---
title: "Spot banned people who sign up again · Agent Wranglers"
url: https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/ban-evasion
id: TNS-13
level: Recommended
applies: accounts
updated: 2026-10-22
tokens: 1063
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Spot banned people who sign up again

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Sign-up fraud and abuse](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: TNS-13
- Level: Recommended
- Chapter: [Sign-up fraud and abuse](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse.md)
- Rule: When you suspend an account for abuse, keep keyed hashes of its email, phone and payment card fingerprint. Raise the risk score of any new sign-up that matches one.
- Check: Suspend a test account, then sign up with the same address written with a plus tag and capital letters. The new sign-up lands in the hold band with the signal `matches_banned`. The banned list holds no plain email or phone number.
- Applies when: The project has user accounts.
- How: A ban that a new email address undoes is no ban. Normalise each identifier first, as [Compare email addresses and usernames in one canonical form](https://agentwranglers.se/playbook/accounts/sign-up/identifier-normalisation.md) shows, so dots and plus tags do not slip past. Hash with a keyed hash, such as HMAC-SHA-256, so the list cannot be reversed by guessing addresses. Payment providers give a card fingerprint that stays the same across accounts, so use that instead of card data. Feed a match into [Score every sign-up for risk](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/sign-up-risk-score.md) as a strong signal, and let a person confirm the link. Keep the hashes for the length of the ban plus one year, and write that period into the retention schedule.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import { createHmac } from 'node:crypto';

export const identifierHash = (kind, value) =>
  createHmac('sha256', process.env.BAN_LIST_KEY).update(`${kind}:${normalise(kind, value)}`).digest('hex');

export const matchesBanned = async signUp =>
  bannedHashes.any([identifierHash('email', signUp.email), identifierHash('phone', signUp.phone)]);
```

### Python example

```python
import hashlib
import hmac
import os

def identifier_hash(kind: str, value: str) -> str:
    message = f"{kind}:{normalise(kind, value)}".encode()
    return hmac.new(os.environ["BAN_LIST_KEY"].encode(), message, hashlib.sha256).hexdigest()

def matches_banned(sign_up) -> bool:
    return banned_hashes.any([identifier_hash("email", sign_up.email), identifier_hash("phone", sign_up.phone)])
```

## Sources

- [GDPR Articles 25 and 32](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related rules

- ACC-4 [Compare email addresses and usernames in one canonical form](https://agentwranglers.se/playbook/accounts/sign-up/identifier-normalisation.md) in Accounts and identity
- TNS-11 [Score every sign-up for risk](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/sign-up-risk-score.md) in Trust and safety
- ECM-37 [Limit each coupon per customer instead of per account](https://agentwranglers.se/playbook/ecommerce/promotions-and-fraud/coupon-limits.md) in E-commerce and fulfilment
- MED-33 [Close the accounts of repeat infringers](https://agentwranglers.se/playbook/files-and-media/copyright-and-takedowns/repeat-infringers.md) in Files and media

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/ban-evasion">Agent Wranglers trust and safety playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Give new accounts low limits until they earn trust](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/new-account-limits.md)
- [Sign-up fraud and abuse](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse.md)