---
title: Linked Accounts Detection
description: "The Linked Accounts Detection module identifies customers who share an identity-grade identifier — shipping address, billing address, phone number, or payment method — across what would otherwise look like separate accounts. It's the module that exposes fraud rings: groups of…"
url: "https://webstepper.io/docs/trustlens/detection-modules/linked-accounts-detection/"
updated: "2026-10-18"
category: Detection Modules
---

# Linked Accounts Detection

The Linked Accounts Detection module identifies customers who share an identity-grade identifier — shipping address, billing address, phone number, or payment method — across what would otherwise look like separate accounts. It's the module that exposes fraud rings: groups of accounts operated by the same person or small team using slight variations on email addresses to multiply discounts, evade blocks, or distribute coordinated refund abuse. Since 1.3.8, a shared IP address or browser on its own never links two accounts.

Module ID: `linked_accounts`. Default: enabled. Free tier (complete).

---

## What It Observes

Every time an order is placed (classic or block checkout), the module:

1. Reads the billing and shipping address from the order
2. Reads the phone number, the IP address, the payment method token (saved token ID, Stripe card fingerprint and card last-4, where the gateway provides them) and the browser user-agent
3. Computes a keyed HMAC-SHA256 hash for each fingerprint (so raw addresses, IPs, and personal info are never stored in plaintext)
4. Stores the hashes in the `{prefix}trustlens_fingerprints` table, dated by the order, with how many orders used each one
5. Looks for other customers holding the same hashes and counts the accounts linked through at least one identity-grade match
6. Stores that count on the customer's record — and refreshes the count on each linked account, since a link is mutual (this count is what the Pro "Linked Accounts" automation condition reads; it works correctly from 1.3.23)
7. Fires the `trustlens/linked_accounts_detected` action — other modules (Coupons, automation rules) listen for this

The keyed-hash design is important: raw addresses and IPs are never stored in the fingerprint table. The hash key is your site's own WordPress secret (the `auth` salt), so the same address on two different stores produces different hashes and cannot be cross-referenced externally. Fingerprints are kept for 365 days after an identifier was last used, then pruned.

---

## What Counts as a Link

The module records six fingerprint types, each with its own normalization rules, but only four of them can create a link.

| Fingerprint Type | Inputs Normalized Into the Hash | Role |
| --- | --- | --- |
| **Shipping address** | address lines 1 and 2, city, postcode, country (lowercased, punctuation removed, common abbreviations such as "st" → "street" expanded) | Identity-grade — links accounts |
| **Billing address** | same as shipping | Identity-grade — links accounts |
| **Phone number** | digits-only form (a leading US "1" country code is dropped) | Identity-grade — links accounts |
| **Payment method** | saved payment token ID, Stripe card fingerprint and card last-4, combined | Identity-grade — links accounts |
| **IP address** | full IPv4 or IPv6 address from the order | Corroboration only — shared NAT, mobile carriers and VPNs make it collide across unrelated shoppers, so it never links on its own |
| **Device** | the browser's user-agent string | Corroboration only — many shoppers share the same browser, so it never links on its own |

A link exists when two customer hashes share *at least one identity-grade* fingerprint. Once linked, any shared IP or device is listed alongside as corroboration. On the customer detail page you can see exactly which fingerprint types two accounts share.

---

## What It Signals

The penalty is added to the score through the `trustlens/score_signals` filter, so it applies to new customers below the Full-confidence Order Threshold too.

| Trigger | Score |
| --- | --- |
| Linked to 1–2 other accounts | -5 |
| Linked to 3–4 other accounts | -10 |
| Linked to 5+ other accounts | -15 |
| Each linked account already in the Risk or Critical segment | an additional -5 (the Link penalty setting) |
| Each linked account that is blocked | an additional -10 (2× the Link penalty) |
| No links | 0 (no signal) |

Everything adds into one signal, shown on the profile as *"Linked to 2 other account(s) (1 high-risk, 0 blocked)"*. Being linked to a risky or blocked account is the strongest fraud-ring indicator: if the account you're linked to is already classified as Risk or Critical by other modules, or has been blocked, the link costs more than the count alone.

---

## The Linked Accounts Panel

The Customer Detail page shows a Linked Accounts panel listing every link with:

- The linked customer's segment badge
- The linked customer's email (or "Guest" if no email is known)
- A Blocked badge if that account is blocked
- Which fingerprint(s) produced the link — shipping or billing address, phone, payment token, plus any shared IP or device
- The linked customer's trust score and the number of matching fingerprints
- A click-through to the linked customer's profile

This is the workflow for investigating fraud rings: open one suspected account, click through the linked accounts panel to see the others, and confirm they all share characteristics (similar order patterns, coordinated timing, shared coupons).

