To link related accounts, list every value the accounts share, weigh each shared value by how many other accounts on your platform also have it, and count only links that come from independent evidence. A payout account shared by two accounts is a strong link. An IP address shared with thousands of other users is barely a link at all. Treat a set of accounts as one operator when at least two strong, independent links agree, and keep everything weaker as a lead.
Common linking mistakes come from skipping one of those steps: a cluster built on a busy IP address, a ban that swept up someone's flatmate, a "ring" that turned out to be one university library.
What linking is for
Much of the abuse that costs a platform money runs on more than one account. A banned seller comes back under a new name. One person claims a sign-up promotion forty times. A group of accounts reviews each other's listings, or passes money around until one of them cashes out. Handled one account at a time, each of these becomes a queue that never empties, because the operator opens the next account.
Linking moves the unit of work from the account to the person or group behind it. It also raises the cost of getting it wrong. A false link punishes someone for another person's behaviour, and they rarely find out why.
The signals, and what each one proves
| Shared value | Why it links accounts | Common innocent reasons | Starting weight |
|---|---|---|---|
| Payout bank account or card | The money has to reach someone | Family members, a small business paying out to one account | Strong |
| Verified phone number | Verification needed the number at that moment | Recycled numbers, a shared family phone | Strong when the dates are close |
| Email address, after normalising | One inbox receives both accounts' mail | Shared family or business inboxes | Strong |
| Profile or listing photo | The same file was uploaded twice | Stock images, copied listings, and photos taken from someone else | Medium, and it never links the person pictured |
| Device identifier or fingerprint | The same machine was used | Shared household devices, public computers, very common configurations | Medium |
| Distinctive username or naming pattern | People reuse handles | Common words and first names | Weak to medium, depending on rarity |
| IP address | The same network was used | Mobile networks, shared carrier addresses, offices, public wifi, VPNs | Weak |
| Timing and behaviour | The same habits | Time zones and ordinary routines | Weak alone, useful as support |
Normalise identifiers before comparing them. Gmail ignores dots in Gmail addresses and delivers mail sent to name+anything to the same inbox, so one person's accounts can look like several until the addresses are normalised. The dot rule only covers consumer Gmail addresses, though. Dots do matter in work and school addresses hosted by Google, so normalising every Google-hosted domain the same way creates false links.
Treat the weight column as a starting point. Three things move it: how rare the value is, whether the link is independent of the others, and when each account used it.
Rarity sets the weight
A shared value links two accounts in proportion to how few other accounts share it. So before drawing a line between two accounts, count how many accounts on your platform have that value. Call it the fan-out.
Start with IP addresses. An IETF document on carrier-grade NAT defines it as a way to share the same IPv4 address among several subscribers, and a 2016 measurement study found it in more than 90 percent of the cellular networks it examined. Another IETF document, on the problems address sharing causes, states the consequence: an address and a time are not enough to identify one subscriber when the address is shared. Researchers who studied sockpuppets in online discussion communities removed the most heavily used IP addresses before they started, because the accounts behind them may simply have been sitting behind a country-wide proxy or an intranet.
Device fingerprints are more distinctive than IP addresses, but less so than their reputation suggests. According to a survey of browser fingerprinting research, the early studies that found more than 80 percent of browsers unique drew on privacy-conscious volunteers, while a 2018 study of about two million fingerprints collected on one of the top 15 French websites found only 33.6 percent unique, and 18.5 percent on mobile. Fingerprints also drift: in one long-running study, nearly half had changed at least once after a single day.
Record linkage weighs agreement by rarity. The model Ivan Fellegi and Alan Sunter formalised in 1969, which a US Census Bureau research report on record linkage starts from, scores a pair of records by how likely its pattern of agreement is among true matches compared with non-matches, and can weight agreement on a name by how common that name is. It also sorts pairs into three groups rather than two: matches, non-matches, and possible matches held for a person to review. A shared surname of Smith tells you less than a shared surname of Tarvelle, and a shared IP address tells you less than a shared payout account, for the same reason. Usernames follow the same rule. In a 2011 study of linking usernames, johnsmith and johnsmith82 were too common to link despite looking alike, while daniele.perito and d.perito could be linked despite looking less alike.
So record the fan-out beside every link. A value shared by two accounts is evidence. A value shared by two thousand is background.
Two links from one fact count once
Links only add up when they come from independent evidence. The same IP address and the same city are one observation, because the city came from the IP address. A shared email address and a username copied from its first half, such as jsmith82@ and @jsmith82, are one observation too, because one was made from the other.
For each new link, ask whether it would still be true if the first link turned out to be a coincidence. If a flatmate explains the shared IP address, the same flatmate probably explains the shared device fingerprint. A shared payout account is less exposed, because a flatmate rarely shares a bank account, though a family member might.
When each account used it
Every link has a date, and the date changes what it means. Two accounts on one IP address in the same hour are a different finding from two accounts that used it eleven months apart.
