How ban evasion detection works: re-identifying returning banned users
Last updated on July 6, 2026 · 11 min read
A ban is supposed to be the end of the conversation. The problem is that most bans remove an account, while the person behind it is still there, free to sign up again with a new email, a cleared browser, and a fresh IP. Ban evasion is that return: a user who was suspended or banned coming back under a new identity to pick up where they left off. It works because the original ban applied to the account, not to the person or the device behind it. Ban evasion detection closes that gap by recognizing the returning device, so the suspension follows the person instead of the throwaway account.
Key takeaways
- Ban evasion is a banned or suspended user returning under a new account to get back onto a platform. The ban removed an identity; the person behind it did not change.
- Account-level bans fail on their own because every identifier they rest on, the email, the cookie, and the IP, is cheap to swap. The device and network behind the new signup are what stay recognizable.
- It is sequential, not parallel. That is the line between ban evasion and multi-accounting: one is a banned user coming back after enforcement, the other is one user running many accounts at once.
- Detection works by re-linking a new signup to the banned account it traces back to, then scoring how confident that link is, so a returning evader is caught at signup rather than after the damage.
- Detection produces the evidence; your team owns the decision. The honest limit: a web-layer read survives a new email, cookie, IP, and browser, but not a full hardware change.
What is ban evasion?
Ban evasion is the practice of a banned or suspended user circumventing that enforcement by returning to the platform under a different account. The account they were banned on stays gone; they simply create a new one, often with a new email and a cleared browser, and carry on. Most platforms prohibit it in their terms, because the point of a ban is to remove a behavior, not just to retire one username.
The reason it is worth treating as its own problem, rather than folding it into general fraud, is the timing. Ban evasion always happens after an enforcement action, as a direct response to it. That timing is also what sets it apart from multi-accounting: multi-accounting runs many accounts in parallel at the same time, while ban evasion is sequential, one banned user coming back after the ban. Either way it is a re-identification problem: the question is not "is this account risky" in the abstract, but "have we seen the person behind this new account before, and did we already show them the door." Everything about detecting it follows from answering that one question.
Why account-level bans do not stop evaders
An account-level ban does not stop a determined user because it blocks the things that are easiest to replace and leaves the things that persist untouched. A ban that keys on the account, the email, or the IP is defeated the moment any of those is swapped, and all three are cheap to swap:
- The email. A new inbox, including a disposable or plus-addressed one, is free and instant, so an email-based block never sees the same address twice.
- The cookie and local storage. Clearing them, or opening an incognito window, makes the next session look brand new to anything that trusted a stored identifier.
- The IP address. A VPN, a proxy, or just a router reboot hands over a different address, while a shared address means an IP ban also catches unrelated, innocent users. Blocking the address either misses the person or punishes a crowd.
What does not change as easily is the device doing the signing up and the network path it takes. An evader can present a new account, but the machine behind it, and the anonymity tools they reach for to disguise it, leave traces that a stable identifier can recognize. That is the layer ban evasion detection has to read, because it is the only one the user cannot reset by clearing a little data.
