How to prevent referral fraud on your waitlist (without killing legit signups)
The short version: most waitlist referral fraud follows four patterns — same-device signups, disposable email farms, velocity spikes, and IP clustering. You stop it with invisible defenses first (device fingerprinting, email validation, velocity rules, honeypots) and reserve visible friction like CAPTCHA or double opt-in for when fraud gets severe. Perfect prevention is impossible; the goal is raising the cost of gaming until it isn't worth the attacker's time.
It's 11pm on a Tuesday. You pour a coffee, open your waitlist dashboard, and feel your stomach drop.
The top of your leaderboard says "mike_r — 2,047 referrals." Nobody else has more than 14.
You click into Mike's referred users and start scrolling. [email protected]. [email protected]. [email protected]. [email protected]. All variants of the same name. All signed up in a 47-minute window last Friday night. All from what looks like the same IP block. Your "refer 10 friends, win early access + a free year" campaign just got detonated by one person with a script and an evening to kill.
If you've shipped a referral-powered waitlist, some version of this has happened to you — or it will. Fake account creation is now the single most common attack on consumer signup flows, accounting for roughly 46% of all fraudulent activity tracked by Arkose Labs in 2025, and Imperva reports that bot traffic surpassed human traffic on the open web in 2024 — sitting at 51% of all requests. Your referral leaderboard is a neon sign advertising free money. It will attract bots and bored 14-year-olds.
Here's the playbook to prevent it, detect it when it happens anyway, and clean it up without torching your legitimate signups.
Why Referral Fraud Happens
Three forces collide, every time.
Real incentives attract real attackers. The moment your leaderboard promises early access, a discount, or a prize, you've created a market. Crypto airdrops learned this the hard way — LayerZero's CEO Bryan Pellegrino publicly estimated that only 400,000 to 600,000 of the project's 6 million eligible wallets were real users, and CoinDesk found that entities controlling multiple wallets captured nearly 48% of Arbitrum's airdrop. Waitlist prizes are smaller, but the math is the same: if the reward is worth more than the labor, someone will put in the labor.
Friction is near-zero. A waitlist signup is an email in a form. There's no credit card, no shipping address, no phone verification — you removed those things on purpose to maximize conversion. That's also what makes your signup the easiest surface on the internet to abuse.
Public leaderboards invite gaming. Gamification is a double-edged sword. Showing position and top-referrer rankings is exactly what makes referral programs viral — and exactly what turns them into a competition where some users will cheat to win. The mechanic that drives growth is the same mechanic that can destroy trust if you don't police it.
The Four Patterns of Waitlist Referral Fraud
Almost every case I've seen in the wild reduces to one of four patterns. Usually several at once.
1. Same-Device Signups
What it looks like: one human, one laptop, one browser, dozens or hundreds of fake accounts created by clearing cookies, opening incognito tabs, or swapping email addresses.
How to spot it in your data: if you're logging a device fingerprint alongside each signup (more on that below), you'll see the same fingerprint hash appearing against 30, 50, 500 different email addresses. Without fingerprinting you'll see softer signals — the same user-agent string, the same screen resolution, the same narrow cluster of cookie-less sessions, all funneling referrals to one referrer code.
How to catch it: device fingerprinting is the silver bullet here. It survives incognito mode, cookie clearing, and even VPN switches, because it's derived from the hardware and software of the device, not from anything stored in the browser.
2. Disposable Email Farms
What it looks like: fifty signups from @mailinator.com, @yopmail.com, @guerrillamail.com, @10minutemail.net, @tempmail.io, or a long tail of lookalike throwaway domains you've never heard of.
How to spot it in your data: sort your subscriber list by email domain and look for domain concentrations that aren't Gmail, Outlook, iCloud, or your target demographic's corporate providers. The open-source disposable-email-domains list maintained by the PyPI team currently tracks thousands of known throwaway providers, and commercial aggregators track 55,000+.
How to catch it: real-time email validation at signup — blocklist lookup, MX record check, and syntax validation. Disposable domains are the lowest-effort attack, which is exactly why they're the most common.
