Linked Accounts Detection

The Linked Accounts Detection module identifies customers who share an identity-grade identifier — shipping address, billing address, phone number, or payment method — across what would otherwise look like separate accounts. It’s the module that exposes fraud rings: groups of accounts operated by the same person or small team using slight variations on email addresses to multiply discounts, evade blocks, or distribute coordinated refund abuse. Since 1.3.8, a shared IP address or browser on its own never links two accounts.

Module ID: linked_accounts. Default: enabled. Free tier (complete).

---

What It Observes #

Every time an order is placed (classic or block checkout), the module:

1. Reads the billing and shipping address from the order
2. Reads the phone number, the IP address, the payment method token (saved token ID, Stripe card fingerprint and card last-4, where the gateway provides them) and the browser user-agent
3. Computes a keyed HMAC-SHA256 hash for each fingerprint (so raw addresses, IPs, and personal info are never stored in plaintext)
4. Stores the hashes in the {prefix}trustlens_fingerprints table, dated by the order, with how many orders used each one
5. Looks for other customers holding the same hashes and counts the accounts linked through at least one identity-grade match
6. Stores that count on the customer’s record — and refreshes the count on each linked account, since a link is mutual (this count is what the Pro “Linked Accounts” automation condition reads; it works correctly from 1.3.23)
7. Fires the trustlens/linked_accounts_detected action — other modules (Coupons, automation rules) listen for this

The keyed-hash design is important: raw addresses and IPs are never stored in the fingerprint table. The hash key is your site’s own WordPress secret (the auth salt), so the same address on two different stores produces different hashes and cannot be cross-referenced externally. Fingerprints are kept for 365 days after an identifier was last used, then pruned.

---

What Counts as a Link #

The module records six fingerprint types, each with its own normalization rules, but only four of them can create a link.

Fingerprint Type	Inputs Normalized Into the Hash	Role
Shipping address	address lines 1 and 2, city, postcode, country (lowercased, punctuation removed, common abbreviations such as “st” → “street” expanded)	Identity-grade — links accounts
Billing address	same as shipping	Identity-grade — links accounts
Phone number	digits-only form (a leading US “1” country code is dropped)	Identity-grade — links accounts
Payment method	saved payment token ID, Stripe card fingerprint and card last-4, combined	Identity-grade — links accounts
IP address	full IPv4 or IPv6 address from the order	Corroboration only — shared NAT, mobile carriers and VPNs make it collide across unrelated shoppers, so it never links on its own
Device	the browser’s user-agent string	Corroboration only — many shoppers share the same browser, so it never links on its own

A link exists when two customer hashes share at least one identity-grade fingerprint. Once linked, any shared IP or device is listed alongside as corroboration. On the customer detail page you can see exactly which fingerprint types two accounts share.

---

What It Signals #

The penalty is added to the score through the trustlens/score_signals filter, so it applies to new customers below the Full-confidence Order Threshold too.

Trigger	Score
Linked to 1–2 other accounts	-5
Linked to 3–4 other accounts	-10
Linked to 5+ other accounts	-15
Each linked account already in the Risk or Critical segment	an additional -5 (the Link penalty setting)
Each linked account that is blocked	an additional -10 (2× the Link penalty)
No links	0 (no signal)

Everything adds into one signal, shown on the profile as “Linked to 2 other account(s) (1 high-risk, 0 blocked)”. Being linked to a risky or blocked account is the strongest fraud-ring indicator: if the account you’re linked to is already classified as Risk or Critical by other modules, or has been blocked, the link costs more than the count alone.

---

The Linked Accounts Panel #

The Customer Detail page shows a Linked Accounts panel listing every link with:

• The linked customer’s segment badge
• The linked customer’s email (or “Guest” if no email is known)
• A Blocked badge if that account is blocked
• Which fingerprint(s) produced the link — shipping or billing address, phone, payment token, plus any shared IP or device
• The linked customer’s trust score and the number of matching fingerprints
• A click-through to the linked customer’s profile

This is the workflow for investigating fraud rings: open one suspected account, click through the linked accounts panel to see the others, and confirm they all share characteristics (similar order patterns, coordinated timing, shared coupons).

---

Settings #

Setting	Default	Description
Module enabled	On	Master toggle
Link penalty	5	Points per linked account in Risk/Critical (0–20); a blocked linked account costs double

Both are on the Linked Accounts Detection card in Settings → Detection. The fingerprint rules themselves are fixed — there’s no per-fingerprint enable/disable.

