Gmail dot and plus alias detection
Gmail dot and plus aliases let one person register again and again with a single inbox. [email protected] and [email protected] look like two players to your database, but every email lands in the same mailbox. InlineShield folds each address back to the inbox it belongs to and flags the sign-up when that inbox has already registered at your site.
Last updated
Why the Gmail dot trick works
Gmail ignores dots in the part before the @, and it ignores everything after a plus sign. It also delivers mail for googlemail.com to the same accounts as gmail.com. So one inbox has thousands of spellings, and each one passes a normal "is this email already registered?" check.
For a casino or sportsbook that is a direct cost. Each new spelling can claim the welcome bonus, the free bet or the no-deposit spins again, and the confirmation emails all reach the same person.
Address typed at sign-up Inbox it delivers to
[email protected] [email protected]
[email protected] [email protected]
[email protected] [email protected]
[email protected] [email protected]
[email protected] [email protected]What InlineShield does at sign-up
- Normalises the address. Dots and plus tags are removed for Gmail, and
googlemail.combecomesgmail.com, so every variant above maps to one inbox. - Checks your own history. The inbox is compared with earlier sign-ups at your site only. Players at other operators are never matched against yours.
- Holds the repeat. A second sign-up from the same inbox gets the trigger
DUPLICATE_INBOX_ALIASand is held for review (verdict QUARANTINED,recommendedAction: "review") instead of going straight through. You can switch this hold off in the console under Settings › Rules. - Explains why. The answer lists the trigger and a plain-language reason, so whoever reviews the sign-up can see which earlier account it matches.
Hold it, don't refuse it
A plus address on its own is not proof of fraud. Plenty of careful people use [email protected] to sort their mail. So a first sign-up with a plus tag is not refused: it is held for review (verdict QUARANTINED, recommendedAction: "review"), and your team decides. Approve it and the signup.approved webhook comes back with require_kyc: the player gets an account, and you check their identity before any payout.
A second account behind the same inbox is held too, with the trigger DUPLICATE_INBOX_ALIAS, so your reviewer can see which earlier account it matches. See risk verdicts for the full set of answers, and pricing for how many sign-ups each plan covers.
Frequently asked questions
Does Gmail really ignore dots in addresses?
Yes. Gmail treats john, jo.hn and j.o.h.n as the same username, and drops anything after a plus sign. All of them deliver to one inbox.
Is googlemail.com the same as gmail.com?
Yes, for delivery. Addresses on googlemail.com reach the matching gmail.com inbox, so InlineShield treats them as one.
Will you block everyone who uses a plus address?
No. A sign-up with a plus tag is held for review, not refused, so your team decides. A repeat sign-up from an inbox that has already registered is held as well; that duplicate-inbox hold can be switched off in Settings › Rules.
Do you match my players against other operators?
No. Repeat sign-ups are detected per client: an inbox is only compared with earlier sign-ups at your own site.
What happens to a held duplicate?
It waits in your review queue. Approve or reject it in the console, and your server hears about it through a signed webhook (signup.approved or signup.rejected) or by asking the review status endpoint.
Does this need device fingerprinting?
No. The check works on the email address and your own sign-up history. InlineShield does not fingerprint devices.
Screen your next sign-up for free
The Free plan includes 1,000 screenings a month. Create an account, add your keys and see real verdicts on your own traffic. No card, no sales call, no setup fee.