How to detect ban evasion

To detect ban evasion, compare a new account with the one you banned on the traces people carry from one account to the next: the handle and its pattern, the email address, the phone number, the profile photo, the bio and writing, and how soon after the ban the account appeared. Then check whether both accounts lead back to the same person in public sources. Treat the new account as the banned user only when at least two specific, independent links agree, and never on a shared surname, city or interest alone.

Sixtyfour, our research agent, does the research half: give it the new account's handle, email address or phone number and it finds where each appears across public sources, works out whether they belong to the person behind the banned account, and returns every link with its source. This guide covers each signal, what it can and cannot show, and how to reach a decision that holds up on appeal. Our guides to linking related accounts, investigating an email address, investigating a phone number and finding out who is behind a fake account go deeper on single steps.

The Trust & Safety Professional Association's glossary calls it recidivism: "The evasion of temporary suspensions or permanent bans, such as by creating a new account under a different name to replace a previously disabled account." Platforms draw the edges differently. Discord's policy also covers "the use or reuse of an existing account or community to avoid a platform-level ban", and YouTube's termination rules reach "any channels in which you are repeatedly or prominently featured." Start from your own rule, because it decides whether an older or bought account is within scope.

On Reddit, ban evasion drew more permanent bans from the admins than any other rule in the second half of 2025: 1,446,274, according to the chart of account bans and warnings by Reddit Rules violation in its transparency report.

Sixtyfour researches whether a new account is the person you banned, from the identifiers the account gives you. Your platform's own account and payment records on both accounts stay with your team, and Sixtyfour does not see them. Give it the new account's handle, email address or phone number, describe the banned account in the request's research plan, and it searches for those identifiers across public sources, traces the accounts and records tied to them, and checks whether they lead to the person behind the banned account. You can ask for the answer as a field of your own, such as whether this is the same person as the banned seller, and with confidence scoring it comes back with a 0 to 100 score, a short justification and the source URLs. Anything it could not establish is left open, and a person on your team decides.

Investigators run it in Atlas, where they can attach saved captures of both accounts, and teams that screen new accounts at volume call it through the Research API. Lattice, in beta, turns many accounts into one graph, connecting rows that share an email address, phone number or profile URL, and its documentation says it "never merges people on name alone." Our trust and safety page has more.

A ban evasion review asks one question: is this new account the person we banned? Keep it apart from whether the account is breaking the rules again, which its own behaviour can answer. Wikipedia's banning policy can act on behaviour alone: new accounts that copy a banned editor's behaviour in the same context, and appear to edit solely for that purpose, are "subject to the remedies applied to the editor whose behavior they are imitating." Keep it apart, too, from whether the account belongs to a relative or friend of the banned person, which is rarely a reason to act on its own.

End each review in one of three places: the same person, with the links that show it; a different person, with the record that shows it; or open, with what would settle it. Researchers at the Georgia Institute of Technology who built ban evasion classifiers for Wikipedia put the limit plainly: "moderators cannot penalize someone purely based on suspicion of ban evasion".

People who come back often keep a name they like. In the Georgia Tech study of 8,551 pairs of banned Wikipedia accounts and the evasion accounts that followed them, usernames within a pair were more similar than in matched pairs of unrelated accounts, and "a considerable number of users form evasion accounts soon after the initial ban with a similar username." The evasion accounts that outlasted the accounts they replaced had less similar names, so a new name clears nobody.

Weigh a similar name by how unusual it is. A 2011 study of usernames found that predictable ones are more likely to be picked by several people, while unusual ones "refer in the vast majority of the cases to unique users." An essay on the signs of sockpuppetry that Wikipedia editors maintain says two names sharing a word are unlikely to be one person unless the word is rare and the newer account appeared soon after the older one. Sixtyfour searches for the new handle and the banned one across other platforms, forums and archived pages, and cites the page behind each appearance it finds.

Email addresses can say more than handles, because fewer people see them. Researchers at Stanford and the University of Maryland who studied sockpuppets in nine discussion communities found that the part of the address before the @ was 50 percent more similar between sockpuppets than between ordinary accounts, against 25 percent for public display names. They suggested sockpuppets put "less effort into picking unique email addresses, which are private-facing and less likely to be noticed."

Normalise before you compare. Gmail ignores dots in its addresses and delivers mail sent to name+anything to the same inbox, though dots do count in work and school addresses that Google hosts. Then compare the pattern: the same name with a new number, the same handle with the same city suffix, the same provider. That comparison is your own check. Sixtyfour researches each address across public sources and returns the person and the pages it leads to, so you can see whether the new address points back to the banned user.

