How to handle Multiple-accounts creation and cheating?

Question

I am developing a game that is running as a web application. The fact is that the game lose sense if one player creates several accounts. Imagine that is a turn-based strategy game, and if you play against yourself (with another account) you can earn tons of points easily.

At first, I thought about logging every single user action, and then comparing the users IP to detect if there is any clue of cheating. But then I noticed that different users could be running under the same IP, for example if they are in the school and all them share the same IP using a proxy. Using this way innocent people could result banned.

Is there any better approach that I'm missing?

Answer 1

There are a few different ways to handle this, and many solutions have their own merits. I will give my opinion of the ideal way to handle this.

First, it's important to understand that no matter how complicated your system is, someone who is sufficiently invested in gaming the system (with appropriate knowledge) will figure out a way to game it.

To seriously handle this issue, if it is really an issue for you, you need to handle this in both the design and technical implementation of your game.

---

On the technical end, you need to basically play a game of comparisons.

In general, I am pro-logging if you are running any type of game with user interaction then verbose logs would allow you to modify and tailor your game based on real quantitative measurements.

Using your logs, you can set up a system to compare data between accounts of any number of similarities.

For example, if two accounts are using the same IP address, or any other information that you deem an appropriate comparison measure, you would want to be able to look at overall interaction between the two (wins/losses, trading) in relation to the amount of interaction with others.

Using this data you can pass appropriate judgement on a case-by-case basis, or automatically. Depending on how widespread the issue has become, I would recommend an automatic option and handling any issues through a live moderator. It's important that you don't delete the account, just suspend it with a message along the lines of "This account has been suspected of violating this game's TOS agreement. If you disagree please go here" with a link to an arbitration panel or something.

It is important that such a thing is in place, because people could be sharing IP addresses at home, or at school. Also, for younger kids, they could be using their parent's email addresses, credit cards, or even names in their sign-up information depending on how protective they are.

---

The second phase is design side. While some benefit is to be expected, you need to sufficiently disincentivize this form of cheating with your gameplay. There are quite a few ways that you can go about this, there are the wholly annoying ones of very short timeouts (which may be necessary). But I feel the best way is by appropriately adjusting the benefits between two accounts.

For example, some MMOs have altered the benefit that high level players recieve when playing with players outside of a reasonable level range. This discourages players with access to multiple accounts from powerleveling themselves (atleast within a specific range)

You could even specifically target accounts that share data and directly decrease the benefit that they gain when interacting with each other. This would encourage interaction with other players, but it can be circumvented with proxy servers and it would be ill-advised depending on your target audience.

The other way that think would work is having gameplay so engaging that people can't really manage to play two separate accounts and still keep up with everyone else.

---

Of course with this system, you would need to spend a nice deal of effort tweaking to prevent false positives and what not.

tl;dr?

You want to collect appropriate data that allows you to automatically detect and handle potential threats and deal with false positives on a user-by-user basis. A good deal of babysitting would be necessary to make sure you don't have false-positives.

Also you want to reduce the benefit of cheating with multiple accounts on the gameplay end.

Answer 2

The simplest and most effective way to counter 'farming' of scores is to adjust the score received based on the disparity between the players. Bear in mind it's not just one player creating multiple accounts you need to worry about: imagine two friends, one deliberately losing so the others ranking is artificially boosted.

Chess and other games avoid this through forms of the Elo rating system. Basically the reward for beating someone of a higher rating than you is high, but the reward for beating someone of a much lower rating is very low. This very quickly makes deliberately losing to advantage another player ineffective. You can tune the rate at which winning against a poor player quickly results in little net gain. A player playing 'properly', i.e. winning against a wide range of similarly ranked opponents, will advance very quickly.

NB: it's not enough to just penalise players who lose so that winning against them gets you nothing, because then players can create an account, lose with it deliberately, then create another account. This isn't so much of an issue if there is a barrier to entry (e.g. entering credit card details to create a new account), but for free-to-play games that would work.

Also its worth noting that there is a danger if the ratings are used as a measure of actual ability, rather than just as a way to modify any rewards the player receives. If the rating itself is the measure, canny players will use the system to sabotage others. I.e. Player 1 gains a lot of skill/ability through practice, and then creates a new account. Player 2, who is about as good as Player 1, accepts a challenge from the newcomer. Losing to the newcomer will massively hurt their ranking, even though really the new player is of equivalent rank. However if the rating isn't actually used to measure the player, this is actually in Player 2's interest (having their rating pulled down will allow them to advance faster given their actual skill level).

