Before I start, bear with me as I set up the newsletter (yes, new territory for me 😁). Thanks for subscribing. Now to the story:
1. One legit seat 💳
Real company, real person, and an overall legit subscription.
2. The team rides along 👥
Five colleagues start working off his login instead of buying their own. Normal enough.
Every SaaS company has this.
3. It goes overseas 🌍
Then the data work gets handed to freelancers abroad. Same login. But usage and devices and IPs start piling up.
4. Out of control 📈
36+ more people pile on. 41 active devices on that one seat, across 227 IP addresses and
43 different internet providers.
5. Scrape & resell 🤖
A headless browser signs in and walks the data pages for 52 straight minutes .. same
page, over and over, holding each one for the same number of seconds. Then the data
shows up in reseller rings.
What it actually cost them 💸
1. Only 1 in 5 of the people using this account were paying for it .. roughly 20% of the
revenue this client should have been worth (before the offshore sharing)
2. Prospects can now buy that data cheaper from a reseller instead of buying it from them
3. Hours, meetings and distraction spent on measures that don't hold .. rate limiting,
seat caps, manual review
How did we catch them 🥷:
1. Not how many devices. How many are active and belong to other people
2. Sharing signals: impossible travel, concurrency, velocity
3. Run them on every page, not just at auth.
4. Bot behaviour, not just hard signals
5. Known residential proxy networks scored into the risk assessment
Rules worth adding this week 🛠️
1. Track total active devices on a seat
2. Flag sharing signals (impossible travel, concurrency, velocity)
3. Do it on every page, not just at auth
4. Look for bot behaviour, not just hard signals
5. Score known residential proxies into your risk assessment
Pay attention to signals of abuse .. they often uncover something bigger. Account sharing
at this scale usually means a reseller ring behind it, and stopping it properly can be
double-digit (percentage) revenue growth.
Full breakdown in the image. It works whether or not you use Rupt.
