Fake accounts and sign-up fraud: what they are, what they cost

What is a fake account?

An account created by a program, often in series, on the sign-up form of a site.

People also speak of fraudulent accounts, mass sign-ups or sign-up fraud. This page is about fake accounts created by programs: those are the ones a bot check can refuse.

See: Glossary: fake account

Why do programs create fake accounts?

A sign-up form open to everyone is open to programs too. An account opens what an anonymous visitor does not have:

• sending spam from inside the site: messages, comments, profiles;
• taking an offer reserved for new accounts several times: free trial, welcome credit, referral;
• skewing what the site counts: sign-ups, votes, reviews;
• preparing other abuse, once the account is open.

What do fake accounts cost?

• time to find them, sort them and close them;
• skewed numbers: sign-ups, active accounts, conversions;
• welcome offers used up by accounts that will never serve;
• unwanted messages received by your real users.

It is simpler to refuse a fake account at sign-up than to remove it afterwards. Antisy cites no figure of cost: it has no source for one.

How do you recognise an automated sign-up?

Your site sees some of the signs itself: sign-ups in bursts, e-mail addresses that never confirm, accounts opened and never used.

Antisy looks at the submission itself. In the browser, the script measures the capabilities the browser declares, the languages and the time zone of the browser, the graphics rendering and the fingerprint of the device, signs of automation, the behaviour of the JavaScript engine and the course of the interaction. Antisy’s server reads the order of the HTTP headers, the IP address, the User-Agent and the request context. For a sign-up, Antisy also keeps the account identifier your site sends, encrypted and hashed.

Antisy does not publish the rules that make its verdict: each rule published would teach whoever is getting round the check what stops them.

See: Home page: what the script measures, and for how long · Frequently asked questions: why the answer does not give the reason for a refusal

What Antisy does against fake account creation

Antisy checks that each sign-up comes from a browser and not from a program, before the account is created, with no puzzle for the person signing up. Your server receives a verdict, allow or deny, and decides: create the account, or refuse without saying why.

An invalid, forged, replayed or expired token is refused in every mode. A token is verified only once: that of an accepted sign-up does not serve to create a second one.

The steps of the integration, and the call that ties the token to the account, are on the page of the use case.

See: Use case: protecting a sign-up from fake sign-ups · Documentation: what never passes

What Antisy does not do

• It does not recognise a fake account opened by hand: a person who signs up under a false identity sends from a real browser.
• It checks neither the e-mail address nor the identity of the person: confirming the address remains your site’s job.
• It does not close fake accounts already created: it acts at sign-up, before the account is created.
• Antisy is not a payment anti-fraud tool.

No bot check is perfect, and Antisy announces no detection rate. It adds to the other defences of a sign-up, such as confirming the e-mail address; it does not replace them.

Where does Antisy stand?

Protecting a login or a sign-up goes through a Node server kit (Express, Fastify, Next.js) that will be published on npm; it is not yet.

Access is by waiting list. The API and the dashboard (in French) have been in service since 27 October 2026, hosted at Infomaniak in Geneva; no customer is in production yet. A pilot is planned; it has not started.

See: The pilot · Join the waiting list

Frequently asked questions