Friend or fraud? How social platforms can stop bot-driven attacks without slowing growth

Growing social account fraud. The alarming rise in bad bots. Ever-tightening regulations. Here’s what you can do to stay ahead.

Introduction: The tipping point

It’s a good time to be a bot.

In late May 2026, the internet reached a new, ominous milestone. This event went largely unnoticed by most internet users, but its impact is being felt across the world. 

That's when internet traffic crossed a symbolic threshold: The share of HTML requests tipped over from being mostly of human origin to mostly of bot origin.

This landmark confirms what we already know: Bot traffic is increasing, and it’s an acute threat to social platforms everywhere. 

Not all bots are bad, though. Yet a significant number are out to steal, disrupt, and destroy. And if you're on a technical team wrangling this new world of bots, you already know this. 

The real question is this: How can a technical team working at a social platform like Snap ensure they're prepared as they can be to face malicious bots and their cybercriminal commanders?

How can you secure your apps while keeping users happy, ensuring your revenue streams are strong, and your products are staying compliant with new online safety regulations?

It’s a tall order.

This report explores this new reality technical teams at social platforms are facing.

We'll cover why new account fraud has evolved into such a tricky challenge in the era of AI. We'll look at why traditional controls are becoming less effective against organized bot operations.

And we'll share some specific ways that persistent device intelligence can help social platforms stop abuse while maintaining the smooth, low-friction experiences that legitimate users expect.

The bot-industrial complex is thriving

There was a time when fake accounts were relatively unsophisticated.

A single attacker might manually create a handful of profiles using disposable email addresses before eventually being detected and removed.

That model is long gone.

Modern fraud operations increasingly resemble software businesses. Instead of an individual creating a few fake accounts (multi-accounting), organized groups build automated pipelines capable of producing thousands of identities across multiple platforms simultaneously. These operations invest in infrastructure designed specifically to imitate legitimate users while avoiding traditional detection techniques.

A fraudster can generate a new email address in seconds, purchase fresh residential IP addresses, clear browser storage or create a new browser profile with little effort. It can cost as little as $0.10 to obtain SMS verification for a fake UK social account. 

There are numerous techniques fraudsters can use.

• Virtual machines allow attackers to operate hundreds of isolated browser environments from a single physical system.
• Anti-detect browsers deliberately randomize browser characteristics to make each session appear unique.
• Residential proxy networks rotate connections through millions of consumer IP addresses, making simple IP-based blocking far less effective than it once was.

The results from employing any (or all) of these tactics can be swift and difficult to manage: The fraudsters are running an industrial process for manufacturing identities at scale. Like a game of whack-a-mole, if one account is suspended, another takes its place almost immediately.

This fundamentally changes the economics of platform abuse. Rather than protecting long-lived accounts, attackers work to scale and volume, expecting accounts to be detected and replaced continuously.

The bot armies have tooled up and scaled out. And fraud fighters need a new toolset to bolster their defenses.

For technical teams, the challenge looks very different to what it once was: It's no longer about identifying a single suspicious account, instead it's about recognizing when the thousands of apparently unrelated accounts could originate from the same underlying infrastructure.

We’re not talking about a few laptops here. Attackers can rapidly generate new bot-based identities at an unprecedented scale—an effort that not long ago was significantly more expensive and operationally complex.

For platforms balancing growth with safety, this represents an important shift in thinking. And this is where device intelligence becomes increasingly important. The goal is to identify the infrastructure that creates those fraudulent identities.

Banning accounts without banning devices creates a revolving door

Removing an abusive account isn’t the end of the problem. It may only be the beginning of the next cycle.

Factory resets, app reinstalls, and changes to browser or device settings can generate new identifiers, giving fraudsters the cover they need to evade detection. 

If a social platform bans an account, it may take seconds for another fake account to appear. This is known as recidivism— the repeated return of previously banned users under new identities.

Regulators and regulatory frameworks, like the UK’s Online Safety Act, want safeguards that are effective at preventing repeat abuse. These regulators explicitly recognize device bans as a necessary enforcement mechanism.

In the UK,for example, Ofcom’s Trust & Safety model recommends permanent enforcement measures, including:

• Account bans
• IP bans
• Device bans

But how do you ensure that banned or age-restricted users don’t simply return under a new identity?

Answering this question requires moving device bans to a durable layer of device-level signals that remain effective even as accounts, credentials, and other identifiers change.

This is device-level detection and account security taken to a whole new level of sophistication.

From ad spend to attribution: How bot traffic distorts metrics and destroys growth

The primary victims of bots and fake accounts are user safety and trust. But there are second-order harms.

As social platforms increasingly rely on advertising revenue, user identity has become just as important for commercial performance as it is for abuse prevention.

Since the introduction of stricter mobile privacy controls, including Apple’s App Tracking Transparency (IDFA) framework, advertisers have become more dependent on the attribution signals reported by the platforms themselves. 

Campaign performance, return on ad spend (ROAS) and bidding decisions all rely on the assumption that impressions, clicks and conversions reflect genuine human behavior. That assumption becomes harder to defend when legitimate user activity is diluted by bots.