3. Velocity Spikes
What it looks like: one referrer code suddenly picks up 50 signups in 10 minutes at 2am local time, then goes quiet.
How to spot it in your data: plot signup timestamps grouped by referred_by code. Legitimate referrers produce a spread — a burst when they first share, then a long tail over days or weeks as their network processes the recommendation. Fraudsters produce a single dense blob, often at odd hours, because scripts don't wait for friends to wake up.
How to catch it: rolling-window velocity rules. If more than N new signups arrive attributed to the same referral code within M minutes, flag the batch for review or automatic rejection.
4. IP Clustering
What it looks like: dozens of signups from the same IP address, or from a small range of IPs inside one ASN (Amazon EC2, DigitalOcean, a residential proxy provider).
How to spot it in your data: store the client IP on every signup. Group by IP (or by /24 subnet) and look for IPs with more than a handful of associated signups. Also flag datacenter ASNs — legitimate users don't sign up from us-east-1.
How to catch it: IP-based rate limiting plus ASN checks. Treat residential-proxy networks and datacenter IPs as high-risk. Don't rely on IP alone — a single household IP can have five legitimate signups, and a determined attacker can trivially rotate IPs — but in combination with fingerprinting and velocity, IP clustering closes a lot of doors.
Detection Techniques That Actually Work
Every serious defense is layered. No single signal catches everything; the compound of three or four signals catches almost everything worth catching.
Device Fingerprinting
A browser fingerprint is a hash derived from 50+ signals your browser exposes to any JavaScript running on the page: user-agent, screen resolution, timezone, installed fonts, navigator.hardwareConcurrency, navigator.deviceMemory, canvas rendering quirks, WebGL renderer string, AudioContext output, language, plugins, and more. Combined, these produce an identifier that persists across incognito windows, cookie clearing, and most casual evasion attempts — because none of those actions change your GPU, your fonts, or how your specific device renders a hidden canvas element.
The landmark 2010 EFF study by Peter Eckersley showed that 83.6% of browsers had a completely unique fingerprint in a sample of 470,000, rising to 94.2% if Flash or Java was enabled. Modern replications on larger datasets show desktop uniqueness still sits above 90%. Commercial providers like Fingerprint.com claim 99.5% accuracy by combining client-side signals with server-side TLS and network characteristics.
What fingerprinting is bad at: mobile devices are more homogeneous (no plugins, uniform OS versions) so fingerprints there are less unique. Sophisticated attackers using anti-detect browsers like Multilogin or GoLogin can spoof 50+ fingerprint parameters per profile. But those tools cost money and time — which is exactly the point. You're not trying to stop a state actor; you're raising the cost above what your reward is worth.
Email Validation
Three layers, ordered cheapest-to-most-expensive:
- Syntax validation — reject anything that isn't a valid RFC-5322 email.
- Disposable domain blocklist — reject known throwaway providers at signup time.
- MX record check — DNS lookup for the domain's mail servers. No MX records means the domain can't receive email, which means it's either fake or dead.
Optionally layer in SMTP handshake validation (connect to the MX host, issue RCPT TO, read the response) — but many providers return catch-all 250 OK for everything, so treat it as a soft signal.
Rate Limiting
Put hard caps on your signup endpoint: 3–10 signups per IP per hour, a daily ceiling, and a per-fingerprint cap. Use token-bucket algorithms so legitimate burst traffic (a viral tweet, a newsletter send) still works, and return proper HTTP 429 responses with Retry-After headers so well-behaved clients back off. Rate limiting alone won't stop a motivated attacker with a proxy pool, but it reliably crushes script-kiddies and accidental loops.
Honeypots
Add a hidden form field — call it website or company — styled off-screen and set to tabindex="-1", autocomplete="off". Legitimate humans never see it. Dumb bots crawl the HTML and fill every field they find. Any submission where the honeypot is populated gets silently rejected. Pair with a server-side timestamp: if the form was submitted in under 2 seconds, it's a bot.
Honeypots cost nothing, have zero UX impact, and eliminate a huge share of unsophisticated spam. Just avoid obvious field names like bot_trap, and watch out for browser autofill populating generically-named fields for real users.
