Different cards, same device: investigating related new accounts

Explore checkers, demos and evaluation routes →

Different payment cards do not erase a device relationship between accounts. A shared device also does not establish that the accounts belong to one physical person or are all fraudulent. Investigate the relationship, the permitted account behavior and the action taken as separate questions.

Identify what actually matched

A device identifier, visitor identity, cookie, IP address, payment instrument and user account are different entities. Record which one matched and over what observation window. An office IP match is not the same finding as a stable device relationship across several known registrations.

Check whether the correct session was associated with the correct account. A stale identifier carried into the wrong signup can create a misleading link. Look at the timing and available history before attributing the relationship to customer behavior.

Apply the actual account and benefit rules

A household may be allowed several accounts while one promotional reward is limited per household. Another service may permit distinct adult customers on shared hardware. A team account can involve several authorized users. Those policies produce different legitimate outcomes.

Do not silently change “one account” into “one person” after a customer has qualified. If the concern is repeated welcome benefits, inspect the benefit history. If the concern is stolen payment instruments, use the payment workflow. If the concern is automated account creation, inspect the relevant session and request evidence.

Use several layers without duplicating their conclusions

ShieldLabs combines device/network corroboration and account-abuse context. Persona’s passive signals include related users, devices and IPs, while Sardine describes investigation across users, devices, accounts and transactions.

Ask what relationship the product returns, when it becomes available and which reasons a reviewer can inspect. A product’s risk score and a linked-account count need not mean the same thing. Avoid claiming that a new device or a new card proves the absence of coordination.

Keep legitimate shared use in the evaluation

Include family computers, workplace hardware, campus networks, accessibility-assisted sessions and genuine customers replacing a device. For each case, establish permitted ownership and eligibility facts independently of the detector you are evaluating.

Do not use “passed email verification” as a universal legitimate label. It establishes inbox access. Do not use “charged back” as a universal fake-account label either: payment disputes have several causes. An applicant who abandons a verification step remains an unresolved outcome until the evidence supports a more specific conclusion.

Measure classification and customer impact separately

Record whether the relationship was correct, whether the behavior violated the rule and whether the chosen action was appropriate. A correctly linked household can still be wrongly restricted. An incorrect device merge can occur even if a later manual review releases the account.

Report known legitimate accounts restricted, confirmed abusive accounts allowed, unresolved cases and missing evidence with explicit denominators. Measure review time and legitimate completion after step-up. A high number of linked accounts is not a count of confirmed fraud prevented.

Give reviewers a usable case

Keep the account and event references, the relevant rule, relationship evidence and current activation or reward state. Preserve enough history to understand why the account was held and what later changed. Give the customer an appropriate correction route without exposing private risk-system details or another customer’s information.

A broad device allowlist can hide repeated abuse if it ignores account actions. A blanket device ban can exclude an entire family. Fix the mechanism that produced the error, then rerun known cases after changing collection, account association or the promotion rule.

FAQ

Sources

Checked October 21, 2026: ShieldLabs, Persona passive signals, Sardine device and behavior, Stripe evaluation guide. Use the buying checklist and alternatives.