Protect Product / Research deskFraud prevention software field guide · October 2026
Protect Product

Protect Product / Field guide

Ban evasion detection: evidence and device ban limits

Ban evasion detection helps a platform evaluate whether new activity is connected to an earlier restricted account and violates its rules. A device ban is one possible enforcement measure, not proof of a person’s identity. Useful detection needs a defensible original restriction, reviewable relationship evidence and a recovery path for legitimate shared environments.

Published 4 min read
Protect Product editorial guide: Ban evasion detection: evidence and device ban limits

Read this article with AI

Copy the article text into your chosen tool to inspect its sources and trade-offs.

Preserve the reason for the original restriction

A new-account relationship is difficult to interpret if the earlier ban has no reliable policy reference. Record the affected account, rule, scope, start time and whether the restriction was temporary or permanent. Include corrections and successful appeals.

Decide what the restriction applies to. It might concern a specific feature, community, business entity or account. Expanding it to every related customer is another policy decision, not an automatic consequence of a device observation.

The multi-accounting guide explains the relationship evidence. This article concerns the additional step of connecting that evidence to a prior enforcement action.

Connect enforcement to a documented violation and review route.
Editorial model. Connect enforcement to a documented violation and review route. Original illustration; no vendor performance is measured.

Distinguish account, session and device restrictions

Restriction What it targets Important limitation
Account restriction A known account and its permissions A new account is a separate record to investigate
Session restriction Current authenticated access Other sessions and recovery routes need their own handling
Device-context restriction An observed environment A shared environment can contain legitimate users
Network restriction Traffic from a source or range Shared and changing networks can affect unrelated customers

Use the narrowest response that meets the policy’s purpose. A platform can preserve access to support or an appeal route even when another capability is restricted. Document those routes rather than leaving them to ad hoc exceptions.

Treat device evidence as a relationship input

A browser or device observation describes a technical environment. It does not establish a legal identity, and its persistence depends on the implementation and supported platform. W3C’s fingerprinting guidance also explains why browser features and protections can affect the information exposed to a site.

For a hypothetical gaming community, two family members might use one console or computer. A relationship to an earlier restricted account deserves review, but it does not settle which member performed a later action. Keep the policy facts and the device relationship separate.

Avoid promising that a device ban is permanent in every environment. The browser fingerprinting article explains what environment observations can and cannot establish.

Build a moderation case rather than a label

An investigation should show the original restriction, relevant new activity, relationship evidence and reason the new action is ineligible. Preserve event time and the policy version. If a relationship is uncertain, record that uncertainty.

Give moderators a defined set of responses. Examples include reviewing a feature request, holding a disputed benefit or escalating a relationship for investigation. The same evidence need not justify closing every related account.

Keep access to sensitive observations limited. A public moderation explanation can describe the rule and appeal process without exposing unrelated customer information or internal collection details.

Include shared devices, transferred equipment, teams on one network and corrected original bans in the test plan. Decide expected outcomes before asking a vendor to demonstrate detection. Inspect how the system updates when an appeal changes the status of the original account.

Also test timing. A relationship created after a restriction expires may require a different response from activity during the restricted period. A late event should not silently recreate a decision that a moderator has already reversed.

For signup or promotion restrictions, connect the case to the fake-account guide and trial-eligibility controls. A ban-evasion label should not replace the actual eligibility rule.

Measure enforcement with its correction cost

Track confirmed violations, legitimate accounts affected, appeal outcomes and time to correction. Compare moderators’ agreement on reviewed cases. An increasing count of linked accounts does not establish that enforcement is more accurate.

Review whether a restriction prevents the relevant harm or merely moves activity to another route. Keep the account model and customer experience involved in that review. The false-positive guide helps define the denominator for mistaken restrictions.

Legal treatment and platform rules differ by context. This article explains a technical and operational workflow; it does not make a universal claim that creating another account is unlawful.

FAQ

What does a device ban mean?

It means the service applies a restriction using an observed device or environment relationship. The exact scope depends on the platform’s implementation and rules.

Is a matching device enough to establish evasion?

It is evidence to evaluate. Shared devices and corrected restrictions are examples where the relationship needs more context.

Does this guide explain how to bypass a ban?

No. It covers authorized platform detection, fair enforcement and correction of mistaken relationships.

Sources

Editorial basis: primary-source documentation and a practical evaluation framework. Examples are hypothetical unless explicitly identified otherwise. This article does not report an independent vendor benchmark.

For evaluation standards and corrections, see our methodology and contact page.