Suspicious User Concerns | Hacker News Reader

Suspicious User Concerns

2 pointsDeceptive10 comments

Last night my site received a sign-up from someone using a Proton email. The name in the email address didn't match the name they used on my site, their phone number contained an area code that does not exist, and they accessed us via VPN.

I canceled the account without notice because from what I know about the internet this is clearly some form of intended illegal activity.

How do I protect against this with introducing no additional friction to my legit customers?

View on HN

Privacy measures do not equate to ‘illegal activity’. We all have something to hide, but the Internet makes that hard to achieve. Masking an IP should have been a standard from the outset as part of the Internet’s original design, but it wasn’t. As for Protonmail, it’s perfectly fine if someone uses this for registrations. I don’t attach my legal name email address to any services because of breaches etc Plus Protonmail has encrypted inboxes as opposed to Gmail which is harvested and part of Prism or whatever the NSA calls it now.

What if it's a ToS violation to enter into my site with false information?

That's business as usual these days. People like to use VPN, fake names, disposable email addresses for signup. Not necessarily fraudulent. Treat it as anonymous user and adjust your business to accommodate those, e.g. free accounts that auto-expire, require credit card or phone verification to unlock all features.

You fight a bit by adding captchas, block VPNs but it's an arms race unable to win. My record user created 80 accounts (manual, a student who really liked our free product, took 12 hours) and another created 800 accounts (somewhat automatic).

I'm sorry Mr. "Deceptive". I don't feel comfortable providing my service to you, that service being an answer to your question, without first knowing where you live and what your birth name is, at the very least. You're fresh account with these fake credentials strikes me as typical of a criminal.

I don't give out my real name or phone without a very good reason. Could the user just be trying to preserve some basic privacy, or does the nature of your site rule that out?

What's your good reason?

@Deceptive - Please post your full name, telephone number, email address and postal address here. If you are reluctant to do so - then doesn't that sort of answer your own question?

Wait, my protected site is being compared to an open forum? Confused.

If a site needs to know my real information to provide its services. E.g. a sales site will need my address to ship things to me.

Welcome to the Internet

Reply on news.ycombinator.com