Identity rings: the person running five accounts and the family sharing a phone leave the same trace

How it attacks

There is no single fake customer here. There are five, and behind all five there is one person.

Each identity is built whole: its name, its ID, its payment method, its small history. On paper none of them has anything to do with the others.

What runs short is hardware. Identities get manufactured by the dozen, but every phone is a phone they have to get hold of. So five accounts get spread across two or three devices, and the operator tries to keep them from crossing: one buys today, another tomorrow, each from the device it was assigned.

When you block one, it gets abandoned on the spot. No complaint, no email, no request for an explanation. The other four keep operating as if nothing happened.

What stays visible is whatever could not be separated: the same device, the same address or the same phone line showing up under people with nothing in common.

Who looks like it and is honest

And that is what a good chunk of your customer base looks like.

The family sharing a card. Mum does the groceries at ten, dad pays the utility bill at two, the kid buys a game at six. One card, four different phones.

The one rotating cards for rewards. One card for groceries, another for online, another for restaurants. A single customer with four payment methods, working the cashback on each one.

The borrowed phone. The brother who opens his account from his sibling's phone because his own ran out of data. The neighbour who helps someone sign up half a block away. The household computer three people log in from.

All three produce what the rule is looking for: accounts belonging to different people connected by the same device, the same address or the same phone line.

And the cost of getting it wrong multiplies here, because blocking a ring means blocking a whole group. If the group was a family, you just lost four customers in one go.

What actually separates them

• What gets shared. The family shares the payment method and everyone brings their own phone. In the ring each identity brings its own payment method and the device is what repeats.
• What repeats in the data. Siblings sharing a phone also share a surname, an address and a neighbourhood, and they hide none of it. The ring identities have nothing in common on paper, and still live on the same device.
• What the money buys. Household spending spreads across the life of a household: groceries, bills, a game, a dinner. The ring identities end up buying the same thing, and sometimes shipping it to the same place.
• What happens when you block one. Cut the kid's purchase and the family calls the same day, receipt in hand and keen to sort it out. A burnt ring identity is almost always abandoned in silence.
• The rhythm between accounts. The one rotating cards uses each in its category, days or weeks apart. The ring identities take turns within the same day.

Two accounts sharing a phone is the most ordinary thing in a household. It takes several of these signals landing on the same group at once.

How it mutates once you detect it

Every block tells the operator which of their seams is visible from outside.

1. You block accounts sharing a device. They fake the device fingerprint. Each identity comes in as if it were on a different phone, bought in a different country.
2. You block the repeated address and phone line. They get a prepaid line per identity and spread deliveries across pickup points.
3. You block the whole group when one falls. They separate the calendar. The identities stop operating on the same day and each spends weeks building its own life before it is good for anything.
4. You block the account that walks away without complaining. It complains. It writes to support, attaches a document and asks for a review, like any customer whose purchase just got cut.

At that point the ring looks like five customers who never cross paths. And something shared is still sitting there: the phone that opened the first two accounts, the address of the first delivery, the line registered six months ago.

Every phone, every line and every address they have to source separately is one more piece to keep alive. Running five genuinely separate identities turns into a full time job.

Closing

The work is in letting the family keep buying from their four phones and seeing the group hiding behind five unrelated names. That depends on whether you can look at those accounts together, or only one at a time as each purchase arrives.

So how do you solve it?

Tuning this by hand takes days, and every day costs chargebacks and good sales. That is what we are solving at Frauddi. We will show you on your own data.

Book a free demo

Next: social engineering, the attacker holding every real detail of the victim because she handed them over herself, and the customer buying from another country because they are travelling (5 of 9).