Linked Accounts in WooCommerce: How One Customer Becomes Five

You block a customer for serial returning. Two weeks later, a “new” customer starts placing orders. Different email address. Clean account history. But the orders ship to the same address. The same credit card processes the payments. And within a month, the return pattern starts again.

You didn’t solve the problem. You moved it to a new email address.

This is what linked accounts look like in WooCommerce — and it’s one of the hardest abuse patterns to catch, because the platform itself can’t see it. WooCommerce identifies customers by email address. Period. There’s no built-in mechanism to connect two accounts that share a shipping address, a phone number, a payment method, or a device. As far as WooCommerce is concerned, five email addresses means five separate customers.

In reality, it might be one person with five identities — and a combined behavior pattern that would have been obvious if anyone could see the full picture.

What linked accounts actually are

Linked accounts are two or more customer accounts that belong to the same real-world person. They share physical identifiers — addresses, phone numbers, payment methods, devices — but use different email addresses, which is the only identity WooCommerce tracks.

The key word is identity fragmentation. The customer isn’t hiding in a technical sense. They’re not spoofing IPs or using VPNs (usually). They’re simply creating another account with a different email, which takes about 30 seconds. Everything else about them — where they live, how they pay, what device they use — stays the same.

That’s what makes detection possible. A person can create unlimited email addresses, but they have one or two home addresses, one or two phone numbers, a few payment methods, and typically one primary device. Those anchors persist across accounts.

Why customers create multiple accounts

Understanding motivation helps you assess severity. Linked accounts fall into four broad categories, and each one calls for a different response.

The coupon recycler

The most common type. Your “WELCOME15” code works once per account. Creating a second account resets the counter. A customer with three email addresses (personal Gmail, work email, an old Yahoo account) can redeem your welcome discount three times without thinking of it as fraud. They saw a loophole and used it.

The motivation is simple: why pay full price when the coupon works on a “new” account?

The block evader

You blocked them for a reason — serial returns, abusive behavior, a chargeback. But blocking an email address doesn’t block a person. They create a new account and continue as if nothing happened. Same shipping address. Same card. Same patterns.

This is the most operationally damaging type, because it directly undermines your enforcement actions. Every block that doesn’t stick costs you more: the original abuse, the time spent investigating, the block decision, and then the abuse resuming under a new name.

The limit circumventer

Some stores limit promotions per customer — one BOGO deal per account, a maximum purchase quantity, or a per-customer usage cap on a sale. Multiple accounts bypass all of these. If your flash sale is limited to 2 units per customer and someone creates 5 accounts, they get 10 units.

The accidental duplicate

Not everyone creating multiple accounts is doing it intentionally. Some customers genuinely can’t remember if they had an account, so they create a new one. Others used a different email at checkout than the one they registered with. These customers aren’t abusing anything — they just have fragmented purchase histories that make your data less useful.

The accidental type is the most common and the least harmful. But it still matters for your data quality, because customer metrics (lifetime value, return rate, order frequency) are only accurate if they capture the full customer relationship, not a fragment of it.

What multi-account abuse costs you (beyond the obvious)

The direct costs — duplicated coupon discounts, bypassed purchase limits — are straightforward to calculate once you find them. But linked accounts cause damage that runs deeper than the discounts.

Your data lies to you

This is the cost nobody talks about. When one customer is split across five accounts, your analytics are wrong in ways that compound over time:

• Customer count is inflated. You think you have 5,000 customers. You might have 4,600 real people. Every metric that divides by “number of customers” is off.
• Lifetime value is deflated. A customer who has spent $1,200 over 3 years looks like five customers who each spent $240. That changes how you segment them, what communications they receive, and what loyalty tier they qualify for.
• Return rates are diluted. A 70% return rate split across five accounts becomes five accounts with 14% return rates — well below any threshold that would trigger investigation. The pattern is invisible.
• Coupon ROI is fictional. If 15% of your “new customer” coupon redemptions are actually repeat customers on fresh accounts, your customer acquisition cost calculations are wrong. You’re not acquiring new customers — you’re discounting existing ones.

Your enforcement is undermined

Blocking a customer by email address only works if that customer uses one email address. If they have five, you’ve blocked 20% of their ability to buy. The other four accounts are unaffected. Your block gave the impression of action without the reality of enforcement.

Your promotions leak

Every per-customer limit you set — usage caps, purchase limits, once-per-customer coupons — is enforced per email address, not per person. Linked accounts make all of these limits performative. The limit says “1 per customer.” The reality is “1 per email address” — and email addresses are free.