Those are the cheap swaps. Stepping back, every ban type a platform reaches for sits on the same spectrum, and each has a known gap:
| Ban type | How it works | Why it is evaded |
|---|---|---|
| IP ban | blocks the address in logs or server config | a VPN, proxy, or router reboot supplies a new address, and a shared IP also catches innocent users |
| Cookie or local-storage ban | flags a stored identifier | cleared by wiping storage or opening an incognito window |
| Username or email ban | disables the credential | a fresh email is free and instant |
| Email-domain ban | blocks whole disposable-email domains | over-blocks privacy-conscious users who legitimately use throwaway inboxes |
| Shadowban | hides the user's content from others while they still see it | a softer deterrent that delays an evader rather than re-identifying them, and is eventually noticed |
| Device-level recognition | anchors on a persistent device and network identifier | the durable layer: it survives email, cookie, IP, and browser changes, and only a full hardware change defeats it |
The signals that expose a returning banned user
A returning banned user gives themselves away because the new account is new but the person and their setup are not, and the effort to look new is itself a tell. No single signal is proof; the read is how many independent ones point back to an account you already banned. The signals that carry the most weight:
| Signal at signup or login | Why it points to ban evasion |
|---|---|
| The same device behind a new account and a banned one | the strongest re-identification link |
| A signup that appears soon after an enforcement action | the timing of a deliberate return |
| An anti-detect browser or sudden change of browser profile | an effort to look like a different device |
| A VPN, proxy, or datacenter connection on the new account | network cover to dodge an address block |
| The same network footprint or hardware traits as the banned account | a persistent layer the new email cannot hide |
| Reuse of the same payment instrument, referral, or contact detail | a slip that ties the two accounts together |
| A burst of new accounts, IPs, or countries tied to one device in a short window | velocity an ordinary user never produces |
The pattern across them is that re-identification is correlation, not a single match. An evader can change the visible layer and route the new account through a fresh IP, but the more they disguise, the more surfaces they have to keep consistent against a device the platform has already seen. A coherent device that resurfaces behind a new account, days after a ban, is the disagreement that gives the return away.
We tested that asymmetry against returning accounts opened through anti-detect browsers, and it held: the browser profile was rewritten to look like a fresh device, yet the device and network underneath still traced to the account we had already banned, matched with confidence up to 99 percent. The disguise widened the gap it was meant to close in 2022, when Chrome began reducing the user-agent string and moving real device detail into structured client hints, leaving a spoofed profile with more surfaces to keep consistent and more ways to disagree.
Some platforms add a behavioral layer on top of these device and network signals, matching writing style, posting rhythm, or interaction patterns back to a banned account, an approach measured in academic research on ban evasion. The two are complementary: one reads the machine and the network, the other reads a person's habits.
How ban evasion detection works
Ban evasion detection works by tying every new signup back to a persistent identifier, then checking that identifier against the accounts you have already banned. When a new account resolves to a device or footprint behind a banned one, that link is the detection. The flow:
- Anchor on a persistent identifier. Build an identifier from the device and network that stays stable across a new email, a cleared cookie, a rotated IP, and a fresh browser, the exact layers an evader changes to look new.
- Check it against the banned set. On each new signup or login, compare the identifier against the ones tied to previously banned accounts, so a returning user is matched to the enforcement they are trying to escape.
- Score the match, do not assume it. Recognition is probabilistic, so the output is a confidence, not a verdict. A strong, multi-signal match flags a likely returning evader; a weak one is treated as a new user rather than punishing someone who merely shares a network.
- Act at signup, not after the damage. Because the check runs when the account is created, the suspension can follow the person to the new account before they get back in, which is the whole point of making a ban stick.
The throughline is that the ban stops applying to an account and starts applying to a person: the platform recognizes the human behind the new signup, so retiring one username no longer resets the slate.
Where ban evasion hits hardest
Ban evasion shows up wherever a ban is worth dodging, which tends to be platforms with open signup and something a returning user still wants:
- Online gaming. Cheaters, smurfs, and toxic players banned by account simply make a new one, so a ban that does not stick is barely a ban.
- Social and dating platforms. Users removed for abuse, spam, or scams return under fresh identities, often to reach the same victims.
- Marketplaces. Sellers banned for fraud or policy violations re-register to keep operating, carrying the same behavior to a new account.
- Streaming and community platforms. Banned users evade to keep access or resume harassment, where recognizing the returning device is the only durable check.
These are also high-volume, open-signup platforms where one returning account is easy to lose in the crowd: the 2025 Imperva Bad Bot Report found automated bot traffic made up 51 percent of all web traffic, a baseline of automated signups and sessions that manual review alone cannot keep pace with. Whatever the platform, the banned user changes the account but keeps the device, and that is the layer a ban has to recognize to stay in force.