---

## Settings

| Setting | Default | Description |
| --- | --- | --- |
| **Module enabled** | On | Master toggle |
| **Link penalty** | 5 | Points per linked account in Risk/Critical (0–20); a blocked linked account costs double |

Both are on the Linked Accounts Detection card in **Settings → Detection**. The fingerprint rules themselves are fixed — there's no per-fingerprint enable/disable.

---

## Common Patterns

### The Email-Variation Ring

**Signature:** 5 accounts: john@gmail.com, j.smith@gmail.com, johnsmith2@gmail.com, john+orders@gmail.com, jonsmith@gmail.com. All share the same shipping address. All used new-customer coupons.

**Detection:** Shipping address hash matches across all 5 accounts. Each account shows "linked to 4 other account(s)" — -10 from the count, plus 5 for every linked account already in Risk or Critical.

**Profile:** Combined with their coupon and return signals, the accounts typically end in Risk or Critical — and as each one drops, the link penalty on the others grows.

### The Family / Household

**Signature:** 2–3 accounts at the same address with different names and different payment methods, normal order patterns, no abuse signals.

**Detection:** Address link present, but no abuse signals on any of the accounts.

**Profile:** Each account shows -5 from the linked-accounts signal but no other module signals. Likely false positive — allowlist if confirmed legitimate.

### The Reseller / Drop-shipper

**Signature:** 1 account placing many orders to many different shipping addresses.

**Detection:** Not flagged by Linked Accounts — this is the inverse pattern. Caught by Shipping Anomalies instead.

### The Block-Evasion Account

**Signature:** A previously-blocked customer creates a new account with a slightly different email and tries to place orders.

**Detection:** The payment method, address or phone matches the blocked account (a matching device alone is not enough). The new account picks up -15 (-5 for the link, -10 because the linked account is blocked), or -20 if the blocked account is also in Risk or Critical.

**Profile:** The new account drops into Caution on the link alone, even with no order history, so it stands out for review.

---

## False-Positive Watch List

Linked Accounts has the highest false-positive rate of any module. Common sources:

- **Family / household sharing.** Spouses, roommates, parents and adult children — all legitimately separate customers sharing an address. Frequency: very common.
- **Office addresses.** Multiple coworkers ordering to the same office address. Frequency: occasional, depends on industry.
- **Shared payment methods.** Parent paying for adult child's order, married couples with joint accounts. Frequency: occasional.
- **Mobile carrier NAT.** Mobile customers can share a public IP with hundreds of unrelated users. TrustLens records the IP but never links accounts on it alone.
- **Corporate VPNs.** Employees of the same company can all appear to come from the same IP — again, corroboration only, never a link by itself.

The mitigations:

- A shared IP or browser can never create a link; at least one address, phone or payment match is required
- One or two plain links cost only 5 points — the larger penalties come from the number of links and from links to accounts already in Risk/Critical or blocked
- You can allowlist confirmed-legitimate household accounts; the allowlist locks the customer at score 100 and suppresses the linked-accounts signal entirely

---

## Disabling the Module

Disabling Linked Accounts loses one of TrustLens's strongest fraud-ring detection capabilities. Only consider this if you're consistently seeing false positives that aren't being mitigated by allowlisting. When disabled:

- No new fingerprints are recorded — which also stops fresh address data reaching the Shipping Anomalies module, since it reads the same fingerprint table
- The linked-accounts penalty is no longer added to scores, and the Customer Detail panel shows "Linked accounts module is disabled."
- Existing fingerprint rows remain in the database
- The Coupons module's multi-account coupon check stops running (it listens for linked-account detections)
- Cross-account fraud-ring detection becomes blind

---

## Reading the Linked Accounts Section of a Profile

- **Signal breakdown** shows one Linked Accounts signal with the count
- **Linked Accounts panel** lists each linked customer with the fingerprint type(s) that produced the link
- **Linked Accounts panel** is where linkage evidence lives — it is worked out live from the fingerprint table each time you open the profile, and the score picks up new links at the customer's next recalculation, rather than a per-link entry being written to the event timeline

The fingerprint-type column in the linked accounts panel is the most useful piece of evidence. Two accounts linked by "Address + Phone + Payment" is overwhelming evidence of shared identity. A single shared address with nothing else is weaker — households and offices share addresses.

---

## Privacy Considerations

Linked Accounts processes personal data — addresses, phones, IPs, payment fingerprints. TrustLens handles this with several safeguards:

- **Keyed HMAC-SHA256 hashing** — raw values are never stored in the fingerprint table. Hashes are keyed with your site's own WordPress secret, so two different stores cannot cross-correlate hashes. (Regenerating your WordPress secret keys invalidates existing fingerprints; run Historical Sync afterwards.)
- **GDPR data export** includes the customer's fingerprint records
- **GDPR data erasure** removes the customer's fingerprints, which removes their links from all other accounts
- **No external sharing** — fingerprint data never leaves your WordPress install unless you explicitly configure webhooks or alerts

See [Privacy & GDPR FAQ](/docs/trustlens/faq/privacy-and-gdpr-faq/) for the full data-handling description.