4 ms·

Ask HN: limiting new account registrations

6 points by evancaine 17y ago

For a project I'm working on I need to make sure as far as possible that users are not able to signup multiple accounts. The most obvious way to do this would be to ask for credit card details then charge & refund a small 'verification' amount. However, I'm in the UK & having a hard time getting a merchant account because I don't have a business bank account, nor do I want one yet if I can help it because it's extra overhead and I want to launch a beta soon. another option would be to use an SMS web service to send a confirmation code to a users mobile phone - not as stringent as a CC check but I'd use it as a last resort. can anyone suggest an alternative? evan

notaddicted 17y ago
I have 2 credit cards.
- joez 17y ago
  He could request the billing address, I believe, and cross reference that. Of course you might have 2 billing addresses as well...
  - cperciva 17y ago
    ... or there might be two family members who live at the same address.
    - joez 17y ago
      They will have different names then? I mean if you think hard enough on these I'm sure theres ways these checks fail. I could see a billing address being a company or communal living at which there are two people with the same given name.
    - JimmyL 17y ago
      You can also change your billing address easily with most credit cards - if nothing is being mailed to me (and I'm determined to get past this check), what makes me enter a real address I have access to for it? As for names, it's somewhat common - two of my credit cards are firstinitial lastname (as opposed to firstname lastname), and I happen to share firstinitial with my father. I've got a friend who was named after his father (firstname lastname III), but who doesn't use the generation suffix for anything aside from his passport.
- ScottWhigham 17y ago
  But are you willing to give them both to some small internet site? I'm sure that there are a few edge cases like this who are comfortable doing that but I'd likely assume 90+% would not.
joez 17y ago
Maybe an email account that should be unique... i.e. a school or employer? @google.com or @berkeley.edu. Although people might have multiple schools/employers or a mix of both. This also might not work for certain demographics (ones without email!) but I am not sure who your audience is.
- gus_massa 17y ago
  It is very easy to create another temporal email address http://mailinator.blogspot.com/2008/08/dear-world-email-addresses-are-not.html http://mailinator.blogspot.com/2008/08/dear-world-email-addr...
  - joez 17y ago
    Oh I wasn't talking about like a @gmail, @yahoo, especially not @mailinator address but one that would be unique to your employer or school. Most schools only allow it's students (and only it's students) to have one address. Most employers are the same way. It would take some doing but it wouldn't be impossible to compile a list of all the .edu's and large companies.
johnnybgoode 17y ago
Why is the SMS confirmation code method less stringent than a CC check?
- brk 17y ago
  I think he means lower barrier to entry, he can do that without needing to sign up with any 3rd party.
anigbrowl 17y ago
Paypal?
- jsz0 17y ago
  Probably the most practical hands off approach to it. Their verification system is annoyingly hard to get around. (although I think they have eased up on it lately)
ScottWhigham 17y ago
The only way I know of to prevent duplicate accounts is to give people a code to redeem that is tied to a physical address. In other words, mail them a post card with a redemption code on it and only mail one card to one address. I'm sure this can be readily abused too though!
- icey 17y ago
  I could have a card sent to my house, my work, my parent's house, my brother's house, a PO box, my neighbor's house, etc.
johnnybgoode 17y ago
Actually, if you want to be really stringent, you should charge a small fee without any refund. I take it you don't want to go that far, though.
donw 17y ago
Out of curiosity, why is it so important to prevent users from signing up multiple times? Is it a scaling issue, or...? I ask, because there may be an alternative (and less invasive) way of reaching the same goal.
jsz0 17y ago
SMS isn't a very good solution. Only slightly better than a simple e-mail verification. There are a number of services that would allow someone to receive texts on unique phone numbers. I'm assuming you have a good reason to limit accounts which means inevitably someone thinks they have a good reason to get around your limit. This might be a silly suggestion but I would prefer, as a user, to be asked to submit a photograph of myself holding up a sign with some unique keyword you generate when the user attempts to signup. I honestly think this is less off putting than exchanging CC information. Depending what type of site you're doing it could actually be a fun mysterious way to promote it.
rms 17y ago
In the USA it's really easy to get a business bank account. Just go into the bank and tell them you want a business bank account and they will set you up with a free business account. Is it harder in the UK?
- dazzawazza 17y ago
  Nope, I went to abbey national (it's called santander now I think) and I get free business banking for life. I'm not recommending them, just saying it is possible. All you need is a few forms of ID.
udfalkso 17y ago
This is almost certainly overkill, but you can do what Google does for services like adsense. They deposit a small amount of money in your bank account, like $0.02 and then you have to tell them what the amount was for verification.
JimmyL 17y ago
If you're really that concerned about multiple users, I think doing the CC check would be the way to go. The larger question I think you should be asking, however, is why this guarantee is so important. You're setting up a huge barrier to new sign-ups - if I came upon a site asking for my CC details, even if it was through PayPal, it would take a hell of a lot for me to move forwards and not lose interest in the service. So you had better make sure that your product is so compelling that it will cause your users to get up from their computers, go get their wallet, and give you their CC number; be warned, this is one hell of a threshold. If you've gone that far, however, I wouldn't bother refunding the money - almost all users who you've engaged enough to get their credit card number won't mind giving you a nickel or so for your services, which you'll probably need to cover the costs of your CC fees anyways. If you do this, I'd 100% go with PayPal - it's easy, and it provides me (the user) with some degree of reassurance that you're not just going to steal my CC number. Even if you do this, however, you still need other checks. I have three different credit cards, all hooked to different addresses and with using different variations of my name. Many banks allow users to generate one-time credit card numbers for online purchases. Multiple people could live at the same address and have cards, and they could even have the same names (like when sons are named after their fathers). Don't forget to analyze how important it is not to have duplicated, or conversely, how much of a problem it would be to have them - as this gets higher, you're going to have to make some tradeoffs (for example you could make a rule that says only one registration per household, and accept that you'll be losing out on users where there is more than one party in the household who wants to use your service). As a point of comparison, the last service that I signed up for that needed this severe of a uniqueness guarantee - the old ICANN@large, anyone? - did a web-based signup, which led to a code getting mailed to you. Additionally, they restricted it to one-signup-per-household, and didn't accept PO boxes. Bottom line is that this is a difficult problem, which generates a very high barrier to entry. So if you've done the analysis and concluded that it's 100% necessary to do this, you may as well embrace it and charge a bit.
- evancaine 17y ago
  thanks everyone for your comments. JimmyL, you make some very valid points and this is a route I'm taking hesitantly. I should have made it clear in my original post why I need to restrict signups in this way. I'm making a trading platform for users to buy & sell collectible items from a certain niche. Without limiting new accounts, there's little to stop someone creating multiple accounts and engaging in fake transactions in order to bump up their feedback, especially during the beta because I won't be charging any fees.
barryrandall 17y ago
Generally speaking, if somebody wants multiple accounts, they can get them easily enough. It would help to know a little bit more about why you're trying to block multiple signups. I'm in the US, and I write checks to my customers. We're required to submit information to the IRS on a quarterly basis, so we collect payee identification, which is either a Social Security number or Employer Identification Number. It's one thing to lie to an Internet company, its another to lie to the IRS. That discourages a lot of people from trying to game the system. Perhaps there's a similar mechanism available in the UK. Focus on detection. Scoring new accounts for possible/probable fraud, and flagging them for review works wonders. Scaling this approach requires more human effort, but it's worth it when you get in to large dollar amounts. It also helps to have some leverage in your terms of service.
anamax 17y ago
> For a project I'm working on I need to make sure as far as possible that users are not able to signup multiple accounts. For your convenience or theirs?

