How streaming services detect password sharing

When Netflix started charging for extra members outside a household in 2023, the obvious question was how a server sitting in a data center could possibly know who lives in whose apartment. It can’t, not directly. What it can do is watch a pile of network and device signals accumulate over time and make a statistical call. That’s the same toolkit used across ad fraud detection, bot mitigation, and multi-accounting enforcement: no single signal proves anything, but enough of them stacked together get uncomfortably accurate.

The household is defined by an IP address, not a person

The anchor signal for most streaming platforms is the IP address assigned by the subscriber’s home internet connection. Residential ISPs hand out a small number of IPs per household, usually one public IP shared by every device behind the router through NAT. When a smart TV, phone, and laptop all check in from the same public IP repeatedly over weeks, that IP becomes a reasonable proxy for “this household.”

This is why the standard advice from streaming providers is that a primary device needs to connect to the home network periodically. It’s not really checking the device, it’s checking that the IP that device sits behind still matches the IP on file. If a login shows up from a residential IP block in another city or country, associated with a different ISP, that’s the first and cheapest red flag. IP-to-ASN databases make this trivial: every public IP maps to an autonomous system number tied to a specific ISP, and ISPs are geographically constrained. A Comcast IP in Denver and a Comcast IP in Miami look nothing alike to a lookup service, even though both are “residential.”

Device fingerprinting fills in what IP alone can’t

IP addresses change. Mobile carriers rotate them, people move, households get new routers. So platforms layer device-level fingerprinting on top. Every app install generates a device ID, and streaming apps also read things like OS version, screen resolution, hardware model, and the TLS/HTTP client signature the app presents when it talks to the API. None of that is exotic, it’s the same fingerprinting surface used across the ad-tech and fraud-detection industry to tell devices apart even when cookies are cleared or IPs rotate.

What matters for account sharing specifically is device diversity and churn. An account with two smart TVs, one phone, and one laptop that have all been stable for a year looks like a household. An account that has cycled through eleven unique device IDs in three months, spread across four cities, looks like something else. Streaming platforms cap the number of devices that can be registered to an account at any given time, and some flag accounts that repeatedly deregister old devices to register new ones from far-flung locations, since that pattern is a common workaround for the device cap itself.

Wifi network identifiers tie devices to a physical place

On top of public IP and device ID, some platforms read the local wifi network’s identifiers, things like the SSID or the router’s MAC address, when the app has permission to see them. This is a stronger signal than IP alone because it survives ISP-level IP rotation. If the home router hasn’t changed but the ISP reassigns a new public IP overnight, the app can still recognize it’s on the same physical network. Netflix has described this kind of “primary location” check publicly: devices connecting through the home wifi periodically reaffirm the account’s home base, and TVs in particular are expected to be primarily used on that network since a television, unlike a phone, isn’t something that travels with a person.

When a login pattern looks unfamiliar, the cheap and reliable move is to just ask. A device logging in from a new IP or a location that doesn’t match the account’s history gets a verification step, an email link or a text code sent to the account holder. This does double duty: it confirms the account owner authorized the new session, and it creates friction that’s mildly annoying for a family member on a genuine trip but a real obstacle for someone whose access depends on repeatedly not having that friction.

This is a standard pattern borrowed from account-takeover defenses across banking and email. It’s cheap to run, it doesn’t require guessing intent from telemetry, and it puts the decision back on a human who has to be reachable at the exact moment the challenge fires. Anyone who’s shared credentials with someone outside their household has probably run into the code arriving on the wrong phone at the wrong time. That’s the mechanism working as intended.

Concurrent stream limits are the blunt backstop

None of the above tells a platform in real time whether a stream is legitimate. Concurrent stream caps do. Most subscription tiers limit how many simultaneous streams an account can run, independent of any fraud model, purely as a plan feature. It’s a blunt instrument, a family of five sharing one premium plan will bump into the same ceiling as a password shared across three unrelated households, but it caps the damage regardless of how clever the sharing arrangement is. Pair concurrent limits with device caps and the two together make casual, large-scale sharing structurally uncomfortable even without any behavioral analysis at all.

Behavioral and temporal patterns add confidence

Beyond location and device identity, platforms look at usage patterns over time: viewing history overlap, login time-of-day clustering, and whether activity from different locations happens concurrently or overlaps in ways that a single household’s routine wouldn’t produce. A household typically shows correlated viewing, someone starts a show, someone else picks it up later on a different device. Genuinely separate households sharing one login tend to show uncorrelated, parallel usage: different genres, different active hours, no overlap in what’s actually being watched. Machine learning models trained on this kind of session data don’t need to prove sharing conclusively, they just need to produce a confidence score that crosses a threshold for triggering a verification prompt or a paywall nudge.

VPNs and proxies complicate the location signal

Because IP geolocation is such a load-bearing signal, it’s also the one people try to spoof, usually with a VPN or a residential proxy to make a foreign or remote login look like it’s coming from the right city. Streaming platforms counter this the same way ad-fraud and geo-restriction systems do: IP reputation databases that flag known data center ranges, hosting provider ASNs, and commercial VPN exit nodes. A login from an IP registered to a cloud hosting company rather than a residential ISP is an immediate anomaly, since ordinary households don’t get their internet from AWS or a VPS provider. Residential proxy networks, which route traffic through real consumer IPs (often via SDKs bundled into other apps or, less legitimately, compromised devices) are harder to catch this way, since the IP genuinely belongs to a residential ISP. That’s why platforms don’t rely on IP reputation alone, and instead cross-reference it against device history, wifi identifiers, and behavioral patterns. A residential proxy might get the IP geolocation right for a single session, but it won’t have the weeks of consistent device pairing and viewing correlation that a real household builds up. No single spoofed signal survives being checked against the others for long, which is the general shape of most detection systems built on layered signals rather than one gate.

The arms race keeps moving

None of these mechanisms are static, and none of them are airtight on their own. Platforms tune thresholds, add signals, and adjust friction based on how much revenue leakage they’re willing to tolerate versus how much they’re willing to annoy paying customers. That trade-off, between catching abuse and not locking out grandma on vacation, is the actual constraint shaping most of this system, more than any technical limitation. The IP address started as the anchor because it was cheap and mostly reliable. Everything layered on top of it since exists because IP alone was never quite enough.

Want more breakdowns of the systems running underneath the platforms everyone uses? The Hidden Internet covers the infrastructure of detection and evasion across streaming, ads, and the web at large.

Get new guides and videos first — join the Telegram channel.