How Sameveil works

Signals we link on

Strong links tie accounts into a cluster. Weak ones add weight but never form a cluster on their own, so a shared office NAT never glues strangers together.

Device fingerprintGPU, screen, fonts, time zone, hashed in the browser. Strong.

Email mailbox[email protected] is [email protected]. Strong.

Payment cardSame card across accounts, at deposit or cash-out. Strong.

Crypto walletThe payout address is the ring's shared bank account. Strong.

Phone numberNormalised to E.164 before hashing. Strong.

IP, ASN, VPN, countryHosting ranges, VPN exits, declared vs. actual country. Weak alone, decisive in combination.

Scoring you can read

Each rule adds points and a sentence. Points are capped at 100 and mapped to a decision. A household sharing one laptop stays under the review threshold; a farm of fifty does not. The thresholds are plain settings, tuned per operator.

Linked to an account your analyst already confirmed as fraud? That is the strongest signal we have, because a human did the work once.

allow — nothing to see
review — queue for a human
block_bonus — account opens, no welcome bonus
block — manual check before play

{
  "account_id": "player-48213",
  "risk_score": 88,
  "decision": "block",
  "reasons": [
    "email already used by 1 account(s) (dot/plus-tag variant)",
    "device shared with 1 other account(s)",
    "2 signups from this device in the last hour"
  ],
  "linked_accounts": [
    { "account_id": "player-48190",
      "via": ["email_hash", "device_fingerprint"] }
  ],
  "cluster_size": 2
}

Three moments, three questions

SignupIs this a new person, or one we already know under another name?

Bonus claimHas this person already had one — on any of their accounts?

WithdrawalWhere is the money going, and who else cashes out there?

Mule accounts look clean at signup on purpose. The shared card only appears at cash-out. That is why one call at registration is not enough.

What it is not

Not a black box

No "fraud probability 0.87". Every point has a sentence attached, and your analysts can disagree with any of them.

Not a gatekeeper

Sameveil never blocks anything. It answers; your platform decides. If it is slow or down, your signups keep flowing.

Not KYC

We do not verify documents or identities. We tell you when two "identities" are one person. Use it next to your KYC, not instead of it.

Abusers can change their name.
They rarely change their laptop.