6 points by evancaine 17y ago

notaddicted 17y ago

I have 2 credit cards.

joez 17y ago
He could request the billing address, I believe, and cross reference that. Of course you might have 2 billing addresses as well...
- cperciva 17y ago
  ... or there might be two family members who live at the same address.
  - joez 17y ago
    They will have different names then? I mean if you think hard enough on these I'm sure theres ways these checks fail. I could see a billing address being a company or communal living at which there are two people with the same given name.
  - JimmyL 17y ago
    You can also change your billing address easily with most credit cards - if nothing is being mailed to me (and I'm determined to get past this check), what makes me enter a real address I have access to for it? As for names, it's somewhat common - two of my credit cards are firstinitial lastname (as opposed to firstname lastname), and I happen to share firstinitial with my father. I've got a friend who was named after his father (firstname lastname III), but who doesn't use the generation suffix for anything aside from his passport.
ScottWhigham 17y ago
But are you willing to give them both to some small internet site? I'm sure that there are a few edge cases like this who are comfortable doing that but I'd likely assume 90+% would not.

joez 17y ago

Maybe an email account that should be unique... i.e. a school or employer? @google.com or @berkeley.edu. Although people might have multiple schools/employers or a mix of both. This also might not work for certain demographics (ones without email!) but I am not sure who your audience is.

gus_massa 17y ago
It is very easy to create another temporal email address http://mailinator.blogspot.com/2008/08/dear-world-email-addresses-are-not.html http://mailinator.blogspot.com/2008/08/dear-world-email-addr...
- joez 17y ago
  Oh I wasn't talking about like a @gmail, @yahoo, especially not @mailinator address but one that would be unique to your employer or school. Most schools only allow it's students (and only it's students) to have one address. Most employers are the same way. It would take some doing but it wouldn't be impossible to compile a list of all the .edu's and large companies.

johnnybgoode 17y ago

Why is the SMS confirmation code method less stringent than a CC check?

brk 17y ago
I think he means lower barrier to entry, he can do that without needing to sign up with any 3rd party.

anigbrowl 17y ago

Paypal?

jsz0 17y ago
Probably the most practical hands off approach to it. Their verification system is annoyingly hard to get around. (although I think they have eased up on it lately)

