Linked accounts

A new screening is compared with your account's earlier screenings. Each reason has its own time window, counted back from the new sign-up, and a strength:

• Each new screening is linked to at most 50 earlier sign-ups, the most recent.
• The IP-based reasons need the player's own IP address: the browser script sends it with every check, and a server-side /verify call needs the player's IP in its ip field. A /verify call without ip gives no IP-based link, only same_inbox, because the request's address is your server's, not the player's.
• The IP-based reasons also need a public IP address. A private, loopback or missing address never gives an IP-based link, for example when ip carries your own server's internal IP instead of the player's.
• An empty User-Agent never matches another one.
• Never linked: test screenings, screenings whose raw email or IP address has been blanked by retention, and pairs you marked "Not the same person".
• The lookup has a time budget of 25 ms, so linking adds at most a few tens of milliseconds to the answer. A screening whose lookup does not finish in time gets no links; later sign-ups can still be linked to it.

Offices, universities, public Wi-Fi and mobile carriers put many people behind one address. So when an IP address has had more than 20 sign-ups at your account in the last 7 days, the links through that IP (same_ip_same_browser, same_ip_same_locale and same_ip) are only possible. When a network has had more than 20 sign-ups in the last 24 hours, its same_network_same_browser links are possible too. The counts leave out the new sign-up and test screenings.

same_inbox is never downgraded.

• Groups form from strong links only. Screenings joined by strong links, directly or through each other, are one group, with an id such as lg_4fQ9xTzA1bC7dE2k.
• When a new sign-up is strongly linked to two groups, they merge into one, and the larger group keeps its id. A later screening can therefore report another id for the same people.
• Possible links are stored and shown, but they never join a group, so a busy shared network can't merge strangers.

linked is in the /verify and /siteverify answers and in the data of the registration.* and signup.* webhooks:

{
  "linked": {
    "groupId": "lg_4fQ9xTzA1bC7dE2k",
    "size": 3,
    "strength": "strong",
    "linkedToFraud": true
  }
}

linked is null when there are no links, when the lookup did not finish within its budget, and in test mode: Test keys never link. /siteverify reads the summary when the token is redeemed, so it can include links stored after the screening, and it is also null if the summary cannot be read at that moment. signup.* webhooks carry the summary as it is when the review is decided.

In the console under Settings › Rules, "Linked to fraud" decides what happens when linkedToFraud is true. It is off by default.

• Only a strong link to a blocked or reported sign-up counts; possible links never trigger the rule.
• A sign-up that is already held keeps its verdict and gains the trigger. A BLOCKED sign-up is unchanged, and the risk score is never changed.
• The rule never blocks.

• Review › Linked lists your groups. Open one to see its sign-ups, the reasons that link them and their possible links.
• Report group as fraud marks every sign-up in the group as fraud (multi-accounting), as if you had marked each one. Later sign-ups strongly linked to any of them then have linkedToFraud true.
• Not the same person removes the group's links: those sign-ups are never linked to each other again. A new sign-up can still be linked to any of them.
• Both actions work on groups of up to 200 sign-ups.

• No device fingerprinting. Links use only what screening already receives: the inbox, the IP address, the User-Agent and, with the browser script, the browser time zone and languages.
• Links are only within your own account. A sign-up is never linked to another InlineShield customer's sign-ups.
• IP links are weak on mobile networks: carriers share a few addresses between many customers, and one phone's address changes often. That is why an IP alone gives only a possible link, for 24 hours.
• A player who uses a new inbox, another network and another browser leaves no link.