How a Game Studio Finds Accounts Sharing One Owner
A game studio doesn’t need to know your name to know you’re the same person behind twelve accounts. It needs a pile of weaker signals that, stacked together, stop looking like coincidence. That’s the entire trick behind account linking: no single clue proves ownership, but enough of them pointing the same direction is close enough for a ban wave.
Studios care about this for reasons that have nothing to do with curiosity. Smurfing wrecks matchmaking. Ban evasion lets a cheater or a toxic player just log back in under a fresh name. Account farming floods a game’s economy with bots that grind currency to resell. Review bombing and boosting rings both depend on one operator controlling many identities at once. Multi-accounting is the common thread, so detecting it became its own discipline inside anti-cheat and trust and safety teams.
The account is not the unit of identity
The first shift in thinking is that a game account is just a row in a database. It’s a username, a password hash, some progress data. None of that tells you who’s actually pressing the keys. What studios try to fingerprint instead is the machine, the network, the payment trail, and the behavior, because those leak information the account itself never will.
This is why banning an account rarely solves ban evasion on its own. If the underlying device or payment method isn’t flagged too, the same person just registers account thirteen. Studios that are serious about this build systems that follow the person’s fingerprints, not the login name.
Device and hardware signals
On PC, native game clients can read more from a machine than a browser can. Anti-cheat and launcher software commonly collects a hardware ID built from things like disk serial numbers, motherboard identifiers, network adapter MAC addresses, and sometimes GPU or CPU identifiers. These get hashed into a single fingerprint tied to the account at login or install time.
The reason this matters for linking accounts is that hardware doesn’t change often. Someone can burn through email addresses in seconds, but swapping a motherboard or reformatting a drive to get a fresh set of hardware identifiers is expensive and, for most people, more effort than it’s worth. When five accounts log in from a client that reports the same disk serial and MAC address, that’s a strong pairing, even if the IP addresses and usernames are all different.
Mobile titles lean on a parallel set of identifiers: device model, OS build, advertising identifiers where available, and characteristics of the installed app environment. Emulators and rooted or jailbroken devices tend to expose telltale differences from stock hardware, which is itself a signal studios watch for, since bulk account creation on mobile often runs through emulator farms rather than physical phones.
Network signals
IP address is the oldest and weakest linking signal, because so many legitimate people share one: households, university dorms, offices, mobile carrier NAT pools. A studio that bans on shared IP alone will catch roommates and punish innocent players constantly. So IP gets used as one input among many rather than a verdict by itself.
What’s more useful is the pattern around the IP. Studios look at whether an address belongs to a residential ISP, a data center, or a known proxy or VPN range, since account clusters tied to hosting providers or open proxy pools behave very differently from ordinary home connections. They also look at timing: a burst of new account registrations from the same subnet within minutes of each other is a different signal than steady organic sign ups spread across a day. Autonomous system number, connection type, and how an IP’s reputation has trended over time all feed into a network score that sits alongside the device fingerprint rather than replacing it.
Payment and account creation trails
Money leaves a trail that’s harder to fake than a username. Card numbers get tokenized, but the token, the billing zip, the card’s issuing bank range, and the name on the card can all be compared across accounts without the studio ever seeing the raw number. Gift card codes and store credit have their own redemption logs. When the same tokenized payment method funds six different accounts, or six accounts all use gift cards purchased in the same retail transaction, that’s a direct financial link, not an inference.
Email and phone signals work similarly. Disposable email domains, sequential usernames, and phone numbers from bulk SMS verification services all have recognizable shapes that fraud teams learn to spot over time. None of these are proof by themselves, since real people reuse a card for a spouse’s account or share a phone number in a family, but they compound with device and network signals into a much stronger case.
Behavior is the hardest thing to fake
Even a person who is careful about hardware, network, and payment separation still plays the game the same way across accounts, because playstyle is a habit, not a choice made at login. Studios that invest in this build behavioral models around things like reaction time distributions, preferred routes or builds, aim patterns, keybind layouts, and even chat writing style.
Text is a particularly durable signal. Stylometry, the analysis of word choice, sentence length, and punctuation habits, has been used for authorship attribution long before games adopted it, and it works nearly as well on in-game chat logs as it does on essays. Two accounts that never interact but write with the same tics, the same typos, the same slang, are a plausible link that a human investigator can weigh alongside the harder technical evidence.
Mouse and keyboard telemetry, where it’s collected, adds another layer: the timing between keypresses and the curve of a mouse movement are surprisingly personal, closer to a signature than to a skill level.
From signals to a verdict: graph analysis
None of these signals is used in isolation. Studios that run mature detection pipelines build a graph where accounts are nodes and shared signals are edges: two accounts connected because they shared a device fingerprint, another edge because they shared a payment token, another because they logged in from the same subnet within the same hour. An account with one weak edge to another account is probably nothing. An account sitting in a tightly connected cluster of ten others, linked by multiple independent signal types, is a very different story.
This clustering approach is also what limits false positives. A shared IP alone gets a shrug. A shared IP plus a shared device fingerprint plus a shared payment token is not something two strangers produce by accident. The graph lets a studio set a threshold: act on dense, multi-signal clusters, and leave thin, single-signal overlaps alone.
What happens after a cluster is found
Studios don’t always ban the instant a cluster lights up. Immediate, obvious bans teach the people running the accounts exactly which signal tripped the alarm, which just accelerates the arms race. It’s common for trust and safety teams to sit on a confirmed cluster, applying quieter measures like matchmaking restrictions, shadow visibility limits, or delayed rewards, while continuing to log signals until the pattern is stable enough to act on in a batch. Large ban waves that land all at once, rather than trickling out account by account, are often a sign that a studio was doing exactly this: watching a cluster grow before pulling the trigger.
Where the false positives live
This system is powerful but not clean. Families on one router, internet cafes, university networks, and people who reformat a shared household PC all produce overlapping signals without any bad intent. That’s precisely why competent studios weight and combine signals instead of banning on any single match, and why appeals processes exist for cases where the graph got it wrong. A studio that bans purely on shared IP or shared hardware ID, with no human review of edge cases, will eventually catch a family of four playing on the same laptop and call it a day well spent. The better systems treat every signal as evidence, not a verdict, and reserve the harshest action for clusters where the evidence is genuinely overwhelming.
The bigger picture is that account linking is a slow, layered defense built from data most players never think about: the hardware they’re on, the network they’re connected through, the card they paid with, and the way they type in chat. No one signal catches a determined operator, but very few operators manage to keep all four clean at once, and that gap is where studios do most of their work.
If you’re curious about the other side of this cat and mouse game, from device fingerprinting to proxy infrastructure to how detection systems get probed and worked around, that’s the whole beat we cover at The Hidden Internet.
Get new guides and videos first — join the Telegram channel.