How to prevent abuse of the account/password-based signup

Get Help
,
1

I keep running into those users -
who mass-register accounts in every possible way.

It’s honestly getting exhausting.
Has anyone dealt with this before using auth0 or something similar?

email email_verified provider
sdfsdsfsdf@gmail.com FALSE auth0
sdfasdf@gmail.com FALSE auth0
xxxsdfasdfsd@gmail.com FALSE auth0

4

Hi @wuxinhua.cn

I am sorry about the delayed response to your topic!

Since these email addresses appear be to be potential bots mass registering in your application you can:

  • Enable Bot Detection - Dashboard → Security → Attack Protection → Bot Detection. This forcers a captcha challenge when the system detects suspicious behaviour.
  • Enforce email verification or SMS MFA on Signup - Since these accounts can be potential bots, it will be much harder to register with them while needing to verify the email itself or use multiple numbers for the MFA process.
  • Enable Suspicious IP Throttling - Security > Attack Protection > Suspicious IP Throttling - If the signup requests originate from the same IP or similar ones, it will block after multiple failed attempts

If you have any other questions, let me know!

Kind Regards,
Nik

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.