ScottWhigham 17y ago

The only way I know of to prevent duplicate accounts is to give people a code to redeem that is tied to a physical address. In other words, mail them a post card with a redemption code on it and only mail one card to one address. I'm sure this can be readily abused too though!

icey 17y ago
I could have a card sent to my house, my work, my parent's house, my brother's house, a PO box, my neighbor's house, etc.

johnnybgoode 17y ago

Actually, if you want to be really stringent, you should charge a small fee without any refund. I take it you don't want to go that far, though.

donw 17y ago

Out of curiosity, why is it so important to prevent users from signing up multiple times? Is it a scaling issue, or...? I ask, because there may be an alternative (and less invasive) way of reaching the same goal.

jsz0 17y ago

SMS isn't a very good solution. Only slightly better than a simple e-mail verification. There are a number of services that would allow someone to receive texts on unique phone numbers. I'm assuming you have a good reason to limit accounts which means inevitably someone thinks they have a good reason to get around your limit. This might be a silly suggestion but I would prefer, as a user, to be asked to submit a photograph of myself holding up a sign with some unique keyword you generate when the user attempts to signup. I honestly think this is less off putting than exchanging CC information. Depending what type of site you're doing it could actually be a fun mysterious way to promote it.

rms 17y ago

In the USA it's really easy to get a business bank account. Just go into the bank and tell them you want a business bank account and they will set you up with a free business account. Is it harder in the UK?

dazzawazza 17y ago
Nope, I went to abbey national (it's called santander now I think) and I get free business banking for life. I'm not recommending them, just saying it is possible. All you need is a few forms of ID.

udfalkso 17y ago

This is almost certainly overkill, but you can do what Google does for services like adsense. They deposit a small amount of money in your bank account, like $0.02 and then you have to tell them what the amount was for verification.

JimmyL 17y ago

If you're really that concerned about multiple users, I think doing the CC check would be the way to go. The larger question I think you should be asking, however, is why this guarantee is so important. You're setting up a huge barrier to new sign-ups - if I came upon a site asking for my CC details, even if it was through PayPal, it would take a hell of a lot for me to move forwards and not lose interest in the service. So you had better make sure that your product is so compelling that it will cause your users to get up from their computers, go get their wallet, and give you their CC number; be warned, this is one hell of a threshold. If you've gone that far, however, I wouldn't bother refunding the money - almost all users who you've engaged enough to get their credit card number won't mind giving you a nickel or so for your services, which you'll probably need to cover the costs of your CC fees anyways. If you do this, I'd 100% go with PayPal - it's easy, and it provides me (the user) with some degree of reassurance that you're not just going to steal my CC number. Even if you do this, however, you still need other checks. I have three different credit cards, all hooked to different addresses and with using different variations of my name. Many banks allow users to generate one-time credit card numbers for online purchases. Multiple people could live at the same address and have cards, and they could even have the same names (like when sons are named after their fathers). Don't forget to analyze how important it is not to have duplicated, or conversely, how much of a problem it would be to have them - as this gets higher, you're going to have to make some tradeoffs (for example you could make a rule that says only one registration per household, and accept that you'll be losing out on users where there is more than one party in the household who wants to use your service). As a point of comparison, the last service that I signed up for that needed this severe of a uniqueness guarantee - the old ICANN@large, anyone? - did a web-based signup, which led to a code getting mailed to you. Additionally, they restricted it to one-signup-per-household, and didn't accept PO boxes. Bottom line is that this is a difficult problem, which generates a very high barrier to entry. So if you've done the analysis and concluded that it's 100% necessary to do this, you may as well embrace it and charge a bit.

evancaine 17y ago
thanks everyone for your comments. JimmyL, you make some very valid points and this is a route I'm taking hesitantly. I should have made it clear in my original post why I need to restrict signups in this way. I'm making a trading platform for users to buy & sell collectible items from a certain niche. Without limiting new accounts, there's little to stop someone creating multiple accounts and engaging in fake transactions in order to bump up their feedback, especially during the beta because I won't be charging any fees.

barryrandall 17y ago

Generally speaking, if somebody wants multiple accounts, they can get them easily enough. It would help to know a little bit more about why you're trying to block multiple signups. I'm in the US, and I write checks to my customers. We're required to submit information to the IRS on a quarterly basis, so we collect payee identification, which is either a Social Security number or Employer Identification Number. It's one thing to lie to an Internet company, its another to lie to the IRS. That discourages a lot of people from trying to game the system. Perhaps there's a similar mechanism available in the UK. Focus on detection. Scoring new accounts for possible/probable fraud, and flagging them for review works wonders. Scaling this approach requires more human effort, but it's worth it when you get in to large dollar amounts. It also helps to have some leverage in your terms of service.

anamax 17y ago

> For a project I'm working on I need to make sure as far as possible that users are not able to signup multiple accounts. For your convenience or theirs?