Fraud Prevention for Prize, Raffle and Auction Sites: VPNs, Multi-Accounting and Bonus Farming

Prize, raffle and auction sites attract a particular kind of abuse. People open extra accounts to farm sign-up bonuses and referral rewards, hide behind VPNs to get round country rules, or use one device to run several accounts in the same draw. This guide covers the protections built into PrizeX, RaffKing and BidKing, what each one actually does, and what it can't stop, so you can set them up with realistic expectations.

Where the fraud tools live

The Fraud Prevention screen is under Security › Fraud Prevention.

• Included in PrizeX, RaffKing and BidKing Pro.
• On BidKing Starter and Plus, it's available from Add-ons in your admin panel.

The screen has four parts:

• Activity, a log of fraud events you can filter. Each event opens to show the player, their risk score, and other accounts seen on the same device or IP.
• Banned by the system, with an Unban button.
• Shared devices.
• Rules, where every check and threshold is set.

The checks themselves run in the core of the software. Once you've activated the add-on and saved your rules, they keep applying even if you deactivate it later. Deactivating only hides the screen.

VPN and proxy detection

• How it detects: visitors' IP addresses are checked with proxycheck.io, and results are cached for 24 hours. Without a key you get 100 lookups a day. A free proxycheck.io key raises that to 1,000.
• What counts as a VPN: proxies, VPNs and Tor, plus data-centre and hosting addresses unless you switch that part off.
• Three modes:
  • Off.
  • Watch only, the default. It logs VPN use and blocks nothing.
  • Block. It refuses VPN users at sign-up, and refuses their bids, ticket purchases, mystery-box openings, spin-wheel, slot, scratch-card and arcade plays, daily bonus claims, wallet transfers and withdrawal requests.
• What it doesn't block: signing in, shop checkout and wallet top-ups.
• If the lookup service can't be reached, the action goes through and the error is logged. A lookup failure never locks out genuine customers.
• Behind a proxy or CDN? Make sure the site sees your visitors' real IP addresses. List your proxy's addresses in the site's .env file as trusted proxies, or every visitor looks like the same address.

One device, one account

• How a device is recognised: by a long-lived browser cookie, combined with network and browser details. The first account seen on a device owns it.
• With single-device enforcement on, a second account on that device can't sign up, and its bids, tickets and other protected actions are refused.
• Auto-ban can ban accounts once a device carries a set number of them, 2 or more.
• Be realistic about it. This is a cookie-based check, not a hardware fingerprint. Someone who clears cookies or uses another browser gets a new device ID. It stops casual multi-accounting, not a determined fraudster. Combine it with the other checks, and look at the Shared devices tab.

Auto-bans and the risk score

Three auto-ban rules can each be switched on with their own threshold:

• Repeated VPN attempts. This needs Block mode.
• Too many accounts on one device. This needs single-device enforcement on.
• Too many country changes. This needs the VPN check on, because that's where the country comes from.

The Rules screen warns you when a rule can't take effect as configured.

A banned account can't sign in and is signed out on its next page. Unbanning from the Fraud Prevention screen also resets its counters.

Every account has a risk score from 0 to 100, built from its fraud events in the last 30 days. The bands are Low, Medium, High and Critical.

• Where it shows: on the customer's profile, in the Users list (which you can sort and filter by it), in the withdrawal review panel and in manual payment review.
• It never blocks anything by itself. It's there to help you decide.

Bonus and referral farming

These protections work even without the Fraud Prevention add-on:

• The sign-up bonus is withheld when the device is already linked to another account, or when too many accounts sign up from one IP address or network in 24 hours. The referrer isn't paid for those sign-ups either. The account itself is still created. A shared connection, such as a mobile network or an office, can legitimately produce many sign-ups, so the bonus is what's withheld.
• A referral code has to belong to a real account before a referral bonus pays.
• A daily referral cap limits what one referrer can earn from referrals in a day. It's off by default, so set it if you pay referral rewards.

Limits on draws, payments and withdrawals

• Per-person ticket limit. Each lottery or raffle can cap the tickets one person can hold, so one account can't buy up a draw.
• Pending payments are checked with the provider. For gateways that support it, Check with gateway on Payment requests asks the provider about a pending payment and settles it only if the amount and currency match. Every check is logged.
• Withdrawals are reviewed by you. If your store lets players cash out, every withdrawal request waits for your approval, and there are per-method minimums and maximums. The review panel shows:
  • the account's age, with a warning if it's under 14 days old;
  • its risk score;
  • what it bought, earned and cashed out;
  • whether the payout account is shared with other players.
• Sign-in limits. Five failed sign-ins in 15 minutes locks further attempts, for customers and for the admin.
• Optional add-ons: reCAPTCHA v2 on sign-in and sign-up, and email verification codes at sign-up.

What these tools can't do

• They don't replace your payment provider's own fraud checks. Card fraud, 3-D Secure and chargebacks are handled by your gateway and its dashboard.
• They don't make your site legal anywhere. Blocking VPNs makes it harder to get round country rules, but it isn't a substitute for knowing where you're allowed to operate. The operator is responsible for compliance, so check with a local lawyer.
• They don't verify age. Sign-up asks for a date of birth and refuses anyone under your minimum age, which is at least 18 once an adult-only add-on is active.
• Watch before you block. Run VPN detection in Watch mode for a week or two, look at the Activity log, and only then switch on Block mode and auto-bans. That way you see how many genuine customers they would affect.

Common questions

Can PrizeX block VPN users?

Yes. In Block mode, VPN, proxy and Tor users are refused at sign-up and when they bid, buy tickets, play the spin wheel, slots, scratch cards or arcade games, claim bonuses, transfer or withdraw. Watch mode, the default, only logs them.

How does it stop one person opening many accounts?

It recognises devices with a long-lived cookie plus network and browser details, and can refuse a second account on the same device. It also withholds sign-up and referral bonuses when an IP or device has been used for other accounts. Clearing cookies can get around the device check, so treat it as one layer.

Does the risk score block accounts automatically?

No. It's shown on profiles, in the Users list and when you review withdrawals and manual payments, to help you decide. Bans come from the auto-ban rules you switch on, or from you.

Do the protections stop if I deactivate the add-on?

No. Once the add-on has been activated and your rules saved, the checks keep running with those settings. Deactivating hides the screen and log. Deleting the add-on removes its settings.