How to prevent gaming fraud: theft, RMT, and multi-accounts

Gaming fraud is the abuse that targets the accounts, economies, and matchmaking of video games rather than the gameplay itself: stolen accounts resold with their rare items, real money trading farms harvesting currency for cash, and one person running many accounts to smurf, cheat, or claim new-player rewards over and over. The scale is not small. As far back as 2005, The New York Times estimated over 100,000 full-time gold farmers in China alone, a figure it put near one million by 2009, and the pressure on game accounts has not eased since: TransUnion found that 8.3 percent of attempted transactions in video gaming were suspected digital fraud in 2025. It travels under its own slang, but the mechanic underneath is almost always the same, one player behind many "separate" accounts, and the way to prevent it starts with seeing that link.

Picture a high-ranked player spinning up a fresh account to stomp beginners, a farm of a hundred accounts feeding a gold-selling site, and a banned cheater signing back in under a new email. To the login page each looks like a brand-new player. What separates them is the layer you choose to read, and the point at which the evidence hands off to your own call.

Key takeaways

• Gaming fraud on the account layer is one person, or one operation, running many video-game accounts to extract value: reselling stolen accounts and rare items, running real money trading and gold-farming rings, smurfing, and returning after a ban.
• It is hard to catch because the fraudster changes the visible layer, the email, the cookie, the IP, the browser, while the device and network behind the accounts stay the same. Detection that reaches the stable device layer wins.
• The signals that expose it are correlation, not a single match: the same device behind "separate" accounts, anonymity tools on a fresh signup, reused payment or trade details, and bursts of accounts created minutes apart.
• Detection produces the evidence; your game's own anti-cheat and your rules own the verdict. ShieldLabs returns a risk score with named signals through an API and webhooks, and your code decides what a linked account gets.

What is gaming fraud?

Gaming fraud is any deceptive activity that targets a video-game platform, publisher, or esports site for gain. Operators usually split it into layers that each need a different tool: the in-client anti-cheat layer that catches aimbots, wallhacks, and injection during a match; the payment layer that screens card abuse and chargebacks on in-game purchases; and the account layer, where one person operates many accounts, or breaks into accounts that are not theirs, at the web-side signup and login.

This guide is about the account layer, because that is where identity does the work. The offer being abused changes with the game, but the move is constant: manufactured identity at volume. A single player stands up a row of accounts, or steals an existing one, so the value a fair account is not meant to reach becomes reachable anyway.

That account layer is distinct from its gambling cousin. In iGaming and online casinos the same identity mechanic drives welcome-bonus farming, which has its own economics. This article stays inside video games: ranked play, in-game economies, item markets, and the accounts that hold them.

One scoping note before the mechanics. Detection here means linkage and recognition: tying accounts that already exist back to one player, or matching a returning device to an account you already know. It reads the device and network the account arrives on, and it complements the game client's own anti-cheat rather than reaching into the match.

How does gaming fraud work?

Gaming fraud on the account layer runs on a simple move: reset whatever a platform uses to tell players apart, so one person reads as a crowd or a hijacked session reads as its owner. The kit is small, well understood, and by 2026 cheap and largely automated. Each tool in it targets a field a careless system treats as identity:

• Fresh sessions on one machine. Clearing storage, a private window, or a logout-login cycle makes the next account look untouched to anything keyed on a cookie, and a farm needs nothing fancier than that to mint dozens of them on one PC.
• Rented addresses. Residential and mobile proxy pools rotate the connection on every account, so an address-based rule keeps meeting a clean IP it has never blocked, which is precisely how a gold-farming ring floats a hundred accounts that each read as unrelated.
• Anti-detect browsers. An anti-detect browser forges a different device profile for each account, so every signup arrives wearing a fabricated, "unique" identity tuned to slip past fingerprinting.
• Throwaway and aliased inboxes. Disposable mailboxes, plus-addressing, and dotted variants of one Gmail feed an unlimited stream of "new" players behind addresses no blocklist recognizes.
• Bought credentials. Account theft skips the new signup entirely: the fraudster picks up leaked logins, tests them at scale in a credential-stuffing run, seizes a live account, and then either strips its tradable items or flips the account itself.

The thread connecting all of these is that the surface of an account is disposable while the machine and the connection under it are not. Swap the email, wipe the cookie, rent a new IP, and none of it touches the device pressing the buttons. Anything that trusts only the surface waves the next account through; anything that reaches the stable layer, the device, links it back. That is the gap device intelligence is built to close.

The main types of video-game fraud

The account-layer abuse in video games clusters into four recognizable shapes. The vocabulary is native to gaming, but each one reduces to the same identity question.

