Linked accounts

Linked accounts are accounts that look independent but share identifying state underneath. The clearest case is one fingerprint showing up across accounts that should belong to different people. That's the signature of multi-accounting: one person running many accounts to farm referrals, dodge a ban, stack free trials, or stuff a vote.

Rupt scores this risk on the login and signup actions, because the same person can resurface at either. It skips access: linkage is established when an identity is asserted, and the heartbeat action would only repeat what the login already said.

What Rupt looks for

• Shared fingerprint: how many distinct users a single fingerprint has been seen on. One device behind one account is normal. One device behind a dozen accounts is not.
• Shared IP: how many distinct users have been seen on the same IP in the last 180 days. Weaker evidence than a fingerprint match, so it carries fewer points.

Severity and response

Those checks feed a linked_accounts risk severity. Shared devices and networks have innocent explanations, like a family computer, an office machine everyone logs into, or a campus network, so the count matters more than the sharing itself. A handful of accounts on one fingerprint is plausible; dozens is a ban-evasion ring. Most teams add the device to a list for review and escalate to a challenge or deny as the count climbs. Your policies decide where normal ends.