank may have its own complaints route too.

Patience matters more than tactics. There's no trick.

Where an antidetect browser fits — and where it doesn't

So why does an antidetect browser company publish this at all?

Awkwardly, is the answer. Plenty of people searching this topic are hoping for the opposite conclusion. An article that told them what they came for would have been easier to write. It would also have been wrong.

Because the people who build and run loyalty programs need browser-level control too, and so do agencies and testers working on them. JustBrowser is a custom Chromium engine with native C++ integration — not an extension — patched on every upstream Chromium release, with 40+ identity parameters per profile. That's useful for honest work:

Testing your own program. Sign-up, earning and redemption flows behave differently by country, language, timezone and device. QA teams need clean, separate profiles that look like real devices in each market, and they need them repeatable. The local REST API and CDP connect profiles to Playwright, Puppeteer or Selenium for regression runs.
Tuning fraud rules. If you run a program's fraud stack, you want test accounts in your own staging environment that exercise your rules from distinct, consistent devices — so you can see what your vendor flags before real members hit it.
Agency work with permission. Marketing teams managing a brand's partner, affiliate or social accounts — accounts the client owns and has handed over — keep each client in its own profile so logins never cross.
Ad and offer verification. Checking what a promotion actually shows a visitor in another region, on another device, without contaminating your own browsing.
Privacy. Keeping your everyday browsing separate from work accounts.

What it isn't: a way to hold several member accounts in a program that allows one. The terms forbid it, and as the detection section shows, the browser was never what linked those accounts.

A few plain facts. JustBrowser runs on Windows x64 and macOS (Apple Silicon) — no Linux build, no mobile app. Proxies aren't included; you bring your own if your testing needs them. Team seats are free, but a seat can only run profiles shared with it. If you're testing your own site's sign-up funnel, pair it with cookieless analytics like JustAnalytics to see how test traffic shows up, and if you run affiliate or traffic campaigns, ClickzProtect handles bot filtering on that side. Our antidetect browser best practices checklist covers profile hygiene for this kind of work.

Frequently Asked Questions

How do loyalty programs detect that multiple accounts belong to the same person?

They combine signals rather than relying on one. Device data (a fingerprint built from browser and hardware characteristics), network history, payment cards, mailing and redemption addresses, phone numbers and behaviour all feed a risk score. No single match proves anything, but several overlapping ones between accounts that claim to be strangers will usually trigger a review.

Is it against the rules to have more than one account in a loyalty program?

In most airline, hotel and retail programs, yes. The terms typically allow one account per person and give the program the right to close duplicate accounts and cancel the points in them. Rules vary, so read your program's own terms and conditions — they are the document that decides the outcome.

Can an antidetect browser stop a loyalty program from linking accounts?

It shouldn't be used for that, and it wouldn't solve it anyway. Duplicate accounts get linked through identity, payment, address and redemption data that no browser touches, and trying to hide the link turns a possible honest mistake into deliberate concealment. That breaks the program's terms and usually ends with every linked account closed.

What is the legitimate way for a household to combine points?

Give each real person their own account, then use the program's official tools. Many programs offer points pooling or member-to-member transfers — Hilton Honors has free points pooling and Marriott Bonvoy allows transfers between members within annual limits, for example. Check the current rules on the program's own site before you rely on them.

My account was frozen but I only have one. What should I do?

Contact member services in writing, ask what triggered the review, and offer to verify your identity. Explain anything that may have looked like linking — a shared family computer, a spouse's card on file, a shared address. Don't open a new account while the review is open; most programs prohibit it and it makes your case harder.

Try JustBrowser

Custom Chromium antidetect browser with native C++ integration — not extension-based, and always current with upstream Chromium. Real C++ engine patches at the canvas / WebGL / audio / font / screen layer, 40+ identity parameters per profile, and a local REST API + CDP for Playwright, Puppeteer and Selenium. Windows x64 and macOS (Apple Silicon). $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles, unlimited cloud sync, unlimited team seats.

Get started → · How it differs from Multilogin / GoLogin / AdsPower · Part of Velocity Digital Labs

How Loyalty Programs Detect Multi-Accounting — and What They Actually Allow

What the rules actually say