• Account theft and resale. High-value accounts, a fully leveled roster, a rare skin collection, a high-MMR rank, are lucrative targets. A fraudster takes over the account with leaked or stolen credentials, then either strips its tradable items or resells the login itself on a third-party market. This is account takeover pointed at a game library, and it shows up as a login from an unrecognized device on an account that has value to move.
• Real money trading and gold farming. Real money trading (RMT) is the sale of in-game currency, items, or accounts for real-world cash outside the game's rules. At scale it is run by farms: rings of many accounts, often scripted, that grind currency or stockpile valuable resources to sell on external marketplaces. According to the developers of World of Warcraft and RuneScape, most gold-farming accounts were paid for with stolen credit card numbers, which is the bridge from this abuse to card fraud and chargebacks. Because the payout scales with account count, the operation is a multi-account problem first, and the farm's tell is a cluster of accounts that resolve to a shared device or network.
• Cheating, smurfing, and returning banned players. Smurfing is a high-ranked player creating lower-ranked alternate accounts to practice, try new techniques, or beat weaker opponents. Low-ranked players end up matched against far stronger ones, which is demoralizing and drives newcomers away. Related to it, a cheater or a griefer removed by a ban simply makes a new account and returns, which is ban evasion applied to competitive play. Both are the same move: extra accounts standing in for one player the platform would rather not have back.
• Payment fraud and chargebacks. Fraudsters buy in-game currency, cosmetics, or battle passes with stolen cards, then the real cardholder disputes the charge, so the platform loses the goods and eats the chargeback. On the account layer this pairs with the fake and taken-over accounts used to make the purchases, so the same identity read that links a farm also flags the accounts behind the disputes.

A related edge worth naming is legitimate multi-accounting. A player may keep a main and a genuinely separate second account for fair reasons, the way people keep two email inboxes, so account count alone is never the verdict. What detection is built to catch is the jump from a person with a couple of accounts to one operation manufacturing identities at volume, and that is a correlation call, not a headcount.

The signals that expose gaming fraud

A fraudster leaves tracks because the account is fresh while the human and the rig behind it are not, and the trouble taken to look fresh is a tell in itself. Nothing here is decisive alone; the read is how many separate indicators converge on one player or a machine already on record. The indicators that weigh most at a signup, a login, or a trade, with the direction each pushes the risk:

What the account reveals	What it suggests	Weight
One device sitting behind several "separate" accounts	a single operator, not a room full of players	High
A high-value account logged into from a device its owner never uses	a takeover underway before the items get moved	High
An anti-detect browser or a forged device profile	a rig rebuilt to pass as a first-time player	High
A VPN, an anonymous proxy, or a datacenter connection	masked routing standing over each account	High
One recurring network footprint under a run of "new" accounts	a farm operating out of a single location	Medium-High
A cluster of signups seconds apart from one footprint	scripting, not people wandering in	Medium-High
A stated region that contradicts where the connection originates	one origin hidden behind many faked locations	Medium-High
A card, cash-out wallet, or referral code recycled between accounts	one hand bankrolling, withdrawing, or self-inviting	Medium
Contact or trade fields that clone each other across accounts	accounts stamped from a single template	Medium

Not one line here is a verdict on its own. Plenty of honest players use a VPN, and a household or a dorm shares one connection. Correlation is what matters: the account that trips several lines at once, above all one whose device already shows up under other accounts, is the one to set aside for a closer look.

How do you detect gaming fraud?

Platforms catch account-layer gaming fraud by resolving every account to the machine and connection it came in on, then rating how strongly the evidence points to a shared operator or a login that does not belong to the account's owner. The surface swaps per account, but the hardware, the network path, and the clock all leave matching residue that a lone, spoofable field like IP never captures. The reads that do the work:

• A durable device fingerprint. An identifier assembled from a wide spread of device, browser, and OS traits keeps pointing at the same rig after the cookies are gone, the email is new, and the IP has moved, which is how a smurf's second account or a farm's hundredth one floats to the top.
• Repeat profiles across accounts. Two accounts that swear they are strangers yet return an identical or near-identical device profile hand you the clearest single sign of a shared player.
• Recognition on the way back in. At login, testing the device against the accounts you already retired flags a barred cheater or griefer trying to slip back into ranked before the match starts.
• Connection reputation. Blocklists, hosted-versus-home classification, ASN, reverse DNS, and geolocation peel apart the masked and datacenter routes a farm hides its accounts behind.
• Signatures of masking tools. VPNs, proxies, Tor, privacy relays, and anti-detect browsers each stamp a recognizable mark, the gear a fraudster relies on to stretch one player into many.
• Cadence and behavior. A rush of signups off one device, accounts born minutes apart, or a card, trade route, and referral code shared between them stitch together records that carry no obvious common field.
• The weighing step. Since every clue is soft on its own, they are scored together, and a footprint recurring across "unrelated" accounts turns into an anomaly all by itself.

