Fake account detection and prevention software: 8 tools compared

Fake account detection software checks a signup before the account exists: the connection it came through, the browser or device, the email address and phone number, and how the session behaves. Of the eight tools compared here, five publish prices: Maskbreak from €29 a month, IPQS from $139.99, Castle from $200 and SEON from $699, and DataDome sells Account Protect on AWS Marketplace from $27,600 a year; Arkose Labs, Sift and HUMAN quote on request. Three have a free plan: Maskbreak, IPQS and Castle. I read every fact below on the vendor’s own pages and listings on 10 October 2026, and every row links to them.

Maskbreak publishes this page and is one of the eight, so read it as a vendor’s comparison: every other row says where that tool beats Maskbreak, and Maskbreak’s own row says what it does not do. It covers software that judges a signup, not identity verification with documents and selfies; for a wider field of fraud APIs, see fraud prevention APIs compared.

Fake account detection software compared: what each checks at signup

“Not published” means I found no price on the vendor’s pages, not that the vendor has none. Neither table rates detection quality: no vendor here, Maskbreak included, publishes an independent benchmark I could cite, so test on your own signups. datadome.co answered my reader with HTTP 403 on 10 October 2026, as a bot-protection vendor’s own site may, so DataDome’s rows come from its documentation and the AWS Marketplace listings it sells through.

What fake account detection software checks at signup

A fake signup is cheap to make look new: a fresh inbox, a fresh address from a proxy pool, a fresh browser profile. The tools differ in which of those they look past.

• The connection. A VPN, a proxy, a Tor exit or a cloud server. Residential and mobile proxies give each fake account a home or phone connection of its own, and an IP reputation list knows only the exits it has already seen, as the proxy detection API comparison explains. Arkose Labs, Castle and IPQS return proxy and VPN flags; Maskbreak reads the exit of the live visit and names the VPN or proxy service when known.
• The browser or device. Scripted signups run automated browsers such as headless Chrome, and people who open accounts by hand use fake browsers that invent a new device for every profile, or emulators and virtual machines. A device ID also ties accounts made on one machine together. Maskbreak names a fake browser with its own reason, antidetect_browser; the guide to detecting fake browsers shows what that check sees.
• The identity. An email address can be checked against disposable-mail domains (Arkose Labs, SEON, Castle, IPQS and Maskbreak document this), for signs that it was generated or is a variation of another (Castle), or for the online accounts registered to it (SEON). A phone number can be checked for VoIP and prepaid lines (IPQS). Maskbreak checks only the domain: see disposable email detection.
• The behaviour. Typing rhythm, mouse movement and how a form is filled in (SEON, HUMAN), bursts of signups per device, address or account (Castle), and what the account does after signup (HUMAN, Sift). Maskbreak has no behaviour checks.

What comes back differs as much: a score your rules act on (IPQS, SEON, Sift), a recommended action (Castle’s from policies you write, DataDome’s with reasons), a challenge the vendor runs (Arkose Labs, HUMAN), or a decision with named reasons from a default policy you can change (Maskbreak). A score needs thresholds and a challenge costs real people time, so decide which you want before you compare detection.

Fake account prevention software prices: who publishes them

• Maskbreak: Free, 10,000 visitor checks a month; Starter €29 a month (50,000), Growth €99 (250,000), Scale €299 (1,000,000) and Enterprise from €990, excluding VAT (pricing).
• IPQS: Free, 1,000 lookups a month and at most 35 a day; Startup $139.99 a month (5,000), SMB Basic $599.99 (10,000) and SMB+ $1,149.99 (75,000), or $1,199.88, $5,999.88 and $11,988 a year. On 10 October 2026 the plans page did not draw its table; these figures are the plan data in its source.
• Castle: Free, $5 of API usage a month, about 1,000 Risk API calls, to “evaluate Castle’s solutions for free before going live”, with no overages; Pro $200 a month including $200 of usage, then $0.005 a Risk or Filter call; Enterprise from $4,000 a month (pricing).
• SEON: Starter $699 a month for 2,500 fraud checks, 10 users and 50 custom rules; Premium on request (pricing). The trial is on request too: “two seats, 500 manual checks per month, and email support”, if SEON decides you qualify.
• DataDome: on AWS Marketplace, sold by DataDome, Account Protect costs from $27,600 for 12 months, up to 600,000 requests a month, and “requires a subscription to DataDome Bot & Online Fraud Mitigation”; the Bot Protect listing starts at $45,960 for 12 months, up to 100 million requests a month, with a trial “according to the free trial terms set by the vendor”.
• Arkose Labs, Sift and HUMAN: no published price. Arkose Labs and Sift have no pricing page, HUMAN’s plans page lists two plans without prices, and all three offer a demo instead.

The units differ, so compare on your own volume: Maskbreak counts visitor checks, IPQS lookups, SEON fraud checks and DataDome requests, while Castle charges each Risk or Filter call against a dollar budget.

How Maskbreak answers a fake signup

Your page loads Maskbreak’s browser script, and your server sends what it collects to POST /v1/evaluate, with the signup’s email address if you want it checked. Computed with the code that answers customers, a scripted signup from a cloud server gets this back:

The block comes from the automated browser; a cloud server alone is only context. Other signups, computed the same way:

A VPN on its own asks for review, never a block: plenty of real people sign up through one. A throwaway inbox, a clock in the wrong country or a virtual machine raises an allow to review and never blocks on its own, while an automated or fake browser, a recognised proxy or a Tor exit blocks by default. The reason codes are listed on /api, and the Rules tab can change the action for most of them. Send the ID you are giving the new account as accountId, and device.linked_accounts counts how many of your accounts that device has been seen with; above one, the reasons add multi_account_device, which changes no decision unless you set a rule for it (see preventing multi-accounting).

