Duplicate-Account Detection in Cashback and Affiliate Programmes: A Guide for Programme Teams

If you run, build or test a cashback, rebate or affiliate programme, duplicate accounts are one of the first abuse patterns you meet. A welcome bonus is a marketing cost paid to acquire a new member, and a second account collecting it is not a second customer. This guide covers how programmes typically detect duplicates, what member terms usually say, how to handle a flagged member fairly, and how to QA your own tracking and detection with isolated browser profiles.

It is written for programme teams: fraud and risk, affiliate managers, merchants listed on cashback portals, and the QA engineers who check that it all works. It is not a guide for members who want extra accounts, and nothing here is meant to help with that.

Why programmes care

Start with where the money comes from. A cashback portal earns an affiliate commission when a member buys through its link, then passes part of it back. The sign-up bonus is different: a marketing cost the portal pays on the bet that a new member will shop through it for years.

Duplicate accounts break that bet. Ten accounts collecting ten sign-up bonuses is one customer billing the marketing budget ten times. Self-referrals do the same to the referral budget. Merchants care too, because a portal paying out on manufactured activity is a portal whose traffic quality they start to question, and once that happens the rates everyone gets go down. Detection protects the incentive that funds everyone else's cashback.

What member terms usually say

Every programme writes its own terms, so check yours. The common shape across large US and UK programmes, such as Rakuten, TopCashback and Ibotta, looks like this:

• One account per person. Some programmes also assess linked accounts together: referrals sharing an address or PayPal account can be flagged, accounts in one household may be assessed jointly, and some apps limit how many accounts one device can be used with.
• Bonuses are for genuinely new members. A second account for a second welcome bonus is the textbook violation.
• No self-referrals. Referring an account you control isn't a referral.
• Payouts go to the member's own account. Routing several members' cashback to one destination, or to accounts in other people's names, is a red flag on its own.
• The programme decides. Terms usually reserve the right to void rewards, reverse paid bonuses and close accounts it believes are abusing the programme.

Household and shared-device rules differ the most between programmes and are not always in the obvious section. If you write the terms, spell yours out; if you read them as a member, read the referral and payout sections too.

How programmes detect duplicate accounts

None of this is secret. Fraud vendors describe their approach in public documentation, and the picture is consistent across the industry. No single signal decides anything. Programmes stack them.

Device signals. Scripts on the page can read characteristics of the browser and hardware: canvas and WebGL rendering output, audio processing, installed fonts, screen size, timezone. Services such as FingerprintJS turn that into a visitor identifier that survives cookie clears. Audio, font and hardware signals tie more to the physical machine than to the browser. There is a network-level equivalent too: TLS fingerprinting reads how a client negotiates its encrypted connection.

Payout destinations. Fingerprinting gets the column inches, but the payout is usually the stronger link. Accounts cashing out to the same PayPal account, the same bank account, or payment accounts sharing a funding source get linked, and that link isn't probabilistic the way a device match is. Money has to land somewhere real.

Referral graphs. Accounts referring each other in a loop, or referral chains that all end at the same payout destination, are among the easiest patterns to spot.

Network and location. Several accounts on one IP proves nothing on its own, since families, offices and dorms share connections, but it adds weight to other signals. Accounts claiming different cities while behaving identically add more.

Behaviour and timing. Real shoppers browse, compare, abandon carts and come back. Linked accounts tend to click straight through to the same merchants, in the same order, and request payouts on the same day. Those patterns are exactly what fraud teams look for, which is much of why behavioural signals keep gaining weight across platforms.

Shared fraud intelligence. Vendors such as iovation (part of TransUnion since 2018) and Sift sell fraud-signal networks spanning many customers. What a given programme subscribes to isn't public. Programme teams should weigh that carefully: a device or payout method flagged by a shared network can carry weight in places the member never used, so treat such signals as input to a human review, not a verdict.

Why it surfaces at payout

Signals are collected from day one, but the expensive human review usually happens when money is about to leave. That is why a flag often appears at the first withdrawal rather than at sign-up. It is also why a clear process at that moment matters so much.

Handling a flagged member fairly

False positives happen. Two adults in one home sharing a laptop and a Wi-Fi network can look like one person running two accounts. A sensible process, from the programme's side:

1. Say what the review needs. A notice that says only "duplicate device indicators" is a category, not a finding, and a shared household laptop produces it as readily as deliberate abuse. Give the member something specific to answer.
2. Offer one official channel. A help-centre form or a named support address, with a stated response time.
3. Allow for innocent explanations. Ask for whatever verification is proportionate, such as proof that the payout account belongs to the member.
4. Be clear about re-registration. State that opening a new account during a review or after a closure is a further violation.
5. Offer an appeal and document the decision. Money frozen for weeks on an allegation nobody will state plainly is where complaints and chargebacks come from.

From the member's side, the honest route is the mirror image: read the notice, answer through the official channel, tell the truth including the innocent explanations, and don't open a new account. If two people in one household both want the same programme, ask support how shared devices are handled before the second person signs up. Evading enforcement breaks the programme's terms and usually ends in a permanent closure.