Answer 3

You could award points based on the difference between the opponents' point totals. Very good players would earn few points for defeating newbies, and newbies would earn many points for defeating experienced players. Likewise, losers would lose points proportional to the same scale.

This wouldn't completely solve your problem, but it would eliminate the simple case of someone creating and defeating a bunch of newbie alts, as well as making it harder to level two different accounts of equal power.

Really, though, there's not a foolproof way of stopping this; a sufficiently dedicated cheater will succeed. But if you flag accounts with suspicious activity for review, where "suspicious activity" includes multiple accounts with the same e-mail or IP address, then you'll be able to spot the most egregious offenders.

Answer 4

I've found this is much easier to fix through game design than through enforcement/banning. Even if you permanently ban all of a player's accounts, sufficiently determined players can find a way around your ban (e.g. if you track IP, they can use dynamic IP or IP masking).

For example, if you award points to players for winning PvP contests, you give players incentives to make multiple accounts so they can lose to themselves. If instead you give bigger rewards for playing in groups with the same players over time (i.e. guild participation), you incentivize friendship and community over competition, which changes preferred behaviors. Having additional metagame characteristics tied to the player's account (such as a Reputation score and Friends list) further makes the maintenance of multiple accounts less appealing -- at the least, people would want one "primary" account with a good rep.

If your game is PvP by nature, a big way around the "I'll make several accounts and lose to myself on purpose" problem is to only offer automated matchmaking. So, the player requests to play a game, and the server automatically matches them against someone else who happens to be online at the time. If players can't choose their opponents, there's no way for them to guarantee they'll fight themselves (unless they happen to be the only one online at the time, but then you have bigger problems). See Microsoft Hearts/Spades, or most Facebook games that allow PvP, for examples of this. Note that in this case you'll definitely want some kind of intelligent matchmaking (either using some kind of ranking/rating system as part of the player account, or letting players self-select their preferred level of competitiveness).

If you're worried that players will want to play games with their friends, you can always offer that option as well, but only allow unrated/unranked/practice games when you choose your opponents.

Answer 5

The people over at https://panopticlick.eff.org/ did some testing on how somebody could be uniquely identified by several values that can be gathered from almost any browser. The results are astounding and you could use a similar approach (maybe combined with other measures) to identify and track your users.

Answer 6

There's a very simple design solution that Blizzard took in Warcraft 3 and Starcraft 2: only let players earn points/score/experience when playing in games using the automatic matchmaking service. Players can still play against their friends, but won't get points from it.

If the player has no way of deciding who they are playing against, there's no reliable way to game it by playing against dummy accounts.

Answer 7

i play on a game system called travian, and i really think the technology isnt good enough to catch cheats. Most cheats have 2-4 systems linked via KVM switch, each system runs different OS versions(windows xp, vista, win7, linux mint, Slitaz and so on) , and is run in via proxy servers (though the main account is not using proxy but standard)

This of course creates such an unfair advantage that most of the people that pay to play the game are leaving, with paying members down over 1000 in just a few months, and with the fewer players, its becoming increasing more obvious that accounts are suspicious, but with no evidence of cheating, the players that do cheat escape punishment, and those that pay fairly (whoops, meant to say play fairly) can see the suspicious activity, they get discouraged and quit the game - or they learn to cheat and hence inlies the problems.

Currently for travian, there is no player in the top of the game that can honestly say they dont cheat, or admitt they havnt hired people from countries like the phils and china to help them play the game for them while they sleep or are on holidays.

surely there must be better ways to catch multiple account cheats, or is this the future of games, where just a few actual people make up the entire game base and the winner is based on who can hire the most people in 3rd world countries to play the games for them.

would membership of $0.01 via credit card (and see who has identical credit card numbers) be a feasible way to detect multiple account cheats at time of registration?

Answer 8

One option if you have multiple servers is to require that any accounts from the same IP must be created on alternate servers. So if you want to create 10 accounts, great, but you'll have to create them on servers that don't interact with each other. This prevents people at the same location from being able to play together, so there is that drawback. On the plus side it also interferes with the effectiveness of proxies in cheating.

You're going to end up with pros and cons to any solution you come up with, and you won't completely eliminate cheating. So decide how far you're willing to go and keep a close eye on how those changes effect the user base.

Answer 9

Most people try to chase after multi accounts with external tools. Which is stupid. If you have proper logs and metrics for user activities you could nail most multi-accounters with a handful of criteria scans inside a game.