Non-human sessions can distort engagement metrics and reduce the accuracy of attribution models. Over time, this weakens confidence in campaign reporting and makes it more difficult for advertisers to justify premium CPMs (cost per mille, or thousand clicks) or continued investment. In this scenario, bot activity transforms from a cost and a nuisance to an obstacle to business growth.

The problem is particularly acute in browser and desktop environments.

As platforms expand web experiences, they also lose many of the persistent signals available in native mobile apps. Short-lived browser sessions and frequently reset identifiers create blind spots between ad exposure and conversion, making it harder to understand whether a campaign reached a real person or an automated session. 

In our 2026 Device Intelligence Report, we found that 96% of detected desktop automation is associated with abuse, highlighting how much of today’s threats originate in environments where traditional trust signals are weakest. 

The revenue-driving importance of these underlying signals is clear to see. In their year-end fiscal report for 2025, Snap reported 89% year-over-year growth in revenue from In-App Optimizations, demonstrating how increasingly sophisticated advertising products depend on accurate user identification and trustworthy behavioral data. 

The fact is: Poor identity signals affect the experience (and ROI) these platforms can unlock for their legitimate users.

When platforms cannot confidently distinguish trusted users from abusive ones, enforcement becomes a wild guess. False positives can lock genuine users out of their accounts, interrupt access to paid services, and create unnecessary friction. And false negatives allow automated abuse to continue unchecked.

If a platform can’t reliably distinguish a human session from an automated one, it cannot provide the quality of measurement, attribution, or user experience that advertisers and legitimate users want and need.

Existing device protections don’t always stop determined ban evasion

Most Trust & Safety stacks already include a mature set of fraud controls.

Behavioral analytics, CAPTCHA, multi-factor authentication (MFA), credential validation, IP reputation, VPN detection, and device-based protections all play an important role in reducing abuse. 

If you’re expecting to hear us say these are outdated and ineffective, you won't. They do work. It's just that they were designed to solve different problems than the most pressing ones today.

And determined attackers continue to find ways around them.

The big difference is not detection, but persistence.

Modern social platforms already use device signals to help detect abuse and enforce device-level actions. But determined attackers can break that link by resetting devices, spoofing identifiers, clearing local data, rotating networks, or combining multiple evasion techniques.

This means that even modern device-level protections have big holes in their effectiveness. A device that has previously been associated with abuse may later appear to be new, allowing operators to return with fresh accounts.

Persistent device intelligence addresses this blind spot by adding an identity layer beneath accounts, sessions, and network attributes. It doesn’t replace existing Trust & Safety controls—it layers up on top, strengthening them by recognizing returning devices even when:

• Cookies have been cleared
• Credentials have changed
• Network characteristics have rotated

The outcome is that platforms can connect activities that would otherwise appear unrelated and identify repeat abuse before it becomes another cycle of account creation.

Persistent device intelligence: How Fingerprint takes protection to the next level

The fact is no single control can stop every form of account abuse. The success of Trust & Safety programs rests on layered defenses, with each control addressing a different stage of the attack lifecycle. 

Yes, email and phone verification help raise the cost of mass account creation. And, yes, CAPTCHA can deter basic types of bot activity and automated abuse. Rate limiting, behavioral analytics, and IP intelligence all add valuable signals that help identify suspicious activity.

But determined attackers have adapted to these controls.

Disposable email addresses, residential proxies, anti-detect browsers, and automated account creation pipelines allow fraudulent activity to bypass many traditional account- and network-level defenses.

This is where persistent device intelligence provides an additional layer of protection.

Fingerprint identifies the device behind an interaction, creating an identity signal that keeps working even as attackers rotate emails, clear cookies, or change network connections. Used alongside existing fraud controls, Fingerprint enables platforms to recognize returning devices and identify repeat offenders before abuse can expand.

Fingerprint also extends protection beyond exact device matching through proximity detection.

Instead of looking only for an identical device, it can recognize hardware that is highly similar to devices previously associated with abuse.

• Proximity detection
• Persistent visitor/device identification
• Smart Signals (VPN, VM, tampering, bot detection, etc.)
• Device reputation over time
• Continuous risk assessment
• Stable identity across sessions

This closes an important gap that account-based controls cannot address, allowing platforms to link related activity that would otherwise appear unrelated.

What you get is a stronger foundation for your Trust & Safety program.

By adding a persistent device layer beneath existing controls, platforms can reduce recidivism, improve the quality of enforcement decisions, strengthen advertiser confidence, and provide a safer experience for legitimate users. And this happens all while making industrialized account abuse significantly more difficult and expensive to sustain for attackers. 

It’s a win for your users and your compliance team. And it’s a big win in the fight against malicious bots. 

——

Want a closer look at device intelligence in action?

Fingerprint can help strengthen your existing Trust & Safety stack by detecting sophisticated bot activity and stopping repeat offenders before abuse can scale. 

Book a tailored demo and see how we can help your team.