Legitimate ways for members to earn more

If the aim is simply more money back, the boring options beat any duplicate account over time:

• Refer real people. Friends and family who will genuinely shop through the programme are what referral bonuses are for.
• Stack within the rules. Many people combine cashback with card rewards or a store's loyalty programme. Whether a given combination is allowed depends on each programme's terms.
• Track purchases. Plenty of "lost" cashback is untracked cashback. Keep order confirmations and file the missing-cashback claim inside the deadline.
• Use the bonus categories. Programmes regularly run boosted rates for specific merchants.

Where a multi-account browser fits on a programme team

A multi-account browser such as JustBrowser is a tool for teams, and these are the jobs it does in this space. None of them involves holding extra member accounts.

Merchants and affiliates testing tracking. If you are a retailer or affiliate with offers listed on cashback portals, you need to know whether tracking fires when a shopper arrives from Chrome on Windows in Texas versus a Mac in London. Isolated profiles, each with its own cookies, storage, proxy and locale, make that repeatable. A common cause of false "tracking is broken" reports is an ad blocker or leftover cookies in the tester's everyday browser, and a separate profile rules that out. The full workflow is in our affiliate cookie and attribution testing guide.

Fraud teams testing their own detection. If you build or run a rewards programme, you need to see what your own fingerprinting and linking logic catches. Running controlled test profiles against your own system, the same way site owners check what FingerprintJS Pro reports on their own pages, shows you where coverage is thin, and where it is too eager. If you are on the detection side of ad traffic specifically, ClickzProtect is our product for that.

QA of the member journey. Sign-up, click-out, return and payout flows on your own programme, run from separate profiles so each test starts from a known state.

Ad verification. Checking that ads and landing pages render correctly across regions and device types, covered in our ad verification workflow.

Teams and privacy. One person keeping work, personal and testing browsing apart, or an agency giving staff launch access to shared client profiles with the client's permission.

What JustBrowser brings to those jobs: a custom Chromium engine with native C++ integration (not an extension), patched on every upstream Chromium release, with 40+ identity parameters rendered consistently by the engine itself. Each profile is its own browser with its own cookies, storage and proxy. You get per-profile proxy routing (bring your own proxy or buy a proxy plan in the app), per-profile DNS-over-HTTPS, team sharing with free seats, and a local REST API plus CDP for Playwright, Puppeteer and Selenium. It runs on Windows x64 and macOS on Apple Silicon. There is no Linux build.

To be plain about it: using JustBrowser to hold extra accounts on a programme that allows one per person is the exact behaviour those terms forbid. It isn't a use we support, and nothing here is meant to help with it.

If you run a site and want visitor analytics without dropping cookies on everyone, JustAnalytics is the cookieless option in our family. It is a different problem in the same neighbourhood.

Frequently Asked Questions

How do cashback programmes detect that multiple accounts belong to the same person?

They combine several signals rather than relying on one. Device fingerprinting links accounts opened from the same machine, payout destinations link accounts that cash out to the same or connected PayPal or bank accounts, referral graphs show accounts referring each other, and shopping behaviour and timing show accounts acting in lockstep. Most of this is reviewed when money moves, which is why accounts often get flagged at the first payout request rather than at sign-up.

What do cashback programme terms usually say about multiple accounts?

Member terms commonly limit each person to one account and treat sign-up bonuses and referral rewards as one-time incentives for genuinely new members. Some also assess linked accounts together, such as ones sharing an address, payout account or device. The exact rule varies, so a programme team should state its rule plainly, and members should read the terms page of the programme they use.

How should a programme handle a member whose account is flagged?

Tell them what the review needs from them, give them an official channel to answer through, and allow for innocent explanations such as two family members sharing a laptop or a home network. Keep notices specific enough to answer, document the decision, and offer a route to appeal. Vague notices turn false positives into support escalations.

How can I test whether my cashback or affiliate tracking works across browsers and regions?

Use isolated browser profiles, each with its own cookies, storage, proxy and locale, to run the same journey from different browsers, regions and device types, then check that the click, the cookie and the conversion all land in your tracking records. Separate profiles also rule out leftover cookies or ad blockers in a tester's everyday browser as the cause of a failure.

Where does a multi-account browser fit in a rewards programme team?

Legitimate uses include merchants and affiliates testing that tracking fires correctly across browsers and regions, fraud teams testing their own detection, ad verification, and team access to shared profiles. Using one to run extra member accounts on a programme that allows one per person is exactly what its terms forbid, and it is not a use JustBrowser supports.

---

Try JustBrowser

A multi-account browser for teams, on a custom Chromium engine with native C++ integration, not extension-based, and always current with upstream Chromium. Real C++ engine patches at the canvas / WebGL / audio / font / screen layer, with 40+ identity parameters rendered by the engine itself. Local REST API + CDP for Playwright, Puppeteer and Selenium. Windows x64 and macOS (Apple Silicon). $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles, unlimited cloud sync, unlimited team seats.

Get started → · How it differs from Multilogin / GoLogin / AdsPower