Phone numbers need particular care. Princeton researchers who studied number recycling cite an FCC estimate that around 35 million US phone numbers are disconnected and placed back in the pool every year. When they sampled 259 numbers available to new subscribers at two major carriers, 171 were still tied to existing accounts at popular websites. A number that verified one account in 2019 and another in 2025 may have belonged to two different people.
Activity timing can support a link, though it rarely proves one alone. The sockpuppet study above combined it with network data to identify likely sockpuppets: posts from the same IP address, in the same discussion, within 15 minutes of each other, in at least three different discussions.
Creation order carries information as well. A new account that appears the day after a ban, from the banned account's device, is the pattern ban evasion leaves. Two accounts that have sat quietly on the same home connection for five years are more likely to be a couple.
Reading a cluster fairly
Many of the false links a platform will draw come from a short list of ordinary situations.
Households, shared flats, offices and student halls put many real people on one connection, and often on one device. People share accounts too. In a 2016 Pew Research Center survey, 41 percent of American online adults said they had shared the password to one of their accounts with friends or family, and in a 2013 survey, 27 percent of internet users who were married or in a committed relationship shared an email account with their partner.
Mobile networks, and some home broadband providers, put unrelated customers behind the same public address, so a shared IP address from a carrier range says very little.
People use VPNs for privacy, travel and work, and a popular VPN exit address is shared by strangers all over the world.
Recycled phone numbers connect a new owner to an old owner's accounts.
A stolen photo links the accounts of whoever uploaded it. The person in the picture is usually a victim, and treating them as part of the cluster turns the victim into a suspect.
An account takeover is the hardest case. A hijacked account starts to share devices and networks with the attacker's other accounts, but its original owner did nothing wrong. When an old, quiet account suddenly joins a cluster, look for a password reset, a new email address or a first login from a new device before you act on it.
Wikipedia, which runs its sockpuppet investigations in public, is careful about the same thing. Its CheckUser policy says the tool "is not magic wiki pixie dust", and adds: "An editing pattern match is the important thing; the IP match is really just extra evidence (or not)." Its sockpuppetry policy warns that people who use the same computer or network connection risk being accused of running each other's accounts.
One cluster, worked through
This case is a composite, and every account in it is invented.
A marketplace bans a trading-card seller for shipping counterfeits. Over the next three weeks, four new seller accounts register in the same category.
Account A pays out to the same bank account as the banned seller, and only these two accounts have ever used it. A's first login, the morning after the ban, also came from the banned seller's device. Only three accounts have ever used that device, and the third is account D. At a fan-out of three, a link the table starts at medium counts as strong here. A household could explain a shared bank account and a shared device, but not a new seller account that opens on that device the morning after the ban and sells the same cards. A has two strong links, independent of each other.
Account B shares a device fingerprint with a second phone that account A logs in from. That fingerprint also matches 38 other accounts, because it belongs to a popular phone model with default settings, and B shares nothing else. B stays unlinked, and the fingerprint is kept as a lead.
Account C used the same IP address as the banned seller. The address belongs to a mobile carrier and appeared on thousands of accounts that month, so it is not a link.
Account D lists twelve product photos that are byte-identical to the banned seller's old listings. On its own that could be a copycat lifting someone else's images, so it counts as support rather than as a link. D has two strong ones. It logged in from the banned seller's device, the one only three accounts have used. And its verified phone number, which no other account uses, appears in a trading-card classified ad posted a month before the ban and signed with the banned seller's username. That username is unusual, and no one else on the classifieds site uses it, so the ad ties D's number to the banned seller.
So A and D go to review together as the same operator as the banned seller, with every link and its fan-out attached. B and C stay unlinked, and the file says why.
Where the platform's data stops
Apart from D's classified ad, everything so far uses signals your platform collected itself. They answer one question well: which accounts here share money, devices, numbers and networks. They cannot tell you who is behind a cluster, or whether the same person runs accounts on other platforms.
Both questions are answered outside your systems. The handle from a banned account turns up on a forum. The phone number on a new seller's listings appears in older ads with a name attached. An email address sits in a breach record next to a username used on other sites. Each of these connects accounts that share nothing inside your platform, and each needs the same discipline: how rare is the shared value, and is it independent of the other links.
Our guide to investigating an email address goes further into tracing one identifier off-platform.
Writing the link down
Write each link down as you make it, so someone else can check it later and it can be undone cleanly if it turns out to be wrong. For each one, record the shared value, its type, when each account used it, its fan-out, and which other links it depends on.
Then match the action to the evidence. A cluster held together by strong, independent links can support a ban. A cluster held together by weak ones supports a step-up check, a limit, or a closer look. Keep actions reversible where you can, and let a person make the final call.
Where Sixtyfour comes in
Your platform holds the device, network and payment data, and linking on those belongs in your own systems. Sixtyfour works on the half that lives outside them. Starting from an account's email address, phone number, username or name, the agent traces where each identifier appears across public sources, works out which of those appearances belong to the same person, and reports every link with its source and the reason it believes the link holds. Anything it could not establish is reported as open. The results come back to your team, and a person decides what happens next. There is more on how trust and safety teams use it on our trust and safety page.