Home » New Account Fraud: What It Is And How To Stop it

New Account Fraud: What It Is And How To Stop it

What is New Account (NAO) Fraud?

New account fraud is when fake accounts are created on a digital platform, with fraudulent intent outside of their intended use. This could include creating a fake profile on a dating app with the intention of sending phishing messages; setting up bogus online gaming accounts to accrue in-game assets using bots; or setting up financial accounts in other people's names to get credit. New account creation powers a wide range of downstream fraud attacks, which is why it is such a prevalent problem for businesses.

How Fraudsters Monetize New Account Fraud?

New account registration attacks can be monetized in many ways depending on the industry and account type. Attacks range from those that inflict direct losses on the targeted business, to less direct attacks which are meant to lay the groundwork for downstream fraud.

The potential direct and indirect losses and the implications for the wider digital ecosystem are why it is imperative to stop account origination fraud at the front door. In the end, it's the business and legitimate customers who are the ones that suffer.

new account fraud

What are the Steps of an Account Origination Attack?

The vast majority of new account registration fraud is accomplished with the use of automated scripts or human click farms. Sometimes, they are used in tandem. Each is used for specific types of fraud attacks.

  • Deploying Botnets

    Bot services are cheap to acquire and require relatively little technical knowledge to deploy. A basic internet search can turn up dozens of bot marketplaces. Bots can create new accounts quickly and at scale - much more than what a human would be able to. These bot-powered accounts are ideal for attacks such as phishing or content scraping - basically any attack where massive scale is needed for it to be profitable.

  • Human Click Farms

    Fraudsters can also hire teams of human workers to create new accounts and perform actions that require more nuance than bots can achieve. Common attacks in this regard include writing fake reviews for a product or business to falsely improve ratings, liking videos, or testing stolen credit card credentials.

  • Activating Dormant Accounts

    Sometimes new accounts are created with the intention of lying dormant for weeks or even months, only to be reactivated later all at once to commit a series of attacks. These can include coordinated attacks such as DDoS or disrupting the usability of a website in some manner.

Why is New Account Fraud on the Rise?

Given the ease and low cost at which fraudsters can access stolen personal data and buy the tools to create bogus accounts at scale, new account creation fraud can be a profitable enterprise.

They only need to have a low success rate for the ROI to work out on behalf of the attacker. For example, bots can create new accounts on a social media site at a large scale to send phishing messages en masse. Even if only a few of these are able to trick unsuspecting users into divulging personal information, the attack can turn out to be profitable for the fraudster. Fraudulent accounts are also used to scrape personal information from social networking sites, which can then be resold to third parties, or used for social engineering purposes in order to launch targeted spear-phishing attacks against individuals.

Additionally, new account fraud is used to create accounts that enable taking advantage of promotional items meant for new customers to entice them into signing up for a service, or to apply for loans and credit cards with no intention of paying them back. These are just a small number of the almost infinite types of fraud that can be committed that start with bogus account registration. That's why this type of fraud is so prevalent and a constant strain for companies to combat.

new account fraud
New Account Fraud and Abuse Continuum

Limitations of Current Approaches

It's difficult for businesses to identify and stop new account fraud because the fake account can often be masked to look like a real account. Sure, dumb bots are easily spotted, but today many attacks utilize more sophisticated bots that appear to mimic a good user. And human fraudsters performing multiple NAO attacks can hide or obfuscate their IP address, location, or any other identifiers. The more sophisticated the form of fraud, the more difficult it is to detect.

With the sophistication of fraud attacks today, much traffic falls into a "gray area" - the traffic that is hard to distinguish between being clearly good or clearly bad. Fraudsters count on this when they launch NAO attacks so they can "blend in" with good traffic, inflicting damage before the attacks are discovered, by which time it's usually too late. Since it's so easy to emulate good users, this exponentially increases false negatives. When faced with an overwhelming tide of these attacks, many businesses resort to blocking any user that might be deemed somewhat suspicious, which in turn hurts new customer acquisition, ruins user experience, and decreases brand loyalty.

new account fraud

This is an issue since many companies rely on an identity-based authentication strategy; but fraudsters already have the knowledge, tools, and data to evade detection from data-driven security parameters. This type of mitigation strategy is geared towards detecting extremes, but as we have seen, very little traffic falls into clean buckets of 'good' or 'bad'.