CAPTCHA as a Last Layer
CAPTCHA has a place, but it's a last resort, not a first one. Modern invisible options like Cloudflare Turnstile are free up to a million requests a month and mostly resolve silently without presenting a puzzle. They run a browser-attestation check and a small proof-of-work challenge behind the scenes. We rolled native Turnstile support into Waitlister for exactly this reason — it's the least-friction visible defense available.
All of the above — device fingerprinting, email validation, velocity rules, IP clustering, honeypots, Turnstile — are built into Waitlister's referral fraud detection out of the box. You do not need to stitch this together yourself.
Detection Techniques That Don't Work (Or Aren't Enough on Their Own)
A short list of things founders reach for that disappoint.
Simple CAPTCHAs as a standalone defense. Image-puzzle CAPTCHAs are trivial for modern AI solvers — a 2023 USENIX Security study found bots beat most of them at 85%+ success rates, often faster than humans. Meanwhile Baymard Institute measured an 8.8% first-try failure rate for real users, rising to nearly 30% on case-sensitive CAPTCHAs. You're blocking fewer bots than you think and losing more humans than you realize.
Blocking by email domain alone. Too coarse. You'll miss creative fraudsters who register a throwaway domain for $1.99, and you'll block legitimate Gmail users who make a burner address specifically to sign up to your product. Domain blocking is a signal, not a verdict.
Manual review at scale. It works for your first 200 signups. It does not work for your next 20,000. Your time is the most expensive input in your business, and forensics at scale is the kind of thing that eats a weekend and produces a spreadsheet nobody acts on. Automate the detection; save your judgment for edge cases.
Trusting referrer self-reports or "flag suspicious users" buttons. Nobody reports themselves. The users most likely to flag a competitor on the leaderboard are the ones gaming it second-hardest.
Cleaning Up a Waitlist That's Already Been Gamed
If you're reading this after the damage, here's the remediation playbook.
- Export your full subscriber list and sort by referral count descending. Your fraud lives at the top. Focus there.
- Investigate the top 5–10 referrers manually first. Look at the emails they sent — are they name variants? Same domain? Look at the signup timestamps — are they clustered? Look at IPs and fingerprints if you have them.
- Run email validation against your existing list. Any halfway-decent bulk email validator (Kickbox, ZeroBounce, NeverBounce) will flag disposable domains and invalid MX in one pass. Expect to find some collateral damage too — disposable addresses from users who signed up legitimately but didn't want to commit their real inbox. That's fine; those users weren't going to convert anyway.
- Look for timestamp clustering. For each top referrer, compute the median gap between their referred signups. Legitimate referrers have gaps measured in hours or days; fraudsters have gaps measured in seconds.
- Communicate transparently — or don't. You have two options. Silently remove fraudulent accounts and say nothing (lower risk, but your community may notice leaderboard shuffles). Or announce a cleanup, explain what you found, and reset the leaderboard (higher trust, stronger signal that you take fairness seriously). For most consumer waitlists, announcing it publicly is the right call — it's great social proof that your program is worth cheating at, and it tells legitimate referrers you have their back.
- Decide your prize policy before you announce. If the cheater is disqualified, does the #2 runner-up win? Write the rule before the post goes live, not after the complaints arrive.
- Enable fraud detection before you relaunch. Turn on device fingerprinting, email validation, velocity rules, and IP clustering before you restart the campaign. If you're on Waitlister, this is a toggle — or pass fingerprints and client IPs through the Add Subscriber API directly.
The Hard Tradeoff: Fraud Prevention vs Signup Friction
Here's the uncomfortable truth: every layer of protection you add costs you some legitimate signups.
GetResponse's analysis of 2.76 billion emails found that single opt-in lists grow 20–30% faster than double opt-in lists. Mailchimp's data, historically, showed DOI confirmation rates as low as 37%. CAPTCHA adds real abandonment — Forrester has reported that 19% of consumers have abandoned a site entirely because of a CAPTCHA. And every additional form field, according to Baymard, measurably drops completion.
