New Account Fraud (Fake Signups)

<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  const form = document.getElementById('signup-form');

  // onInitialized fires when the check starts, before the snippet sends it.
  // Start the fresh identification when the form comes into use, so it is sent
  // while the user fills the form, and let the form submit normally.
  const identify = () => {
    // The account does not exist yet.
    mod.forceCheckAnonymous({
      onInitialized: (result) => {
        if (result.status === 'initialized') {
          document.getElementById('shieldlabs-request-id').value = result.requestID;
        }
      },
    });
  };
  if (form.contains(document.activeElement)) identify(); // already focused (autofocus)
  else form.addEventListener('focusin', identify, { once: true });
</script>

<form id="signup-form" method="POST" action="/api/signup">
  <input type="hidden" id="shieldlabs-request-id" name="shieldlabsRequestId" />
  <input type="email" name="email" placeholder="Email" />
  <input type="password" name="password" placeholder="Password" />
  <button type="submit">Create account</button>
</form>

app.post('/api/signup', async (req, res) => {
  const { email, password, shieldlabsRequestId } = req.body;

  // 1. Your normal validation first.
  if (await emailExists(email)) {
    return res.status(409).json({ error: 'Email already in use' });
  }

  // 2. The guard. A signup is a guest flow, so there is no User HID to match yet.
  const risk = await waitForScore(shieldlabsRequestId, 2000);
  if (!risk) {
    return res.status(200).json({ requireVerification: true, reason: 'no_identification' });
  }
  if (risk.risk_score > 100 || risk.device_id === NIL_DEVICE) {
    // The 999 rate-limit marker, or no usable device signals: review, never allow.
    return res.status(200).json({ requireVerification: true, reason: 'unverified_device' });
  }
  const flags = risk.detection_flags ?? {}; // booleans for quick branching

  // 3. Map the score to a band and choose the action.
  if (band(risk.risk_score) === 'Dangerous') {
    // Strong risk signals. Require email + a second factor.
    return res.status(200).json({ requireVerification: true, reason: 'extra_verification' });
  }
  if (band(risk.risk_score) === 'Suspicious') {
    // Email-verify before activating.
    return createPendingAccount(email, password, res);
  }

  // Trusted: create the account normally.
  return createAccount(email, password, res);
});

// Devices linked to users with a Multi-accounting event, recorded when it arrives
// through the API or webhooks or when you review it in the analytics dashboard
// (your own store), plus a live account count per device.
const watchedDevices = await loadWatchedDeviceIds();

async function deviceIsKnownFarm(deviceId) {
  if (watchedDevices.has(deviceId)) return true;
  const accounts = await accountsBehindDevice(deviceId).catch(() => null);
  if (accounts === null) return true; // a failed History read is unverified: verify the signup
  return accounts >= YOUR_ACCOUNT_LIMIT;
}

app.post('/api/signup', async (req, res) => {
  // ... validation, the guard and the Risk Score check above ...

  if (await deviceIsKnownFarm(risk.device_id)) {
    return res.status(200).json({
      requireVerification: true,
      reason: 'device_linked_to_many_accounts',
    });
  }

  return createAccount(email, password, res);
});