The 6 signals that connect linked accounts

People can create unlimited email addresses. They cannot easily change the physical and digital identifiers that follow them across accounts. These are the signals that link accounts together.

Why normalization matters

Matching addresses sounds simple until you realize that “123 Main St” and “123 Main Street” and “123 main st.” are the same location but different strings. Effective linked account detection normalizes data before comparing:

• Addresses: Lowercase everything, expand abbreviations (St → Street, Apt → Apartment, Rd → Road), remove punctuation, combine all address components into one string
• Phone numbers: Strip to digits only, remove country codes — so “+1 (555) 123-4567” and “5551234567” match correctly
• Payment methods: Compare card fingerprints or last-4 digit patterns, not raw card numbers (which you never have access to)

Without normalization, a customer who writes their address slightly differently on each account slips through. With it, the match becomes obvious.

When one signal is noise and three signals are proof

This is the most important concept in linked account detection: no single signal proves two accounts belong to the same person. Multiple signals together do.

One signal: investigate

Two accounts sharing a shipping address could be roommates. Two accounts from the same IP could be a family. Two accounts with the same phone number could be a married couple with a shared home phone. Any single match has a plausible innocent explanation.

Two signals: likely linked

Two accounts that share both a shipping address and a phone number? Probably the same person. Two accounts with the same payment method and the same device fingerprint? Almost certainly the same person.

Three or more signals: near certainty

Two accounts that share a shipping address, a phone number, and a payment method are the same person. The probability that three independent identifiers would coincidentally match across two accounts that are truly different individuals is negligible.

The abuse patterns that linked accounts hide

Linked accounts aren’t a fraud type — they’re a fraud multiplier. They take every other abuse pattern and make it invisible by distributing it across identities. Here are the patterns that linked accounts enable and conceal.

Coupon recycling at scale

Your “first purchase” coupon is meant to be used once. A customer with five accounts uses it five times. The coupon dashboard shows five separate first-time customers, each using the code exactly once — which looks like a successful acquisition campaign. In reality, you’ve given one person five discounts and acquired zero new customers.

We’ve covered coupon abuse patterns in depth separately. What linked accounts add is the invisibility layer: per-account coupon tracking shows clean usage, because the abuse is spread across identities your system treats as separate.

Return rate laundering

A customer who returns 70% of their orders is a red flag. Five accounts that each return 14% are not. Linked accounts let serial returners spread their return behavior below whatever threshold would trigger review. The combined pattern is abusive, but no single account crosses the line.

This is the pattern we described in our guide to serial returners — and it’s only detectable when you can connect the accounts and calculate a combined return rate.

Block evasion

You block Account A for abuse. The customer creates Account B. If your block is per-email (which is all WooCommerce supports natively), Account B is clean, fresh, and free to order. The block accomplished nothing except teaching the customer that they need a new email address.

Effective blocking requires blocking the person, not the email. That means identifying linked accounts and extending enforcement actions across all of them.

Purchase limit bypass

Flash sale limited to 3 per customer? A customer with five accounts can buy 15. Usage cap of 1 per customer? That’s 5 now. Any limit tied to email-based identity is only as strong as the assumption that each email represents a unique person — and that assumption breaks down more often than most stores realize.

Dispute and chargeback distribution

A customer who files three chargebacks from one account raises alarms with your payment processor. The same three chargebacks spread across three accounts look like three unrelated incidents. Linked accounts hide dispute concentration that would otherwise trigger payment processor review or account termination.

How to find linked accounts in your store

There are two approaches: manual, which works for small stores and one-time audits, and automated, which is necessary at scale.

The manual audit (45-90 minutes)

Why manual doesn’t scale

The manual audit works once. It gives you a snapshot. But linked accounts are created continuously — new ones appear every week. You’d need to repeat this audit regularly to stay current, and at 45-90 minutes per audit with growing data complexity, it quickly becomes unsustainable.

More importantly, manual audits can only check addresses and phone numbers. You can’t manually cross-reference payment tokens, IP addresses, or device fingerprints — that data isn’t in a standard WooCommerce export. The most reliable signals are the ones you can’t check manually.

Automated detection

Automated linked account detection works by collecting identity signals on every order — address, phone, payment method, IP, device — hashing them for privacy, and cross-referencing against all other customer records continuously. When a new order comes in from a “new” customer whose shipping address matches an existing customer’s, the system flags the link immediately.

TrustLens does this automatically: it tracks all six fingerprint types across every WooCommerce order, identifies linked accounts in real time, and factors the links into each customer’s trust score. Accounts linked to blocked or high-risk customers receive additional score penalties — so if Account A gets blocked for abuse, Account B’s trust score drops automatically because it’s linked to a blocked account.