Smarter Authentication With Targeted Friction

Rather than taking extreme measures such as letting too many suspicious users create new accounts for fear of hindering good customers or mass blocking traffic, which inevitably leads to false positives, Arkose Labs takes an approach that uses targeted friction for a superior authentication experience.

Many sophisticated bots can accurately mimic human traffic and go undetected by traditional solutions. While Arkose Labs' step-up enforcement can detect and stop most large scale bots, sometimes the fraudsters deploy bots that have been trained to act like humans. These bots behave like humans but have solve patterns that are closer to automated traffic. Upon detecting the presence of such bots, Arkose Labs deploys a proprietary 'acid test' to effectively triage the traffic into humans vs. bots. This starts with the platform switching out the one visual puzzle for a completely new kind of puzzle, still easy for humans to solve. This effectively stops all automated traffic, as the attack program cannot possibly solve a puzzle its designer has never seen before.

The Arkose Labs Fraud and Abuse Platform does not just mitigate the effects of fraud but provides powerful remediation which blocks 100% of malicious bot traffic, and enables businesses to deflect attacks from bots, skilled cybercriminals, and sweatshop outfits. This allows good users to maintain the seamless digital authentication experience they have grown accustomed to, while providing friction and frustration to fraudsters.

Evidence-based Authentication

With this approach, targeted authentication can be deployed to stymie automated attacks and slow down and frustrate human attackers. Arkose Labs, thus, delivers targeted enforcement challenges that accurately distinguish between authentic users, malicious humans, and bots.

  • The challenges gradually increase in difficulty depending on the associated risk of the user. Ultimately, this makes fraudsters expend a large amount of time and energy and makes it inefficient to clear challenges at scale. Since increasing costs diminish the profitability of attacks, fraudsters are compelled to stop. That's how Arkose Labs effectively bankrupts the business model of fraud.
  • This means good users will be able to easily sign up for new accounts and take advantage of promotional deals and other incentives designed to attract new customers. Meanwhile, fraudsters who create fake new accounts for malicious purposes will be foiled.

To find out more about how Arkose Labs can help you stop new account origination attacks, click here to request a demo.


Fraudsters use stolen consumer details or synthetic identities to create fake new accounts and monetize them in a number of ways. For instance, a fake bank account may be used to open unauthorized lines of credit such as loans and credit cards. A fraudulent online gaming account is used for bonus abuse as well as to steal in-game assets and cheat other gamers. Bogus accounts on technology platforms exploit the free server space and compute power. Since businesses are trying to make onboarding simpler and more seamless for new customers, fraudsters are taking advantage and creating multiple fake new accounts to launch many types of attacks.

Digital businesses can choose to deploy anti-fraud solutions while onboarding new customers to help them detect and stop new account fraud. Rigorous monitoring and use of targeted friction, as provided by Arkose Labs, can provide them with long-term protection.

New account fraud continues to pose a rising threat to digital businesses, fraudsters are using fake new accounts to monetize freemium business models. The combination of fraudsters becoming more sophisticated in spoofing and cloaking techniques with unpredictable online behavior of authentic customers, is making it difficult for businesses to accurately identify fraudsters from legitimate users.

The Arkose Labs Fraud and Abuse Prevention Platform provides the most effective protection against large-scale fake account registrations. It helps protect digital businesses by shifting the attack surface away from the business network; and using real-time intelligence, rich analytics, and sophisticated step-up challenges to progressively diminish the economic viability of an attack. Once economic incentives are eliminated, fraudsters abandon the attack and move on.