preventing fake signups

[ahmed]

my site has a feedback system similar to ebay's. Unlike ebay though, I don't charge any fees from my members and require nothing more than an email address and password to create a user account. Recently I've had people creating fake accounts in order to leave feedback for their 'main' account, thereby increasing their positive feedback.

I've tried a combination of different methods to try and stop this: watching for more than x positive feedbacks for a particular user from the same IP address and/or user agent, insisting that new members can only leave feedback after x days, personally reviewing all feedback and related activity to see if I think it's genuine... these methods are either inpractical, give too many false positives or are too restrictive on the user.

anyone have any other ideas?

[Brett_Tabke]

No way really. YOu can sure cut down on problems though by no allowing freebie Yahoo, Gmail and Hotmail signups. Those are the worst of the offenders.

[whoisgregg]

You'd still be left with all the sneaky webmasters who get every variation of an e-mail address to domains they own.

For example: I could register at a site as [e-mail], [e-mail], [e-mail], etc. and I get all those e-mails and can respond to each as a separate account. (But I'm a webmaster and, like all webmasters, I am unintentionally the bane of other webmasters everywhere -- EXCEPT when I am on webmasterworld.) Never design a site to deal with webmasters... I bet Brett would agree on that. :)

[zollerwagner]

I'd agree with most of the above, but there are a few things that can be done to cut out some of the fake registrations.

A lot of the fakers don't provide real addresses, so we require email verification in two ways. First, they have to input their email address twice. A server-side script tests to be sure the addresses agree. This is mostly to be sure that they haven't made a typo.

Then, the site automatically sends them an email to the address they gave. There is a link in the email that they have to click on in order to have the registration "activated" on the server. The new registrants don't become fully active members until they click on that link. That means that they can't log in until they're "active".

You'd be amazed by the high percentage of people who never complete the process. Some probably don't get it, even though it is explained on the site and in the email. Some are clearly fakers. After a period of time the non-actives are removed from the system.

Of course, this won't stop people from registering twice with working addresses.

[SEOMike]

Is there some kind of transaction going on at all? If so you could do like Ebay and allow only prople who have completed a transaction with the person leave feedback.

If Amazon can't stop shilling [dictionary.reference.com] than you might be out of luck!