A phone number carries two traces. The first is where it came from. In the US, the North American Numbering Plan Administrator, NANPA, assigns numbers to providers in thousands-blocks where pooling is in place, a thousand numbers sharing their first seven digits, and interconnected VoIP providers are among the companies that can request them directly. Two numbers from one block come from a range assigned to one provider. That is a weak link, since a block serves many customers, and it counts for more when the provider holding the block is an internet phone provider.

The second is the kind of line. Internet phone and app-issued numbers suit an account meant to be thrown away, and many honest people use them. The FBI notes that in text-message phishing, malicious actors "typically use software to generate phone numbers that are not attributed to a specific mobile phone or subscriber." Both are checks your analyst makes by hand: the block from the first seven digits and public numbering data, and the line type from the current carrier lookup our phone guide describes. Sixtyfour's part is the number's public footprint: it returns the person behind each number and the people linked to it in public records, and cites the pages where the number appears.

Run the new account's photos through a reverse image search yourself: a search engine's search by image can return "Websites with the image or a similar image". A personal photo that first appeared on the banned account, such as the same desk or product shot, is a medium link, and a stock image links nothing.

Compare bios, listing text and messages for unusual phrases, repeated errors and the same structure. The Georgia Tech researchers found that the text evasion accounts added was closer to their banned accounts' text than in matched pairs. The Wikipedia essay adds a caution: "it is not uncommon for people to learn from the writing styles of others." A copied sentence supports a link and rarely carries one, because anyone who read the banned account could copy it. Comparing the text stays with your reviewer, and Sixtyfour returns the public profiles and posts it finds for each identifier, so you can see whether the same text appears elsewhere.

The strongest evidence is a public record that ties the new account to the banned user without resting on anything the new account says about itself: the new email address on a page the banned person controls, a forum profile that links both handles, the new number in an older post signed with the banned account's handle. Each connects two accounts that may share nothing on your platform.

This is the step Sixtyfour is built for. From each identifier it traces the accounts and records tied to it, works out which belong to the same person, and does the same from the banned account's details, so you can see whether both lead to one identity. Each finding comes with its source, and with confidence scoring on, each field you asked for carries a score. In the docs' words, "A high score means the evidence chain is strong; a low score means attribution is uncertain." Keep the result to what the decision needs: whether the new account is the banned user.

Timing is a check you make yourself, against the date of the ban, and it cuts both ways. In the Georgia Tech study the evasion account was created a median of about four days and 20 hours after the ban, with a standard deviation of 255 days, so many come back within a week and some wait far longer. A long gap does not rule evasion out, and an account opened before the ban can still be within scope under rules like Discord's.

Check whether the return was allowed. In October 2025 YouTube started a pilot letting some terminated creators request a new channel, though they "are not eligible to apply for a new channel until one year after their channel was terminated", and a user who returns with your platform's permission is not evading anything.

Write the decision so that someone who was not there can check it. For each link, record the two values compared, where each came from and when, how unusual the value is, and which other links it depends on. Two links from one fact count once: a bio sentence and a photo copied from the same old listing are one observation.

Set the threshold in advance. A sound one treats the account as the banned user when at least two strong, independent links agree, such as a public record tying the new email address to the banned person and a personal photo first used on the banned account. One strong link with weak support is a reason to look further or to hold the account for review. A shared surname, city or interest is context.

Record what is open and which innocent explanation you checked, then write the notice as if you will have to defend it. The Santa Clara Principles, whose current version was drawn up by a coalition of organisations, advocates and academic experts, ask that a notice name "The specific clause of the guidelines" behind the action, and that an appeal include "Human review by a person or panel of persons who were not involved in the initial decision." Some appeals succeed: in the second half of 2025, Reddit's admins received 77,380 appeals against account-level actions for ban evasion, and 2.9 percent of them resulted in a reversal of action, according to the appeals chart in Reddit's transparency report.

These are common false matches, and each has a test.

• A sibling or other relative. Families share surnames, towns, interests and sometimes photos. Wikipedia's sockpuppetry policy warns that when family members, roommates or co-workers share a computer, their accounts "risk being accused of sockpuppetry". The test is whether the new account has its own history, with its own email address, photos and public footprint from before the ban. A shared surname tells you two accounts may belong to one family, and nothing about which member of it you banned.
• A shared household. People who live together share an address and family photos, and some share accounts. Look for the traits that belong to one person rather than to the home, such as a personal handle, a writing voice or an address pattern.
• A common name. In the 2020 Census, 11 last names were each reported more than a million times, and 258 last names covered a quarter of the population, according to a Census Bureau brief published in April 2026. A name match needs a second detail that does not depend on the name.
• A copycat. Someone who admired or resented the banned account can copy its bio, its handle style or its photos, so copied material needs a second link that a stranger could not have made.

When the evidence shows a different person, say so in the file and take no action against them for the relationship.

