I'm building a website that gives awards to users. After each game I ask the user for their email and send them an email to claim their gift.

Is there anyway to make sure that one user isn't simply opening new emails to take all the awards ? IPs can be changed so restricting them isn't a solution.

  • The short answer: no, it's really not possible. Normally there is more nuance than that and I might aim for an answer that gives some options, but in this case, unless you have some verifiable personal information (SSN?), a sufficiently motivated user will be able to change IP, email, name, address, etc... easily, quickly, and automatically Commented Mar 16, 2020 at 17:34
  • 2
    Aren't you taking the wrong approach? If the award is for investing the time to play the game until some goal is reached than it should not matter if another email gets used, just make the goal hard enough to match the value of the users time. But if the game is just an excuse/abuse to actually collect as much emails as you can then I'm actually ok with users fooling you this way. Commented Mar 16, 2020 at 18:16
  • 1
    Why do you care that the same person might get multiple awards? What's the impact on you? How likely do you think this is going to happen? It seems like your approach in offering awards needs review.
    – schroeder
    Commented Mar 16, 2020 at 18:19
  • It's not exactly a game(it's just a random gift generator), everyone who uses it will get an award and it only takes a minute. It is an advertisement campaign. There is a limited amount of awards and I don't want a few people claiming them all.
    – webdevq1q
    Commented Mar 16, 2020 at 18:37
  • 2
    ... note that some people are going to be giving a "fake" (as in, not their usual, everyday email account), just because it's a marketing campaign. This is why so many of these campaigns moved to social media - because you could check the age of the account, and whether they had connections, which is essentially impossible with a bare email address. Can you tie it to some sort of similar account - for example, if it's for xbox gift cards, make them have a gamertag with history. Commented Mar 16, 2020 at 21:37

1 Answer 1


There isn't a foolproof way to stop this completely, the best you can do is to make it somewhat difficult for non-savvy users.

Primary tracking methods:

  • Cookies - Cookies are the first level of detecting previous visitors. Using a unique cookie (like a nonce) has virtually zero false positives when asserting a user is a previous visitor. Fortunately (or unfortunately in your case) it can be easily evaded by deleting/blocking cookies or using "private browsing" or "incognito" mode.

  • IP Address - The user's IP address would be the second level of detection used if no matching cookie was received. If the IP matches, it's a decently high level of confidence that it was the previous visitor

    Side Note: You could also check if the IP address of the user is a known VPN, Proxy, or Tor exit node, and forbid awards to those if you're really worried about it.

  • ETag (web caching) - Servers can use the ETag header on responses for pages that the browser might potentially cache. The ETag contains a unique value for the version of the resource being requested, such as ETag: 0123456789. The next time the browser requests that resource it will send a If-None-Match: 0123456789 which either tells the server if it needs to send the latest version of that resource if it doesn't match, otherwise tells the browser to grab it from their cache if it does match. This was originally designed for saving bandwidth, but of course this can also be used for tracking.

Browser/Device Fingerprinting:

If still not able to assert if the user has already received an award with the primary methods, and you're paranoid about people abusing the system, then your next line of detection would be browser/device fingerprinting. This can be decently sophisticated when combining multiple metrics to generate a virtual fingerprint. Examples of such metrics:

  • HTTP Headers
    • User-Agent (Browser and OS version)
    • Accepted MIME types
    • Locale/Language
    • etc.
  • HTML5 Canvas and WebGL fingerprinting
  • WebRTC fingerprinting
  • Enumeration of browser plugins or extensions
  • AdBlocker presence
  • SSL/TLS protocol and cipher enumeration
  • Supported Fonts enumerated with javascript
  • Performance Bench marking with Javascript
  • Web Audio API fingerprinting

Web tracking software can factor these metrics together with different weighted scores for each one, to assert the user is a previous visitor with some degree of confidence. Of course if your target audience is tech-savvy people, they can fairly easily avoid tracking.

Curious what your device fingerprint looks like?

These two sites might surprise you with how much information they were able to obtain by using some of these techniques listed above and possibly more:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .