What to expect when enabling account sharing prevention for your product

When a product starts protecting against account sharing (https://www.rupt.dev/docs/how-account-sharing-prevention-works), users will react differently. In this post, we’ll explore the most common reactions to expect, how to handle them, and how to prepare for them ahead of time.

One important note to highlight before diving into the details is that if you’re doing account-sharing prevention correctly, most users will likely not see a single challenge. Only those actively sharing accounts will see the challenges, and that’s good!

Support

Most users who do see a challenge will get through it unhindered. But if you have two-factor authentication (2FA) enabled—and we recommend you do —the users who are sharing an account with a different person and don’t have access to their email address or phone number will likely be entirely blocked unless they get help from the email/phone owner.

If you don’t verify emails on sign-up, you may get an initial rise in support tickets from users who made a misspelling in their emails or whose inboxes are out of storage, etc. This will likely only be a 1-2 week period, but it will die down with no significant effect, similar to a case of Sketchy as discussed with Dani Dyess (https://www.rupt.dev/blog/elearning-leader-sketchy-sits-down-with-rupt-to-discuss-the-impact-of-account-sharing-prevention).

How to prepare for this?

If you verify emails or phone numbers in your sign-up process, you should be good to go. Otherwise, you can expect to help some users update their email addresses or verify them manually.

Pushback

There will be some claims that no account sharing is happening. It may be true, as no system is perfect. But it’s far more likely that there is account sharing, and customers don’t like to admit it. In this scenario, we recommend going to the account details page of the person making a claim and investigating their usage, locations, and account-sharing signals to make a determination. Unless it’s an obvious case of abuse, we recommend agreeing with the user, explaining that the “system” thinks they’re account sharing because it saw XYZ signals, and helping them detach/delete some devices and move past the challenges.

If you see an unreasonable burden on the user, consider adjusting your limits. Don’t adjust the limits too quickly, though, as your initial hunch about the limits is often correct.

How to handle this?

Help the user move past challenges, blame “the system” (a.k.a Rupt), and only adjust your settings if necessary.

Churn

Churn is a genuine concern when tackling account sharing, but it’s tricky. Let’s dissect it.

The concern:

If we introduce friction (challenges) to our users, they will be pissed off, cancel and leave to a competitor.

The reality:

If we introduce friction (challenges) to non-sharing users, the user experience will degrade, and they will leave it to a competitor.

If you do introduce challenges to the wrong users (non-sharers) or challenges are seamless, UX will degrade, and users will cancel.

But if you introduce friction to the right set of users, no users will leave. Instead, you will have significantly more users and growth.

How to prepare for this?

Primarily, choose an excellent account-sharing prevention partner. Rupt handles this by always erring on the side of caution. If we’re not sure users are sharing, they will never see a challenge. This will ensure growth and no churn!

Conversions & growth

One of the fantastic things you’ll see very quickly is an increase in new accounts and subscriptions. Very few initiatives lead to a growth so significant as account sharing prevention. Rupt does its best to estimate the number of converted account sharers (https://www.rupt.dev/blog/what-is-a-converted-account-sharer), but it’s often underestimated. We’ve seen customers get a clearer picture following these methods:

For B2B products

Look at all the challenged users and group them by company. Then, see which ones added seats after seeing challenges. You can find out which users are challenged by exporting the list of challenged users or by listening to the challenge webhooks.

For B2C

Benchmark the new account creation before and after turning on account sharing prevention. Turn off account sharing prevention once every six months for two weeks to see if it’s still effective, and then turn it back on and see the difference.

Ready to take the next step in preventing account sharing on your platform? Try Rupt! Sign up now at rupt.dev and let's supercharge your growth together.