The roommate problem: when shared signals aren’t fraud

The biggest risk with linked account detection is false positives — flagging legitimate separate people who happen to share an identifier. Getting this wrong penalizes good customers and undermines trust in the system.

Legitimate sharing scenarios

The golden rule: links suggest, behavior confirms

Linked accounts are a detection signal, not an action trigger. Two accounts sharing an address tells you to look at their combined behavior. If the combined behavior shows abuse patterns — repeated coupon usage, high returns, block evasion — then you have a problem. If the combined behavior looks like two normal customers at the same address, you have roommates.

Never penalize customers solely for being linked. Penalize them for what the linked accounts do.

Allowlisting as a safety valve

When you verify that two linked accounts are genuinely separate people — roommates who both love your products — allowlist them. Allowlisted customers are exempt from linked account penalties and maintain their earned trust score regardless of who else orders from their address.

A good linked account system should make allowlisting easy, because false positives are inevitable and the cost of wrongly penalizing a legitimate customer is higher than the cost of letting a marginal abuser slide.

What to do when you find them

Finding linked accounts is the detection problem. Knowing what to do about them is the response problem — and it requires the same proportional thinking you’d apply to any customer risk signal.

The cascade principle

When you take action on one linked account, the action should cascade to all linked accounts. If Account A is blocked for abuse and Account B is linked with high confidence (3+ shared signals), Account B’s risk score should increase automatically. This prevents the “block one, create another” cycle.

The cascade should be proportional: blocking Account A doesn’t necessarily mean auto-blocking Account B. It means Account B’s trust score drops, making it more likely to be reviewed, restricted, or flagged — giving you the chance to investigate before taking action.

Making it harder to begin with

Detection catches the problem. Prevention reduces how often it occurs.

Remove the incentive

Most linked accounts exist because of coupons. If your welcome discount is the primary driver, consider alternatives that don’t incentivize account creation:

• Automatic first-order discounts: Instead of a coupon code, apply the discount automatically when WooCommerce detects no previous orders from that email. No code to share or reuse.
• Unique per-customer codes: Generate one-time codes sent to specific email addresses. Even if someone creates a new account, the code is tied to the original email.
• Post-purchase rewards: Instead of a discount on the first order, offer a discount on the second order. This incentivizes returning rather than creating new accounts.

Strengthen identity verification

• Email verification on account creation: Requiring email confirmation slows down account creation. It doesn’t stop determined abusers, but it filters out casual ones who would have created a quick throwaway account if friction were lower.
• Phone number at checkout: Collecting a phone number gives you an additional signal for linking. Most people will use their real phone number because they want shipping updates.

Design promotions that don’t reward new accounts

The fundamental design question: does your promotion reward being a new customer or buying from you? The more value you attach to “being new,” the more you incentivize account creation. The more value you attach to “loyalty and repeat purchases,” the more you incentivize honest long-term relationships.

Wrapping up

Linked accounts are the force multiplier behind almost every other abuse pattern. Coupon abuse becomes invisible when it’s spread across five accounts. Return abuse drops below detection thresholds when the returns are distributed across identities. Block evasion becomes trivial when creating a new identity takes 30 seconds.

WooCommerce doesn’t see any of this. It sees email addresses. One email, one customer. Different email, different customer. The platform has no concept of identity beyond that single field.

The store owners who handle linked accounts well follow a consistent pattern:

• They look beyond the email. Shipping addresses, phone numbers, payment methods, IP addresses, and device fingerprints are the anchors that persist across accounts. One person can have unlimited emails. They can’t easily have unlimited physical addresses or credit cards.
• They don’t act on signals alone. A shared address is a detection signal, not a verdict. They investigate combined behavior before taking action. Roommates share addresses. Abusers share addresses and abuse patterns.
• They let actions cascade. When one account in a linked cluster is blocked, the risk score of connected accounts increases. This prevents the “new email, fresh start” cycle that makes email-only blocking worthless.
• They protect innocent matches. Allowlisting verified legitimate relationships (families, roommates) prevents the system from punishing good customers who happen to share an identifier with someone else.
• They fix the incentive. If the primary reason for creating linked accounts is coupon recycling, the fix isn’t better detection — it’s designing promotions that don’t reward new accounts over loyal customers.

Start with the 15-minute coupon audit: export your top welcome coupon’s redemptions, sort by shipping address, and see how many addresses appear more than once. That single check will tell you whether linked accounts are a real problem in your store or a theoretical one.

The accounts are already linked. The question is whether your system can see the connections.