What Maskbreak does not do, so you can weigh it against the other seven:

• No challenge: a signup it finds nothing against gets allow, and if you want a puzzle or an emailed code on review, your app shows it.
• No phone check, and an email address is checked only for a disposable-mail domain.
• No behaviour checks and no view of what an account does after signup.
• Browser visits only: there is no iOS or Android SDK.
• A check sent without the browser token is answered allow with degraded: true, so hold those rather than read them as clean; a bare IP lookup, GET /v1/lookup, checks only Tor exits and published cloud ranges.

Notes on each fake account detection tool

Arkose Labs

Arkose Labs says it shuts down fake account creation “by making it cost-prohibitive for attackers” (fake account creation). Its Bot Manager weighs “225+ risk signals” and deploys “dynamic challenges that evolve in real time”. The Verify API returns a risk_band, proxy, VPN and Tor flags, a device ID with device_spoofing_detected, and email fields such as is_disposable and is_private_relay; Device ID and Email Intelligence are products of their own on its platform. Its warranty covers “automated credential stuffing attacks on logins”, with incident response costs up to $1m: logins, not signups. See Maskbreak vs Arkose Labs.

SEON

SEON’s Fraud API “combines our email, phone number, IP, BIN, and AML APIs with device fingerprinting” in one call, with device data from a JavaScript agent and iOS and Android SDKs. Its Email API reports “the number of online profiles found when checking on more than 290 online platforms”, data breaches and disposable domains, and its device flags include suspected AI agents, device farms, emulators, remote control and unusual typing, mouse movement and form filling. Its Premium plan adds case management and AML compliance. See Maskbreak vs SEON.

Sift

Sift says it “analyzes every signup in milliseconds using a global data network and fraud patterns no single business could see alone”, with models that combine device fingerprinting, identity signals and its Global Data Network, a no-code decision engine with workflow simulation, and a console for analysts. The Sift Score API returns “a fraud risk score (0-100)” and “the top 20 risk signals explaining why an action was flagged”. See Maskbreak vs Sift.

Castle

Castle checks signups through its Filter API, which “is meant for checking the behavior of anonymous users” (integration guide): a browser SDK creates a request token, your server sends it with a $registration event, and Castle answers allow, challenge or deny from your policies. Until you add one, every answer is allow. Its signals include headless_browser, spoofed_device, residential_proxy_access, disposable_email_domain, generated_email, multiple_aliases_per_email, high_activity_device and multiple_accounts_per_device, and it has browser, iOS and Android SDKs. See Maskbreak vs Castle.

IPQS

IPQS (IPQualityScore) sells separate lookups: proxy detection returns a fraud_score with proxy, vpn and tor flags for an address, email validation flags disposable, leaked and recent_abuse, phone validation flags VOIP and prepaid lines, and a device fingerprint script returns a device_id, fraud_chance and bot_status. Its device page says “Device fingerprinting can help identify when multiple registrations originate from the same device”. See Maskbreak vs IPQS.

DataDome

DataDome’s Account Protect takes a registration event from your server and recommends allow, deny, review or challenge, with reasons; “your application will still make the final decision”. Its AWS Marketplace listing says it reads “user data, including email patterns, login times, device information, and behavioral cues”, and the Bot Protect listing says DataDome “analyzes every request to your mobile app, website, and/or API”. See DataDome alternatives.

HUMAN

HUMAN Security’s Sightline Cyberfraud Defense is its product for fake accounts. Its fake accounts page says it evaluates “actions taken at registration and within accounts”, groups accounts “with common identifiers (e.g. email)” and analyses “natural browsing patterns, mouse movements, and timing irregularities”. Its plans list default actions (block, password reset, challenge), its own Human Challenge and attacker network grouping. See HUMAN alternatives.

How to test fake account detection software before you buy

Run the same signups through every candidate on your own staging form, and keep the raw answers:

• Same signup, same minute: proxy exits rotate, so send each case to every candidate within a minute.
• Count false positives on real people: run the check in log-only mode on your real signups for a week and read what it would have blocked, as in rolling out fraud detection.
• Count the cost of a challenge: if a tool shows one, count how many real people finish it.

Which fake account prevention software fits your signup?

• You want a free plan you can run in production: Maskbreak’s Free plan covers production use within 10,000 visitor checks a month; IPQS’s free plan has 1,000 lookups a month, and Castle’s free budget is for evaluation before going live.
• Your fake accounts arrive with real-looking identities: SEON looks up the person behind an email address or phone number, and IPQS validates both.
• You want a challenge in front of risky signups: Arkose Labs and HUMAN run their own; Castle and DataDome return a challenge action for your app to show.
• A fraud team works the cases: Sift, SEON and HUMAN come with consoles and investigation tools.
• Bots hit the whole site, not only the form: DataDome and HUMAN protect every request.
• Your signups happen in a browser and you want the tooling named: Maskbreak returns the fake browser, automation or proxy behind each blocked signup as a reason code, from one call. For the whole signup flow, see stopping fake signups and Maskbreak for SaaS.

Maskbreak’s Free plan includes 10,000 visitor checks a month with no card, and paid plans start at €29 a month, excluding VAT (pricing). To see the answer for your own connection, open the live check on the homepage.