---

Common Patterns #

The Email-Variation Ring #

Signature: 5 accounts: [email protected], [email protected], [email protected], [email protected], [email protected]. All share the same shipping address. All used new-customer coupons.

Detection: Shipping address hash matches across all 5 accounts. Each account shows “linked to 4 other account(s)” — -10 from the count, plus 5 for every linked account already in Risk or Critical.

Profile: Combined with their coupon and return signals, the accounts typically end in Risk or Critical — and as each one drops, the link penalty on the others grows.

The Family / Household #

Signature: 2–3 accounts at the same address with different names and different payment methods, normal order patterns, no abuse signals.

Detection: Address link present, but no abuse signals on any of the accounts.

Profile: Each account shows -5 from the linked-accounts signal but no other module signals. Likely false positive — allowlist if confirmed legitimate.

The Reseller / Drop-shipper #

Signature: 1 account placing many orders to many different shipping addresses.

Detection: Not flagged by Linked Accounts — this is the inverse pattern. Caught by Shipping Anomalies instead.

The Block-Evasion Account #

Signature: A previously-blocked customer creates a new account with a slightly different email and tries to place orders.

Detection: The payment method, address or phone matches the blocked account (a matching device alone is not enough). The new account picks up -15 (-5 for the link, -10 because the linked account is blocked), or -20 if the blocked account is also in Risk or Critical.

Profile: The new account drops into Caution on the link alone, even with no order history, so it stands out for review.

---

False-Positive Watch List #

Linked Accounts has the highest false-positive rate of any module. Common sources:

• Family / household sharing. Spouses, roommates, parents and adult children — all legitimately separate customers sharing an address. Frequency: very common.
• Office addresses. Multiple coworkers ordering to the same office address. Frequency: occasional, depends on industry.
• Shared payment methods. Parent paying for adult child’s order, married couples with joint accounts. Frequency: occasional.
• Mobile carrier NAT. Mobile customers can share a public IP with hundreds of unrelated users. TrustLens records the IP but never links accounts on it alone.
• Corporate VPNs. Employees of the same company can all appear to come from the same IP — again, corroboration only, never a link by itself.

The mitigations:

• A shared IP or browser can never create a link; at least one address, phone or payment match is required
• One or two plain links cost only 5 points — the larger penalties come from the number of links and from links to accounts already in Risk/Critical or blocked
• You can allowlist confirmed-legitimate household accounts; the allowlist locks the customer at score 100 and suppresses the linked-accounts signal entirely

---

Disabling the Module #

Disabling Linked Accounts loses one of TrustLens’s strongest fraud-ring detection capabilities. Only consider this if you’re consistently seeing false positives that aren’t being mitigated by allowlisting. When disabled:

• No new fingerprints are recorded — which also stops fresh address data reaching the Shipping Anomalies module, since it reads the same fingerprint table
• The linked-accounts penalty is no longer added to scores, and the Customer Detail panel shows “Linked accounts module is disabled.”
• Existing fingerprint rows remain in the database
• The Coupons module’s multi-account coupon check stops running (it listens for linked-account detections)
• Cross-account fraud-ring detection becomes blind

---

Reading the Linked Accounts Section of a Profile #

• Signal breakdown shows one Linked Accounts signal with the count
• Linked Accounts panel lists each linked customer with the fingerprint type(s) that produced the link
• Linked Accounts panel is where linkage evidence lives — it is worked out live from the fingerprint table each time you open the profile, and the score picks up new links at the customer’s next recalculation, rather than a per-link entry being written to the event timeline

The fingerprint-type column in the linked accounts panel is the most useful piece of evidence. Two accounts linked by “Address + Phone + Payment” is overwhelming evidence of shared identity. A single shared address with nothing else is weaker — households and offices share addresses.

---

Privacy Considerations #

Linked Accounts processes personal data — addresses, phones, IPs, payment fingerprints. TrustLens handles this with several safeguards:

• Keyed HMAC-SHA256 hashing — raw values are never stored in the fingerprint table. Hashes are keyed with your site’s own WordPress secret, so two different stores cannot cross-correlate hashes. (Regenerating your WordPress secret keys invalidates existing fingerprints; run Historical Sync afterwards.)
• GDPR data export includes the customer’s fingerprint records
• GDPR data erasure removes the customer’s fingerprints, which removes their links from all other accounts
• No external sharing — fingerprint data never leaves your WordPress install unless you explicitly configure webhooks or alerts

See Privacy & GDPR FAQ for the full data-handling description.