Blog / Fraud analytics, Account takeover, Link analysis & graph databases
Today we explore ecommerce burner accounts and why it's important for merchants to home in on and ban them before they do harm.
25 August 2026
A fraudulent order may appear to come from a new customer – but in the case of burner accounts, it may be one action within an interconnected network of accounts, devices, payment instruments and delivery destinations controlled by the same cybercriminal or organized group of fraudsters.
In today's article, we're going to look into ecommerce burner accounts: what they are and how they are used – and, importantly, why merchants would be wise to detect and ban them before they do harm.
Also called disposable accounts, burner accounts are online shop accounts created, acquired or repurposed for temporary fraudulent or abusive use – and then abandoned by the perpetrator once restricted, linked to losses or no longer useful.
They are not a standalone fraud type but disposable infrastructure used across payments, promotions, refunds, marketplaces, credit and other ecommerce journeys. Several burner accounts together can be used for multi-accounting schemes, as well.
Burner accounts may rely on fabricated, stolen, synthetic or genuine identity information: A fake account is defined by whether its identity is false or misleading, while a burner account is defined by how replaceable it is.
Fraudsters have myriad uses for ecommerce burner accounts, as their purpose is to appear legitimate in order to enable fraud and abuse. Here are some examples:
Payment and credit fraud: Disposable accounts can be used to test compromised payment credentials, place fraudulent orders or obtain goods through BNPL and other credit products. Some are used immediately; others establish a positive transaction or repayment history to better hide their intentions before increasing their spending and disappearing.
Promotion and loyalty abuse: Fraudsters can operate multiple accounts to repeatedly claim welcome discounts, referral rewards, free trials, gaming bonuses or loyalty value. These losses may appear as marketing or customer acquisition costs rather than fraud, distorting program performance.
Marketplace and payout abuse: For online marketplaces, burner accounts may operate as fake sellers, controlled buyers, workers or payout recipients, supporting false listings, collusion, stolen payment transactions, incentive abuse and rapid payout extraction.
Refund and return abuse: False non-delivery, missing item or damaged goods claims can be spread across accounts so that each appears to be a first complaint and remains below account level thresholds.
The common feature here is not the loss category, but the ability to distribute activity across identities and replace each account faster than the merchant can connect it to earlier incidents.
In 2026, burner accounts – and burner account fraud – are becoming easier to scale for cybercriminals, and a bigger threat to merchants.
Automation – further amplified by the dissemination of fraud tools in fraudster communities – allows fraudsters to create and test account variations continuously. They can change identity details, devices, transaction values and timing, then use approvals, declines and account restrictions as feedback for subsequent attempts.
Generative AI can reduce the effort required to produce convincing profiles, identity documents and customer communications in the same way that GenAI can be used to supercharge refund fraud. Several sources, including ENISA, have reported increasing use of generative AI and deepfakes in impersonation and social engineering activity. However, AI’s role should not be overstated: Here, it does not provide the payment instrument, delivery destination or payout route required to monetize an account. Its importance lies in making identity presentation cheaper, more varied and easier to scale.
Recorded Future has also observed criminal actors advertising accounts, SIM cards, personal data, KYC bypass services and money laundering methods. Access to these fraud-as-a-service offerings allow account creation, testing, fulfillment and monetization to be divided between different participants, making burner accounts easier to operate and replace.
Together, automation, generative AI and fraud-as-a-service have made burner accounts easier to operate and faster to replace following merchant intervention. The result? More fraud, of course.
Burner accounts set up with online merchants can appear unremarkable when assessed individually. Email, telephone or identity-level verification may confirm the information presented, but it cannot establish honest intent, predict future behavior or prove that the same operator is not controlling other profiles. Account-level thresholds are similarly limited when accounts can be replaced cheaply.
Legitimate customers also share devices, payment instruments, addresses and networks. A shared connection is therefore not proof of fraud. Burner account abuse becomes visible when several weaker indicators are assessed together and monitored over time. And to do that, you need to put all your data to work.