The common thread is that the answer lives in correlation, never in a single lookup. A farm can rent a clean residential IP for each account and forge every profile, yet every extra layer it fakes is one more surface it has to hold steady across the whole fleet. A coherent rig that keeps reappearing behind twenty "different" signups, or a footprint that recurs a little too often, is exactly the contradiction a multi-signal read is tuned to catch, and holding that consistency at scale is what exposes the operation.

In testing, we ran accounts through anti-detect browsers rigged to forge a fresh device profile per account, and the spoof held on the surface while the layers beneath it drifted out of agreement. A profile rebuilt to pass as a brand-new player still had to keep its forged traits, its connection story, and its timing consistent across the whole fleet, and the more of that an operation faked, the more surfaces it had to hold steady at once. That asymmetry got sharper in 2022, when Chrome began reducing the user-agent string and moving device detail into structured client hints, so a self-reported identity and the traits actually observed no longer had to line up.

Why account-only enforcement falls short

Banning the account, the email, or the IP falls short because all three are the cheapest things to replace, and in a game they get replaced constantly. A ranked ban keys on an account; the smurf just makes another. An IP ban keys on an address; the farm rotates residential proxies and never shows the same one twice, and a shared address means the ban also catches unrelated players behind the same carrier or campus network.

The oldest heuristic, block duplicate IPs, breaks from both directions. Carrier-grade NAT routes many real subscribers through one public address, so hundreds of unrelated players can present the same IP and blocking it punishes a crowd. Residential proxies do the mirror image, handing one operation a fresh clean IP per account, so IP uniqueness stops meaning distinct people too. The same address no longer proves the same player, and different addresses no longer prove different players.

What does not reset with a click is the device doing the signing up and the network path it takes. A stable device identifier survives the exact email, cookie, and IP changes that defeat an account-level ban, which is why durable enforcement anchors on the device and the broader signal stack rather than on any single spoofable field. The honest limit sits at a full hardware change: a genuinely new device weakens the match, which is why a web-layer read complements a game's own hardware-level bans and anti-cheat rather than standing in for them.

How ShieldLabs detects gaming fraud

The stubborn part of gaming fraud is linkage and recognition: showing that twenty "different" signups belong to one farm, that a smurf's pristine new account is really a ranked veteran, or that a session on a high-value account is arriving from a machine its owner has never touched. ShieldLabs is the detection layer for gaming platforms that settles those questions for you. Drop one JavaScript snippet onto your signup, login, and account pages, bind it to a player account, and its pre-built patterns surface which players are working several accounts and which anonymity tools they favor.

The core of it is a persistent device identifier that reconnects a "fresh" visit to a machine it has seen before, straight through the cleared cookies and swapped IPs a fraudster leans on to pass as a crowd or a new owner. Wrapped around that identifier, every visit comes back with a risk score from 0 to 100 that weighs the contradictions and lights up a session when one player is steering a fleet of accounts behind masked connections and forged profiles, or when a login lands on an account from a device nobody there recognizes. All of it runs quietly, without adding a step for a genuine player. Riding alongside the score is a full spread of anonymity signals: VPN detection, anonymous proxy detection, datacenter IP detection, and more.

Every scored visit returns the visitor, the machine underneath it, a 0-to-100 score, and the named signals that shifted it:

{
  "event_type": "identification.scored",
  "schema_version": "2026-06-01",
  "created_at": "2026-07-02T10:15:00Z",
  "data": {
    "request_id": "3e8f1a90-2c47-4b6d-9f02-7a1c8e5d4b63",
    "visitor_id": "d4a7c218-6b93-4e51-8c0a-2f9b6d31e470",
    "device_id": "5b9e2c84-1f76-4a30-bd58-9c0e7a4f2d11",
    "connection_type": "vpn",
    "risk_score": 85,
    "detection_flags": { "anti_detect_browser": true, "vpn": true },
    "observed_at": "2026-07-02T10:15:00Z"
  }
}

That same device_id reappearing under a new email and a moved IP is the connection those resets were supposed to sever, whether it fronts a farm's next account or a barred cheater's comeback. You take the response, or the identical payload pushed to a webhook, and decide by your own rules what a linked account or an out-of-place login earns. ShieldLabs hands over the evidence; your rules act on it, and the verdict stays in your application next to your anti-cheat.

In the analytics dashboard your team can gauge overall traffic quality and patterns and separate anonymous traffic from clean traffic at a glance, tracked as a trend rather than examined one visit at a time, so a smurf wave or a farm signup surge shows up as a shape in the data instead of a stack of separate tickets.

Every piece of it, the risk score, the identifiers, and the named anonymity signals, comes through an API and webhooks, so your team can move on multi-accounting, account theft, RMT farms, and returning banned players from your own code. That same identity layer extends to multi-accounting prevention in any industry.

Sources

1. Wikipedia: Gold farming
2. Wikipedia: Smurfing (gaming)
3. Wikipedia: Carrier-grade NAT
4. OWASP: Credential stuffing
5. TransUnion: H1 2026 Update to the Top Fraud Trends Report (2026)