Explore checkers, demos and evaluation routes →
Summarize this page with
An account-sharing pilot should measure both the detection finding and what happened to the customer afterward. Use independently known cases, explicit denominators and a defined observation window. Report legitimate accounts affected, unresolved cases, completed recovery and confirmed commercial outcomes separately.
A device-count increase is not recovered revenue. A password reset is not proof that sharing stopped. A completed upgrade is a real commercial event, but its causal relationship to the intervention still needs a comparison if you want to claim incremental revenue.
- 1Label known cases
- 2Measure customer impact
- 3Verify recovered revenue
Define the unit of evaluation
Choose whether a result describes an account, access attempt, device relationship or session. An account flagged twenty times should not automatically become twenty distinct customers affected. Report repeated restrictions separately because they matter to customer experience.
Fix the observation window and entitlement model before reviewing results. The same device pattern may be permitted for a household plan and prohibited for a named-user seat. Store the applicable plan version so a later upgrade does not retroactively rewrite what was authorized at the time.
| Outcome | Suggested denominator | Interpretation boundary |
|---|---|---|
| Legitimate accounts restricted | Known legitimate evaluated accounts | Depends on label coverage and case selection |
| Sharing cases detected | Known sharing simulations or labeled cases | Does not describe all unobserved sharing |
| Successful recovery | Accounts offered the relevant recovery path | Completion does not settle the original label |
| Confirmed paid expansion | Eligible accounts exposed to an upgrade path | Incrementality requires a comparison |
| Repeated mistaken restrictions | Corrected legitimate accounts | Reveals unresolved workflow or state errors |
Build labels before inspecting scores
Use permitted test accounts with known device relationships and independently confirmed entitlement. Include legitimate travelers, replacement devices, households, offices and team plans. Construct authorized sharing simulations that cover sequential use as well as overlap.
For production cases, document how labels were obtained and which remain uncertain. A support appeal may reveal a mistake, but customers who do not appeal may still have been wrongly restricted. Email verification or a payment is supporting evidence with limits, not a universal proof that all use is authorized.
Keep an unresolved category instead of forcing every ambiguous case into legitimate or abusive. Publish label coverage alongside the result. Otherwise an apparent improvement can reflect a narrower sample rather than a better detector.
Separate the failure modes
An observation error concerns the technical evidence: a missing event, incorrect device continuity or wrong timestamp. An association error connects valid evidence to the wrong account. A policy error applies the wrong entitlement or threshold. A response error imposes an inappropriate restriction or fails to restore access after correction.
These require different fixes. Raising a device limit may hide an account-association defect. A better device identifier will not repair an outdated membership cache. Keep the original finding and the final customer action in separate records so the team can identify where the problem occurred.
Evaluate equivalent product scope
Compare the same cases, surfaces and window for each candidate. A public demo can expose available output, but it does not replace an implementation pilot. Confirm required rule activation, account association, server verification and ongoing access coverage first.
ShieldLabs provides ready-made account-abuse events with linked identity and device/network context. Castle supports configured policies; Rupt includes sharing-specific access protection; Fingerprint supplies identity for application-owned history. Include the engineering and review work required by each model in the comparison.
Current access is part of scope. cside documentation closes new Device Intelligence activations, while its sharing rule requires manual activation. An advertised free plan is not enough to establish that a new team can run the intended pilot.
Measure recovery as a customer journey
Record which action was offered: re-authentication, device removal, named-user invitation, support review or upgrade. Measure completion, time to resolution and whether authorized access was restored. Inspect abandonment without assuming every abandoned account was abusive.
Support should be able to reverse a mistaken restriction and correct the underlying state. Repeatedly granting exceptions without fixing the event association or entitlement cache creates recurring friction and hides operating cost.
Review outcomes by meaningful cohorts such as household plan, mobile access, workplace network or recently upgraded team. Small samples need counts and uncertainty, not a confident percentage without a denominator.
Verify commercial outcomes
Join completed upgrades or extra seats to the trusted billing and entitlement records. Separate offers shown, checkout starts and paid expansion. Account for refunds, cancellations, discounts and support effort over a declared follow-up window.
To estimate incremental revenue, use a suitable comparison or controlled rollout where the business context allows it. Before-and-after revenue alone can change because of seasonality, pricing, traffic mix or other product changes. Report observed conversions plainly when causal attribution is unavailable.
Compare detector charges, integration work and review cost with the net commercial outcome. Per-identification, API-call and evaluation units differ, so use the actual protected-event volume rather than treating every active user as one billable check.
FAQ
Is every customer appeal a false positive?
No. It is evidence to investigate. Verify the entitlement, observations and final resolution; also consider legitimate customers who never appeal.
Does fewer active sessions mean sharing stopped?
Not necessarily. Use may have become sequential, customers may have abandoned access or restrictions may have affected legitimate users. Inspect account outcomes and follow-up.
Can upgrade revenue be called incremental immediately?
A paid upgrade is an observed outcome. Claiming incremental revenue requires a comparison that addresses other causes of the change.
Sources and further reading
Read October 21, 2026: Castle tuning guidance, Rupt sharing concepts, Fingerprint sharing guide, ShieldLabs sharing solution, cside activation conditions. See the published evaluation framework.
Continue reading
- How to detect account sharing without blocking legitimate households
- Enforce SaaS seat limits without frustrating legitimate users
- Impossible travel vs account sharing: read the evidence correctly
Compare all ten tools or read the complete deployment guide.