Contests and duplicate profiles: detecting fraud without blocking families

Why duplicate profiles really cost brands dearly

An entrant who signs up 50 times with variations of email and phone number artificially multiplies their chances of winning. For brands, this means a drastic reduction in the return on investment of the contest: instead of 10,000 real entrants, you have 2,000, but 8,000 fictitious records that skew your lists, consume your prize budgets and pollute your engagement metrics. Yet the difficulty lies in the critical distinction: a couple sharing the same IP address, a mother registering her three children, or two roommates at the same address are not fraudsters, but legitimate situations that must not be penalized.

How to identify real fraud patterns

What signals indicate fraudulent duplication?

Duplicate fraud generally follows identifiable patterns. The IP address is the first signal: if 15 accounts are created in less than an hour from the same IP address, that is a strong indicator. However, the same IP address may be shared by an entire family, a company or a collective building—so it is never absolute proof. Registration timing reinforces the diagnosis: automated account creations occur at regular intervals (every 2 seconds), whereas different entrants naturally sign up over several days or weeks. Identity data offers other leads: different names but minor variations (Jean_Martin, jean.martin, jmartin123), sequential phone numbers or ones all sharing the same first 6 digits, emails of the type "participant1@temp.com, participant2@temp.com" reveal script generation.

Which legitimate cases must absolutely not be penalized?

Multigenerational or sibling households often share a home connection. Two adults living together will very likely have the same public IP address. A mother registering her three minor children will have the same phone number and identical postal address. A grandparent registering their grandchildren will show an age gap, but the same geographic location. These scenarios must never be flagged as fraud on the basis of a shared IP or shared address. This is why the criteria must be cumulative, not isolated: a single signal (shared IP) does not disqualify, but the combination of three to five signals (IP + regular timing + generated emails + similar names + sequential phone) creates a fraud probability score.

Ethical detection tools and techniques

Which indicators should be combined for a reliable diagnosis?

Build a multi-criteria risk score rather than relying on a single rule. Assign points for each element: IP address shared by more than 3 accounts (+2 points), 5 accounts or more (+4 points); abnormal registration timing (+3 points per account created at a regular interval); generic or temporary email format (+2 points); phone number with the same 6-digit prefix (+2 points); GPS location data offset but identical postal addresses (0 points—these may be normal movements). Set a disqualification threshold starting at 8-10 points, not below. Accounts between 5 and 8 points deserve manual review by a human team before any action.

Which technical tools can help without excessive cost?

A basic system requires the systematic recording of: the creation IP address, the browser user-agent, the exact timestamp, the approximate geolocation (no need for meter-level precision), the email domain. This data is stored centrally. You can then write simple SQL queries to identify clusters (SELECT * WHERE ip_address = X AND created_at BETWEEN Y AND Z). Open-source solutions such as MaxMind GeoIP or your platform's internal API are enough to verify geographic location. If you use a contest platform (such as makecontest.io or equivalent), check whether the tool already offers native duplicate detection or an enriched data export so you can analyze it yourself. Avoid buying overly expensive external services if your volume is not massive.

When should manual verification be set up?

Beyond a numerical score, human review is essential for accounts in the gray zone. A dedicated team must check: is the data consistent (same person or different people)? Are the names obvious variations of the same individual? Does the postal address reveal a family (same surname) or strangers? For suspicious legitimate entries (couple, parents), contact the entrant directly and ask for a simple confirmation (phone number verification, email confirmation) before disqualifying.

Drafting rules that protect without creating disputes

What is a legal and effective anti-duplicate clause?

Your rules must be explicit from the start. Recommended wording: "Each natural person may enter the contest only once. Multiple entries made from the same user account, the same device, the same IP address or with fraudulent personal data will be detected and all accounts concerned may be disqualified. Cases where several members of the same family or household ask to enter via separate accounts will be assessed individually; proof of family relationship or shared residence may be requested."

This wording:

• Clearly states the rule (one person = one entry)
• Specifies the detection methods (IP, device, fraudulent data)
• Explicitly mentions the risk of disqualification
• Opens a door to legitimate cases through verification
• Remains accessible and understandable to all

How to handle GDPR during a disqualification?