That's why the order matters. Start with invisible protections — device fingerprinting, velocity analysis, honeypots, IP and email validation. They have zero user-visible impact. Layer in semi-visible protections like Turnstile only if the invisible layer isn't enough. Reach for fully visible protections like double opt-in or phone verification only when fraud is severe or when the reward is valuable enough to justify the conversion hit.
The goal isn't zero fraud. Zero fraud is impossible short of manually onboarding every user. The goal is raising the attacker's cost above the value of your prize. If winning your early-access slot requires an anti-detect browser subscription, a residential proxy pool, and four hours of scripting, most would-be cheaters will move on.
As a rough guideline: if less than 1% of your signups look suspicious, you're fine — that's background noise on the open internet. If you're seeing 5% or more, you have a problem that's actively costing you legitimate users' trust in the leaderboard.
Frequently Asked Questions
People are signing up with fake emails on my waitlist to farm referrals — how do I stop this without killing legit signups? Start with the three invisible defenses: device fingerprinting (catches same-device multi-accounting), disposable email domain blocking (catches the bulk of throwaway addresses), and velocity rules (catches scripted bursts). None of these add a single click or field to your signup form, so legitimate conversion is untouched. Only add visible defenses like CAPTCHA or double opt-in if the invisible layer isn't enough.
My referral leaderboard is being gamed by one person with 2,000 fake signups. How do I detect and clean this up? Sort your list by referral count, investigate the top referrers manually, look for email-pattern clustering, timestamp clustering, and repeated IPs or device fingerprints. Run a bulk email validator against the suspect accounts. Remove the fraudulent signups, announce the cleanup, reset the leaderboard if needed, and enable automated fraud detection before relaunching. The playbook above walks through each step.
Can't fraudsters just use a VPN to get around IP detection? Yes — and that's exactly why IP detection alone isn't enough. A VPN switches your apparent IP; it does not change your device fingerprint, your installed fonts, your GPU, or the fact that your browser submitted the form in 0.4 seconds. Layered defense is the point.
What about users who legitimately share a household IP? You look for patterns, not single signals. A household might generate three or four signups from the same IP over a month — different fingerprints, different email domains, spread over days. A fraud farm generates 80 signups from the same IP in an hour, with the same fingerprint and sequential email addresses. The combination is what's suspicious, not any one signal.
Should I use double opt-in on a referral waitlist? Tradeoff. DOI catches a lot of fake signups — if you can't click a confirmation link, your referral doesn't count — but it typically drops your list growth 20–30% and can depress it further if your confirmation email hits spam. Morning Brew used double opt-in specifically to stop fake signups, since the newsletter is free and there's no purchase step to verify identity. For most waitlists, I'd start without DOI and rely on invisible defenses. If your prize is valuable (paid early access, hardware, real money), turn DOI on.
How many fake signups is "normal" for a waitlist? Below 1% is noise — the internet has bots, and you'll never get to zero. Between 1% and 5% is worth monitoring and tightening defenses. Above 5% means your leaderboard is being actively farmed and you should intervene. If your top referrer's numbers look wildly out of line with everyone else's, that's a stronger signal than any aggregate percentage.
Best way to stop referral fraud on a pre-launch waitlist? The short answer: use a waitlist tool that does this natively so you don't have to build it. Layered, invisible detection (fingerprinting + email validation + velocity + IP clustering) stops the 95% of attacks that come from amateurs and scripts. Add Turnstile if you need another layer. Reserve double opt-in for prizes that are actually worth cheating for.
Keep Your Referral Program Honest
If you'd rather not build fraud detection from scratch, Waitlister ships with it out of the box:
- Device fingerprinting, disposable-email blocking, velocity analysis, and IP clustering, all enabled with one toggle — read the referral fraud detection feature page for the full list.
- Native Cloudflare Turnstile support when you want another layer without the friction of puzzle-style CAPTCHA.
- A real referral program with leaderboards, tiered rewards, and the telemetry you need to spot fraud before it tops the leaderboard.
If you want to go deeper on the growth side, start with our viral referral program guide and run the numbers on your expected growth with our viral coefficient calculator.
Build the leaderboard your real users deserve. Don't let one person with a script own it.