How to Stop Fake Signups on a Rewards Site or App

How do you stop fake signups on a rewards site?

You stop fake signups by layering cheap checks at the sign-up form: a bot challenge such as Cloudflare Turnstile that you verify on your server, email verification that rejects disposable domains, rate limits per IP address, network and device, and a hidden honeypot field. Then you remove the payoff: no sign-up bonus or earnings can be withdrawn until the account has aged and its first rewards are confirmed. Finally, you watch sign-up volume in your logs so a wave is caught in hours, not at cashout.

This guide covers the sign-up form and an account’s first days on rewards sites and apps. Later stages have their own guides: Stop multi-accounting and VPN abuse for duplicate accounts, How to prevent referral fraud for referral farms, and KYC for rewards sites for identity checks at cashout.

The sign-up defense stack at a glance

On a rewards site every new account can be worth something: a welcome bonus, a referral commission, offers that pay before anyone looks. Even a fake account that never cashes out costs you a verification email that may bounce, maybe an SMS, and skewed marketing data. Each control below stops a different kind of fake signup.

Put the rules in your terms before you enforce them: one account per person, real email only, no automated sign-ups. Rewards site terms of service covers the wording.

Bot challenges and honeypots that actually work

Turnstile or CAPTCHA, verified on your server

Cloudflare describes Turnstile as a “smart CAPTCHA alternative” that runs in managed, non-interactive or invisible mode and works on any website, even one not proxied through Cloudflare. The Turnstile plans page lists a free plan with unlimited challenge requests and up to 20 widgets per account (checked on October 29, 2026).

The most common mistake is adding the widget and never checking the result. Cloudflare’s server-side validation guide says you must call the Siteverify API, that tokens can be forged if you skip it, and that each token is valid for 300 seconds and can be validated only once. So on your server:

• Call Siteverify before you create the account or send any email, and reject the request unless success is true.
• Check that hostname is your domain and action matches the form, so a token solved elsewhere cannot be reused.
• Protect the other forms that send messages too: “resend verification email”, password reset and phone code requests.

People paid to sign up pass any challenge easily, which is why the next layers exist.

Honeypot fields and timing checks

A honeypot is a form field real people never see. Move it off-screen with a CSS class, add tabindex="-1", aria-hidden="true" and autocomplete="off" so keyboard users, screen readers and password managers skip it, and give it a plausible name such as company_site. Simple bots fill every input. Add a timing check too: put the render time in a signed hidden value and treat a submit within a second or two as automated.

Email verification and disposable domains

Require a verified email, by one-time code or short-lived signed link, before an account can open your offerwall or receive any bonus. Until then it can browse but not earn. Bots that type invented addresses never get past this step.

Block disposable email domains

Throwaway inbox services create a working address in seconds, which is exactly what a sign-up farm needs. The maintained open-source list is disposable-email-domains on GitHub. Its disposable_email_blocklist.conf held 9,963 domains when we checked on October 29, 2026, with new domains added two days earlier, and it is released under CC0, so commercial use needs no permission. Its README quotes a PyPI administrator saying PyPI uses it to block throwaway domains from creating accounts. Three details matter for your code:

• Entries are second-level domains, so mail.example-temp.com must match example-temp.com. Check every parent domain.
• The maintainers “cannot guarantee all of these can still be considered disposable”, so keep a small allowlist of your own.
• The list changes often. Refresh your copy on a schedule, such as weekly.

A minimal PHP check that walks up the domain:

function is_blocked_email(string $email, array $blocked): bool
{
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        return true;
    }
    $parts = explode('.', strtolower(substr(strrchr($email, '@'), 1)));
    while (count($parts) >= 2) {
        if (isset($blocked[implode('.', $parts)])) {
            return true;
        }
        array_shift($parts);
    }
    return false;
}

$blocked = array_flip(file('disposable_email_blocklist.conf', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES));

Tell a blocked user plainly: “Please use a permanent email address.”

Normalize addresses before you check for duplicates

Google’s help page Dots don’t matter in Gmail addresses confirms that johnsmith@gmail.com and j.o.h.n.s.m.i.t.h@gmail.com reach the same personal inbox, and its Gmail aliases page shows tags such as janedoe+school@gmail.com. Store a normalized copy (lowercase, dots and plus tags removed for gmail.com and googlemail.com) and enforce uniqueness on it, but send to the address the user typed. Do not strip dots for work or school accounts, where Google says dots do matter.