And no, I'm not going to hand you the breakdown - truth is - and very few people in the industry are going to spell it out - the more stupid game designers and coders are out there the better job security for the people who know what the hell it is they are doing.

Multi Accounting is only even viable to people if the benefit chain is badly designed and can by manipulated easily by multi-accounts.

If multi-accounting is hard and time consuming in terms of reward (not detection dodging - just gameplay effort and time)

Then the only people really doing it are the hardcore players. And you don't even need to bother raising an eye brow to them as they are community drivers. They spend every effort to know all your loopholes and study efficiency within an environment. By all rights the effort they invest should be the best rewarded. You still get to monetize the majority of lazy ones.

Good designers never really go plugging every loophole - just plug the major ones and make sure you have a way to take out excess out of the economy. Or obviously inject value in if need be.

I have a list on hand of 83 multiaccounters. They think they are fooling us - and get to enjoy the happiness of the idea that they are smarter than us. Most also invest real cash into the game - we don't want to ban them. Our coders didn't really have time for a system - So I set up CM with a secret dummy account to occasionally bash their heads ingame and "legitimately" steal their "riches".

They think they are playing us as company, and are getting increasingly motivated by thinking someone else ingame has an axe to grind. End result is - any critical excess is discarded by a CM - considering he knows what the user is upto, and pull an "ambush" at any time. All of which - can be automated by code but, who has time or budget for that?

Anybody building complex multi-account detection systems for profiling user IDS, to prevent multi accounts in games is pissing against the wind to begin with.

Answer 10

You really need to identify the specific behaviors that you want to prevent.

For example, if the real problem that you want to prevent is not "people making multiple accounts", but "individuals being targeted by multiple accounts controlled by the same person", that's an area where you can use similar traits between potentially clone accounts to allow the players themselves to police multiplaying. In other words, if they detect traits of multiplaying, they can act (via some interface) to check for similarities between the accounts, and if the accounts do have too many similarities, cause a punishment to occur. Player policing. The benefit of this is that multi-accounting matters the most to other, non-multiplaying individuals, so if they feel wronged, they have a recourse they can try to catch the multiplayer on the spot. It also allows things that in a flatly viewed account system would be false positives (like ip) to be much more real evidence of multiaccounting.

Similarly, as others have mentioned, if it's the gaining of rank by defeating their own dummy accounts, a system like the rep system here on stackexchange helps to turn taking ranking points from yourself into a zero-sum gain.

Answer 11

Ensure that making multiple accounts isn't worth it.

Examples of how you'd do this:

• Grant tiny awards in the first few levels compared to later levels.
• Compulsory tutorials - first time players will find it useful and multi-accouters will find them incredibly annoying.
• If there's a reward for referring others, give the award once the referred player reaches a certain level.
• If players battle one another, make winning against low(er) level players get waste of time. E.g. anyone under more than 5 levels than you won't give you rewards for winning against.
• The StackExchange network is an excellent example. Making new accounts has very little benefit.

Allow players to make multiple accounts because you can't stop them from doing it anyway:

• If you add IP blocks, people will use proxies and VPNs
  • IP checking also bring about false positives.
• Tracking cookies and local storage data can be deleted.
• If you try to collect (a lot of) personal information, it'll strongly discourage people from registering and it's useless if you don't verify it.
• Each account typically takes up a few bytes of space. You can afford that.

Out of all of these answers, this method is the only one that truly works. If people won't want to make multiple accounts, they won't do it. You can decide on what they want through good, considerate game design.

Answer 12

I think there is another aproach. Because there is another potential harm: Imaging two friends who both create two accounts: one looser and one winner account each. One day friend A uses his looser account to loose all games against friend B's winner account. The next day they change. Checking the IPs won't help here.

You should check the behaviour of the players (a strategy know from intrusion detections systems). If two player play each other often and one looses all the time, this is a clue. If games end very early, it is another clue.

You could score those clues, add the score up to a reputation (don't show the reputation to the users) and ban accounts if they reach a value you define. Maybe there should also be anti-clues that repairs the reputation.

Other clues depend very much on your game. But I think you get the idea.

Answer 13

You can use Flash local data storage, not everyone knows how to delete flash data.

Answer 14

Not really a solution, but a deterrent at least: Say that if people are discovered having multiple accounts, all accounts will be banned. This should keep many people from even trying it. Even if you don't actually ban all accounts, or don't have a way to detect it at all, most will be too afraid.