Detecting ban evasion with ShieldLabs
ShieldLabs gives your platform a persistent DeviceID that recognizes a returning visitor, which is what makes a ban follow the person. You add one JavaScript snippet to your signup and login pages, and on each visit it fuses device, browser, and network signals into one identifier that stays stable even after the user clears cookies, switches email, or rotates their IP. When that identifier matches one tied to an account you already banned, you have the link you need to keep the ban in force.
Each visit also returns a risk score from 0 to 100 with the anonymity signals behind it, including a VPN, an anonymous proxy, a datacenter IP, or an anti-detect browser, the cover an evader tends to reach for right after a ban. Across accounts, the pre-built patterns show which accounts trace back to one device, so your team can watch returning offenders as a pattern rather than catching them one at a time.
ShieldLabs scores the visitor and names the signals. You read the result through the API and webhooks and decide, by your own rules, what to do, whether that is holding the new account for review, requiring a step-up check, or letting a clean signup through, so the verdict stays in your application. The same identity layer carries into multi-accounting prevention, new-account fraud prevention, and ban evasion prevention.
Sources
- Wikipedia: Block (Internet)
- Niverthi, Verma, Kumar: Characterizing, Detecting, and Predicting Online Ban Evasion (arXiv, 2022)
- Imperva: 2025 Bad Bot Report (2025)
Frequently asked questions
- Can ban evasion be detected after a factory reset or reinstall?
- A web-layer read recognizes a returning user across the changes most evaders actually make, a new email, cleared cookies, a rotated IP, and even a fresh browser, because the identifier leans on traits that survive those resets. A full factory reset or a genuinely new device is the honest limit: it changes enough of the underlying signals that the match weakens, which is why web-layer detection complements a platform's own hardware-level ban rather than replacing it. Most evaders never go that far, because it is expensive and inconvenient, so the common cases are still caught.
- Does ban evasion detection flag legitimate users who share a device or network?
- Shared devices and networks are exactly why detection scores a match instead of asserting one. A family computer or a shared office network can produce overlapping signals, so a single shared trait is treated as weak evidence, not a verdict, and a confident flag needs several independent signals to agree. That lets a team review borderline cases and act only on high-confidence matches, rather than blocking a household because one person on it was banned.
- Does a VPN stop a platform from detecting ban evasion?
- A VPN hides the IP address, which defeats any block that relies on the address alone, but it does not change the device behind the connection, and the VPN itself is a signal. Detection that anchors on the device recognizes the returning user even when the IP is masked, and the presence of a VPN or proxy on a brand-new account, right after a ban, raises suspicion rather than lowering it. Masking the network is the cover, not the escape.
- When is ban evasion caught, at signup or later?
- The cheapest place to catch it is at signup or first login, when the new account is created, because that is when the returning user can be matched to the ban before they get back in and cause more damage. Reading the device and network signals at that moment, and checking them against previously banned accounts, turns an after-the-fact cleanup into a gate. Catching it later still works, but by then the evader is already on the platform.
- How do platforms like Reddit and Discord detect ban evasion?
- Large platforms detect ban evasion by linking a new account back to a banned one through signals the user cannot easily reset, rather than by the username alone. In practice that means looking at the device and network behind the new account, the timing of the return, and overlaps with the banned account's footprint, then flagging a likely match for a moderator to review. The exact signals differ by platform, and most keep them deliberately vague, but the common thread is that they recognize the person or device behind the new account, not just the new name.
Related articles
Device ban: how to block a repeat offender so the ban survives a new account
A device ban makes a ban stick to the device, not the account, so a banned user cannot walk back in under a fresh email. How it works and how to build it.
How to prevent ticket scalping
What ticket scalping is, how scalpers beat per-person limits with fake accounts, and how the device behind those accounts links them back to one buyer.
How to prevent referral fraud
What referral fraud is, the main types from self-referral to account farming, why it is hard to catch, and how the device behind fake referrals stops it.