Rate limits per IP, network and device

Real people sign up once; farms sign up in batches. Count attempts, not only successes, in a sliding window, at several levels:

• Per IP address, generously, because families, schools and mobile carriers share addresses.
• Per network range: a /24 for IPv4 and a /64 for IPv6, since one IPv6 user often controls a whole /64.
• Per device: an app device identifier, or a browser signal on the web. What is device fingerprinting? explains what these signals can prove and the privacy rules around them.
• Per email domain: a run of sign-ups from one small, unknown domain is often a farm’s own catch-all domain.
• Per message: verification emails and SMS codes per address, number and IP, with growing delays between resends.

Slow attacks spread over many residential addresses slip under counters. What is IP reputation? covers the VPN, proxy and data center detection that helps there.

Phone verification: when it is worth the cost

A phone number costs the abuser money, so it is harder to fake in bulk than an email address. But it has costs for you too:

• You pay per message, and attackers exploit that. Twilio’s guide on preventing fraud in Verify describes SMS pumping: fraudsters use your phone number field to send codes to number ranges a mobile operator controls, and share in the revenue. It recommends rate limits by user, IP or device, turning off countries you do not serve, exponential delays per number, and a CAPTCHA.
• Numbers can be bought. Rented and virtual numbers receive codes too.
• Some honest users cannot pass. NIST’s SP 800-63B-4 treats phone network (PSTN) codes as restricted, tells verifiers to weigh signs such as a SIM change or number porting, and notes that weak coverage stops some people receiving codes. It is written for logins, but the lesson carries over.
• Friction and data. Users hesitate to share a number, and you must protect it.

For most rewards sites the best moment is the first cashout, not sign-up: the user has a reason to verify, you only pay for people who earned something, and you can flag a number already on another account. Ask at sign-up only where your logs show heavy abuse.

Delay withdrawals until accounts age

Most fake signups exist to take something out quickly. If nothing can leave in the first days, many stop being worth creating, and the rest give your other checks time to work.

• No withdrawable sign-up bonus. Release a welcome bonus only after the account’s own first offer reward is confirmed.
• A minimum account age before the first cashout, such as 7 days (an illustrative figure).
• First earnings must clear their hold, because offer rewards can be reversed weeks later; Reward hold periods shows how to set the length.
• Review every first cashout, by hand or by rules.

Show the date the account becomes eligible on the cashout page. A visible countdown prevents more tickets than any FAQ.

Spotting sign-up waves in your logs

Monitoring catches what gets past every check, ideally the same day. Compare sign-ups per hour with the same hour last week, alert on a big jump, then look at what the new accounts share:

• A sharp rise with no campaign, post or launch to explain it.
• A falling share of verified emails: farms often abandon most accounts.
• One email domain, network provider or country dominating.
• Usernames or addresses that follow a pattern, such as a word plus a counter.
• Identical browser versions and screen sizes, or near-identical form completion times.
• New accounts that go straight to the highest paying offer, then go quiet.

A simple hourly query often shows it. This MySQL example assumes a users table with a creation time, a verified flag and the sign-up IP:

SELECT DATE_FORMAT(created_at, '%Y-%m-%d %H:00') AS hour,
       COUNT(*) AS signups,
       SUM(email_verified) AS verified,
       COUNT(DISTINCT signup_ip) AS ips
FROM users
WHERE created_at >= NOW() - INTERVAL 7 DAY
GROUP BY hour
ORDER BY hour;

If a wave reaches your offerwall, offer partners reverse the results that were not genuine. Pass your user ID in the sub ID of every wall link so each reversal maps to an account (Click IDs and sub IDs), and see Ad fraud and bot traffic for bot patterns after sign-up.

Protect your email sender reputation from fake signups

Many owners discover this cost too late. Bots sign up with addresses that do not exist, which bounce, or with real people’s addresses, and those people mark your unwanted verification email as spam. Both count against your domain. Then your password resets and cashout confirmations land in spam too, and an email provider may pause your outgoing mail altogether.

Gmail and Yahoo publish the rules senders must meet. In summary (checked on October 29, 2026):

Sources: Google’s Email sender guidelines and Yahoo’s Sender Best Practices. Both have enforced these requirements since February 2024, and they can change, so read the live pages.

What to do on a rewards site

1. Send nothing before the bot check passes. The verification email sits behind the server-verified challenge, the disposable domain check and the rate limits.
2. Cap verification mail per address and per IP, with growing delays on “resend”, so nobody can use your form to flood a stranger’s inbox.
3. Suppress hard bounces at once and mark the account unverified.
4. Send marketing to verified users only.
5. Separate mail streams. Google recommends a different IP for each message type if you send from several, and one From address per category. Many senders also put transactional mail on its own subdomain so marketing problems do not block password resets.
6. Watch the numbers. Google Postmaster Tools shows your Gmail spam rate, and a jump in your own bounce rate is often the first sign of a sign-up wave.

Frequently asked questions