Treat a sudden burst from an established account as a takeover

How to do it

Spammers steal old accounts because new ones hit the caps of Give new accounts low limits until they earn trust. A burst right after a sign-in from a new device is the strongest sign, as Notice when a session cookie moves to another device explains. So is a recent correct password with a failed second factor, as Tell people when their password worked but the second factor failed describes. The owner is most likely a victim, so the pause gives no strike. Tell them what happened, as Tell people about every change to their sign-in says. After they sign in again, restore sending and send the burst's items to the queue for removal. Count paused accounts in Watch abuse rates and alert on jumps.

Examples

JavaScript example

const MIN_ACCOUNT_AGE_DAYS = 30;
const BURST_FACTOR = 10;

export const isTakeoverBurst = (account, sentLastDay) =>
  account.ageDays > MIN_ACCOUNT_AGE_DAYS && !account.hasUpheldReport
  && sentLastDay > BURST_FACTOR * Math.max(1, account.usualDailySends);

Python example

MIN_ACCOUNT_AGE_DAYS = 30
BURST_FACTOR = 10

def is_takeover_burst(account, sent_last_day: int) -> bool:
    return (account.age_days > MIN_ACCOUNT_AGE_DAYS and not account.has_upheld_report
            and sent_last_day > BURST_FACTOR * max(1, account.usual_daily_sends))

How to check

A test account aged 60 days sends 5 messages a day for a week, then 50 in one hour. Sending pauses, every session ends, and the owner gets a notice. After a sign-in with a second factor, sending works again and the account holds no strike.

Related rules

• TNS-12 Give new accounts low limits until they earn trust in Trust and safety
• ACC-66 Notice when a session cookie moves to another device in Accounts and identity
• ACC-25 Tell people when their password worked but the second factor failed in Accounts and identity
• ACC-22 Tell people about every change to their sign-in in Accounts and identity
• TNS-16 Watch abuse rates and alert on jumps in Trust and safety