Finding the same person behind many accounts
Rank shared artefacts by what they prove. A repeated verified ID number means the same person. A repeated face is strong evidence for review. A shared device, phone or address is common in families, so treat it as corroboration and count distinct people before acting.
Charles Archibong, Co-founder
· 5 min read
Key takeaways
- A repeated verified ID number is the only artefact that proves two accounts are the same person.
- A face match across accounts is strong evidence to review, not proof to act on automatically.
- Shared devices, phones and addresses are normal in families; count them, then combine them.
- Set thresholds on how many other accounts share an artefact, and route to review before blocking.
To find one person behind many accounts without punishing families, rank the evidence by what it proves. A verified ID number that appears twice means the same person, almost by definition. A face that matches across accounts is strong evidence worth a human look. A shared device, phone number or address is ordinary in households, so it should only ever add weight to other evidence.
The practical rule: act automatically only on identity proof, send face matches and stacks of weaker signals to review, and set every threshold as a count of other accounts, so one family sharing a phone never looks like a fraud ring.
Why is this harder than it looks?
Multi-accounting shows up as promotion abuse (a sign-up bonus claimed twenty times), loan stacking (one borrower, several credit lines) and ban evasion (a blocked customer returning under a new name). The obvious fix is to block anything that repeats. It fails quickly in practice.
Consider three illustrative households:
A mother in Ibadan opens accounts for herself and her two adult sons on her phone, because the sons' phones cannot run the app. One device, three genuine customers.
Four students share a flat in Nairobi and one Wi-Fi router. One IP address, four genuine customers.
A man in Accra creates six accounts with borrowed ID cards and his own face, on six cheap phones. Six devices, one person.
A rule that blocks repeated devices stops the first family and misses the third case entirely. The signals have to be weighed, not just counted.
Which signals prove what?
Signal | What a repeat means | Innocent explanations | Suggested use |
|---|---|---|---|
Same verified ID number | The same person | Almost none, other than a returning customer re-verifying | Link the accounts; apply your one-account policy |
Same face on different identities | Probably the same person using someone else's documents | Twins, close relatives, poor photos | Review |
Same device | Same handset | Families, shared phones, agents helping customers | Corroboration; review above a count |
Same verified phone number | Same SIM | Family numbers, shared business lines | Corroboration |
Same address | Same building | Households, compounds, hostels | Weak corroboration only |
Disposable email domain | Low-effort sign-up | Privacy-minded users | Friction, not rejection |
The ordering matters more than the exact thresholds. Only the first row is identity proof. Everything below it is a pointer.
How should you use a verified ID number?
Deduplicate on the verified number, not the typed one. A number the applicant typed can be anyone's. A number that passed a government record check or was read from a document and matched to the selfie belongs to the person who verified.
Then decide what your product allows. A lender may permit one account per verified person. A marketplace may allow several accounts for one person but only one welcome bonus. Write the policy down before you build the rule, because the rule is only as good as the policy it enforces.
In Myaza Trust, when an entity is declared verified with an ID, the Identity Hub links it to an identity record, reusing the existing one where the ID is already known. That identity also collects the other IDs the same person has verified with in your organisation, so a customer who verified with a BVN and later with a NIN is recognised as one person.
How should you treat a face match?
The attacker in Accra defeats ID-number deduplication by using a different borrowed ID each time. What they cannot easily change is their face, because each account had to pass a selfie and liveness check. Searching new selfies against your existing verified customers is how this pattern comes to light.
Treat a match as evidence to review. Faces can look alike, relatives resemble each other, and a poor capture can produce a misleading score. The decision you want a reviewer to make is: is this the same person using someone else's identity?
Myaza Trust runs this search after a successful verification, within your own organisation, environment and face model, excluding the same entity. In the workflow builder, Presence Intelligence → Rules → Review face reuse sets how many other accounts must match before the verification goes to review; a threshold of 2 means at least two other accounts, and repeated checks on one account do not count (face reuse documentation). You can also send a search that could not run to review, since a missing finding does not prove an account is unique. A face blocklist and allowlist let you record known bad actors and known look-alikes. Searches never cross into other organisations' customers.
How should you weigh devices and phones?
Use them as counts and as corroboration.
Count distinct people, not attempts. One customer retrying five times on one phone is one person. Three different verified people on one phone is a family, an agent or a farm.
Combine before acting. Three people on one device is common. Three people on one device, each with a face match to another account, is not.
Raise the bar where the reward is high. A device shared by five people might be fine for a savings account and worth a review for a welcome bonus.
Decision rules in Myaza Trust can read device.matchedEntities (the multi-accounting count for the device) and phone.matchedVerifications (how many other verifications in your organisation verified the same number), alongside email.disposable (decisioning fields). A shared-device finding recommends review; it does not block an account or merge identities.
A worked rule set for a promotion
Here is an illustrative configuration for a sign-up bonus, from strongest to weakest evidence:
Same verified ID as an existing customer: no second bonus; link to the existing account.
Face matches two or more other accounts: hold the bonus and send to review.
Device used by three or more other verified people, and a phone number verified by another person: hold the bonus and send to review.
Device shared with one or two other people and nothing else: pay the bonus. This is the family case.
Disposable email: ask for a different email before the bonus is paid.
Notice what is missing: nothing in this list blocks an account outright on a device or IP address. Blocking belongs after a person has looked at the evidence.
What to do next
Write your policy: how many accounts, and how many rewards, one verified person may have.
Deduplicate on verified ID numbers first; it is the cheapest proof you have.
Add face reuse as a review signal, with a threshold counted in other accounts.
Use device and phone reuse as counts that add weight, never as a sole reason to block.
Review a sample of flagged cases each month and adjust thresholds based on what reviewers found.
See how these checks fit into fraud prevention and ongoing fraud detection.
Sources
Charles Archibong
Co-founder
Charles Archibong co-founded Myaza Trust. He writes about identity verification, financial technology, and the practical work of building trusted digital services.