You have the right to store IP addresses, user-agents and location data for the duration of the contest and for 30 days after it closes (for appeals/recourse). Mention this in your privacy policy: "We collect your IP address, your approximate location and technical data to prevent fraud and guarantee the fairness of the contest. This data is deleted 30 days after the end of the campaign, unless a disqualification must be justified."

When you disqualify an account, you must be able to document your decision: list the concrete signals detected (do not say "suspected fraud", but "5 accounts created in 3 minutes from the same IP + emails of the same format"). If the entrant disputes it, this documentation protects you. Important: never use anti-fraud detection to collect data beyond this specific need, nor to resell or share it without consent.

Best practices for managing false positives

What should you do if you identify legitimate entrants as fraudsters?

The best defense is a clear and transparent process. Before any definitive disqualification, impose a verification step on yourself. Contact the entrant via the indicated channel (email, SMS) explaining the anomalies detected ("several accounts associated with your address") without accusing them directly. Ask for a simple confirmation: "Do you confirm that you are the only person holding this account?" or "Who else in your family is entering from the same address?". Offer a low-friction verification: code received by SMS, answer to a previously recorded security question.

How to prioritize your efforts according to your entrant volume?

If your contest has fewer than 5,000 entrants: manually inspect the 50 accounts with the highest risk score. The human cost remains acceptable and you limit false positives. Between 5,000 and 50,000 entrants: automate the scoring, but manually analyze the 1-2% most suspicious accounts. Above 50,000: use a platform with native detection (makecontest.io offers anti-fraud tools), or engage a specialized service. For small volumes, manual rigor beats technological sophistication.

Concrete case studies: telling fraud from legitimacy

Scenario 1: Same IP address, fast timing

Situation: 8 accounts created in 4 minutes from IP 192.168.1.1 with names "Participant_1" to "Participant_8" and emails participant1@tempmail.com to participant8@tempmail.com. Diagnosis: Score of 12 points (shared IP +4, regular timing +4, generated emails +4). Action: Disqualify the whole set. This pattern leaves no doubt about automated mass creation.

Scenario 2: Same IP address, normal timing, varying data

Situation: 3 accounts over one week from the same IP (house with shared wifi), names "Marie Dupont", "Pierre Dupont", "Thomas Dupont", varied emails (m.dupont@yahoo.fr, pdupont.contact@gmail.com, t.dupont98@hotmail.fr), same phone number (06 12 34 56 78) for the first two and a different number for the third. Diagnosis: Score of 3 points (shared IP +2, different emails -1, similar but justifiable names +2). Action: Manual verification. Ask for confirmation: "Are you a family sharing the home wifi?". If yes and if the names match (verify via ID document or postal address), validate all the accounts.

Scenario 3: No shared IP, but suspicious data

Situation: Two accounts with completely different IPs (one in France, the other in Belgium), created 2 days apart, names "Jean Martin" and "Jean.Martin", same phone number (06 12 34 56 78) but different email. Diagnosis: Score of 4 points (similar data +2, shared number +2, but different IPs lower the suspicion). Action: Possible legitimate travel (remote work, vacation) or remote fraud. Ask for proof: "Confirm that you are the only person using the number 06 12 34 56 78" or a light identity verification.

Summary of the critical points to remember

An effective anti-duplicate strategy rests on three pillars. First, never rely on a single indicator: IPs, names and emails must converge toward a diagnosis before you act. Second, leave room for legitimacy: families, couples and roommates have the right to enter, each with their own account. Third, document everything: every disqualification must be based on concrete and reproducible signals to protect you in the event of an appeal.

The right balance consists of automating detection to identify obviously fraudulent patterns, while reserving human judgment for borderline cases. Clear contest rules, a transparent privacy policy and an accessible appeals process minimize disputes and maintain the trust of legitimate entrants. The cost of a few manual verifications is infinitesimal compared with that of falsely disqualifying a customer or a GDPR controversy.