Account Sharing Visualized

We detect account sharing as part of finding opportunities for subscription businesses to expand, and for identifying abuse. As part of that we often analyze interesting cases which help inform our machine learned models.

We wanted to share some behind the scenes examples, with the appropriate anonymization and filtering to preserve privacy, of certain ways we visualize account sharing to help in our analysis.

One way we look at analyzing account sharing is over time. Below are a few specific examples showing different cases of account sharing and associated visualizations of them. Each colour represents one unique device using the account.

One account shared across an entire organization​

We can clearly see work days framed with lower usage on Sundays and Saturday evenings. You can also observe very high rates of simultaneous usage between the same types of devices, and that it has consistently been like this for weeks.

An account reseller who sells access to users in every continent apart from Antarctica​

This is really interesting as here we see very little simultaneous use compared with the entire organization case. It is clear this account is used across a broad range of devices, with the global reach generating activity nearly 24 hours a day.

Even though individual devices may have consistent patterns of usage on given days of the week, the distribution as a whole is broadly random instead of aligning neatly to weekdays or weekends.

Many devices and a lunchtime stroll​

Here we have a case which, when looking at device specifics, locations, and durations between use, appears to be a textbook example of account sharing. It has a number of desktop devices used regularly, spanning two cities with a large distance between them.

However, when we add in their activity over an appropriate time domain, a pattern emerges showing it is in fact not account sharing.

This account was used on a work computer during the week and very rarely on weekends. That machine uses a corporate VPN which places it far away from the other personal machines used on the account.

During lunch time this account is used on a personal laptop, while on weekends and some mornings it is used on a personal gaming computer.

Broad rules such as a limiting the number of devices or simply looking at fast travel between two locations would have inadvertently flagged this as account sharing.

Few devices, but clearly sharing​

This account has a reasonable number of devices which are used in the same city. This could appear to be someone switching between an iOS phone and an Android tablet, but if you look at it on the time domain we can see the usage patterns of these two devices commonly line up and in many cases overlap with each other.

Along with other data we analyzed we can say with reasonable certainty that this account is being shared, something that would not have been caught with device counts, distance or other common forms of analysis.

Determining accounts that are truly account sharing is a tricky business, but time domain visualization can be a very helpful tool in spotting patterns that lead to a better understanding of a given case.

If you are curious about how much account sharing your product has, find out for free by signing up to Upollo. You will also see all the other real time insights we provide that have led to faster growth, more conversions and faster expansion.