Spot banned people who sign up again

How to do it

A ban that a new email address undoes is no ban. Normalise each identifier first, as Compare email addresses and usernames in one canonical form shows, so dots and plus tags do not slip past. Hash with a keyed hash, such as HMAC-SHA-256, so the list cannot be reversed by guessing addresses. Payment providers give a card fingerprint that stays the same across accounts, so use that instead of card data. Feed a match into Score every sign-up for risk as a strong signal, and let a person confirm the link. Keep the hashes for the length of the ban plus one year, and write that period into the retention schedule.

Examples

JavaScript example

import { createHmac } from 'node:crypto';

export const identifierHash = (kind, value) =>
  createHmac('sha256', process.env.BAN_LIST_KEY).update(`${kind}:${normalise(kind, value)}`).digest('hex');

export const matchesBanned = async signUp =>
  bannedHashes.any([identifierHash('email', signUp.email), identifierHash('phone', signUp.phone)]);

Python example

import hashlib
import hmac
import os

def identifier_hash(kind: str, value: str) -> str:
    message = f"{kind}:{normalise(kind, value)}".encode()
    return hmac.new(os.environ["BAN_LIST_KEY"].encode(), message, hashlib.sha256).hexdigest()

def matches_banned(sign_up) -> bool:
    return banned_hashes.any([identifier_hash("email", sign_up.email), identifier_hash("phone", sign_up.phone)])

How to check

Suspend a test account, then sign up with the same address written with a plus tag and capital letters. The new sign-up lands in the hold band with the signal matches_banned. The banned list holds no plain email or phone number.

Sources

• GDPR Articles 25 and 32

Related rules

• ACC-4 Compare email addresses and usernames in one canonical form in Accounts and identity
• TNS-11 Score every sign-up for risk in Trust and safety