The case is a composite. Gorrimere, Reid Gethwick, Mira Gethwick and the handles aperturewren and brasshood_glass are invented. Domains use the .example names reserved for documentation, example.com stands for a large free mail provider, and the phone numbers come from the fictitious 555-0100 to 555-0199 range reserved for entertainment and advertising.

Gorrimere runs a marketplace for used camera gear at gorrimere.example. In August 2026 it permanently banned the seller aperturewren for taking deposits on lenses it never shipped. The account used aperturewren.pdx@example.com and +1 503 555 0147, and its bio read "Every lens cleaned, tested and boxed by hand." Within three weeks two new Portland sellers list in the same category, and the review queue flags both.

The first, brasshood_glass, opened 11 days after the ban. Its handle shares nothing with the banned one. The reviewer's own comparison finds that its address, brasshood.pdx@example.com, follows the banned account's pattern at the same provider, that its number, +1 503 555 0162, sits in the same thousands-block, and that its bio repeats the banned account's sentence word for word. It asks for deposits before shipping, as aperturewren did.

The reviewer gives Sixtyfour the new account's handle, address and number, describes aperturewren in the research plan, and asks for one field: whether this is the same person as the seller aperturewren. Sixtyfour returns three findings, each with its source. A public photography forum has carried an aperturewren profile since 2019, with the same bio sentence in its signature and a link to a lens repair page at reidgethwick.example under the name Reid Gethwick. The new address is the contact on a June 2026 classified ad for lens servicing, signed Reid G., with a photo of a lens on a walnut bench. And the new number appears in a March 2026 post by that forum profile, offering a lens for local pickup. It reports one thing as open: the handle brasshood_glass appears nowhere else it searched. Its answer to the field is yes, with a high confidence score and a justification citing the ad and the forum post.

The reviewer finds the walnut bench photo, by image search, in a 2023 post by the same forum profile. Two strong, independent links now tie the new account to that profile: its address on an ad signed Reid G. that carries a photo the profile posted in 2023, and its number in the profile's own post. Both run through the forum profile, so the file also records why that profile is the banned seller's: the same unusual handle and the same bio sentence since 2019. The address pattern, the number block, the timing and the deposits are support. The team acts under Gorrimere's ban evasion rule. The file lists each link with its source and date, and the open handle search, and the notice names the rule and an appeal route to a reviewer who was not involved.

The second, mira_gethwick, opened 16 days after the ban and sells film cameras, and its surname matches the name Sixtyfour found. Its address is name-based at a different provider, its number, +1 971 555 0118, is in another block, and its photos are its own. Given its handle and address, Sixtyfour returns a portfolio site under Mira Gethwick's name with work from 2018, her own forum account with posts since 2020, and a 2021 camera club page listing Mira and Reid Gethwick as volunteers. Nothing ties her address, number or photos to aperturewren, and Sixtyfour's answer to the same field is no, citing her separate history.

The club page shows the two know each other and may be related, and the file records that as context only. Mira's account stays open and nobody contacts her about Reid. Sixtyfour found the records and scored its answer for each account, and the call on both accounts stayed with Gorrimere's team.

• A clean break. A new handle style, a new email provider, a number from elsewhere and no reused photos or text leave nothing to compare, and the Georgia Tech researchers found that evasion accounts which outlasted their banned accounts used less similar names and more restrained language.
• Accounts prepared in advance. An account opened or bought before the ban has no timing link.
• Borrowed identities. A relative's name, a stranger's photo or a recycled number can point the evidence at someone innocent, sometimes by design.

The links that hold up best are the ones the person had to keep using, such as an inbox, a long-lived handle or a page they still control.

Most of what makes a new account look like a returning user has an ordinary explanation, and a fair review rules it out first.

• Many people run more than one account honestly. Wikipedia's essay says "Anyone who uses multiple accounts in good faith is not violating any policies and shall face no action".
• Some returns are permitted, such as the new channels some terminated creators can request a year on under YouTube's 2025 pilot.
• The original ban may have been wrong. YouTube says "The majority of appealed decisions are upheld", which means some are not.
• Phone numbers are recycled, so old public records attached to the new account's number may belong to an earlier holder, as our phone guide explains.

So keep the levels apart. A lead is a reason to look further, a link is a specific, dated connection with a source, and a finding that the new account is the banned user needs at least two strong, independent links. In the words of Wikipedia's essay, the possible signs are many, "But none of them are absolute proof sockpuppetry is occurring."

Compare the new account with the banned one on the traces people carry between accounts: handle and email patterns, the phone number's block and line type, photos, bios and writing, and timing against the ban. Check whether both lead to the same person in public records, weigh each link by how rare and independent it is, and decide only when two strong links agree. Rule out the sibling, the housemate and the common name, write down what is open, and give the person a route to appeal. Sixtyfour does the public research from the new account's handle, email address or phone number and returns each link to the banned account with its source, so your reviewer decides from evidence they can check.