To detect burner accounts effectively, merchants should combine ongoing behavioral assessment with network analysis across apparently unrelated accounts. Here are the signals to keep track of in your analysis:
Relevant indicators include:
account age
account creation velocity
reused contact information
identity inconsistencies
sensitive profile changes
links to restricted accounts
Valid identity data does not establish genuine intent. A customer may provide accurate personal details while operating multiple accounts or setting the scene for abuse that is committed later, while it’s also possible for a burner account to have started its life as a legitimate account that was then taken over by a fraudster.
Device and network signals that may reveal common control by a single person or fraud ring include:
device reuse
emulators
browser manipulation
proxy or hosting provider usage
unusual device changes
improbable location shifts
These signals require context because legitimate customers may share infrastructure, while sophisticated fraudsters may rotate it.
Behavioral signals that could indicate centrally managed accounts include:
repeated registration sequences
unusually rapid form completion
identical navigation
immediate promotion redemption
low value testing
coordinated changes in spending
A single action of this type may be normal, but the same sequence across several accounts is more significant.
Merchants should look for:
identical payment instruments used across several accounts
accounts attempting numerous cards
declines distributed across connected profiles
repeated testing or spending patterns
Similar products, values and payment sequences may strengthen the evidence.
Delivery recipients, collection points, reshipping locations, bank accounts and payout beneficiaries may be more stable than the accounts themselves.
When unrelated identities direct goods or funds toward the same destinations, these connections can reveal where the wider operation extracts value.
Link analysis and graph networks are very useful for identifying burner accounts, but do take heed: A single connection between accounts does not necessarily indicate fraud. Stronger evidence emerges when devices, payments, recipients, account details and behavioral patterns overlap across the same cluster.
Network analysis identifies how accounts are connected, while ongoing monitoring shows how those accounts and connections evolve.
An account may pass onboarding and behave legitimately before increasing its spending, changing payout details, submitting claims or connecting to another account that later generates a dispute.
Therefore, risk should be reassessed as behavior changes, new connections emerge and delayed outcomes become available.
Now we’ve seen the signals that may indicate burner accounts, here is a list of practical advice to limit fraudster use of this type of account for their schemes.
The level of verification should reflect the value an account can access.
Credit, seller payouts, transferable rewards and high value fulfillment may justify stronger checks than a basic customer profile.
Additional verification can then be introduced when the account attempts a higher risk action.
Velocity limits should operate across devices, payment instruments, telephone numbers, addresses, recipients and account clusters – not only individual accounts.
Promotion eligibility should similarly consider previous use by connected accounts, households and payment methods.
Product limits, delayed high risk fulfillment, staged payouts and cooling off periods after sensitive changes can reduce the value extracted before detection.
Whenever an account is restricted, investigations should extend to its connected devices, payments, recipients, delivery locations and beneficiaries. The objective is to disrupt the infrastructure supporting the abuse, not merely to block another disposable account.
Controls should combine multiple signals, apply proportionate friction and be measured against fraud losses, conversion, payment approval, fulfillment, payouts, manual review and complaints.
Merchants should also monitor displacement: Stronger account controls may redirect fraud toward guest checkout, account takeover, customer support or alternative payment methods rather than eliminating it altogether.
Merchants that treat burner accounts as isolated fraudulent accounts will continue to block the symptoms but not the cause, leaving the wider criminal operation intact.
Burner accounts can pass onboarding and closely imitate legitimate behavior. Detecting them requires continuous behavioral monitoring and link analysis that identifies where accounts, devices, payments, fulfillment and payouts converge.
The objective is not simply to close the next disposable account but to disrupt the infrastructure behind it. The account may be disposable; the infrastructure often is not.
Capturing the right data and conducting network analysis is key to tackling burner account-enabled fraud.
Get Ravelin's latest reports, analysis and advice on fraud, payments and secure growth in your inbox.
Nelda Biltauere Senior Fraud and Payments Researcher
