Fraud prevention 🛡️
Preventing fraud is crucial for your organization and Ethnio, but especially in the world of participant incentives. Not only do we not like survey fakers and professional scammers, but those people in your research studies can cause serious problems with quality findings.
Fraud prevention deep dive 🤿
For a more in-depth outline of how Ethnio approaches fraud prevention, we have a pretty detailed blog post on tips and tricks and all the measures we have in place.
📖 Read all about Ethnio's multi-layered fraud prevention and strategies →
Here's how we tackle fraud prevention effectively, and account owners or admins can head to account › fraud prevention to control the options.
- Study responses
- Pool
- Incentives
Study responses
If one or more of your responses are flagged as suspicious, a new column will appear AFTER a suspicious response is flagged called Fraud Suspicion and individual rows will have a tag called ⚠️ Suspicious.
A response is flagged when Ethnio sees the same device fingerprint on more than one response in that study. The earliest response from a device is never flagged — only the ones that follow it.
Under Account → Fraud Prevention → Flag suspicious responses there's a checkbox that controls how strict the device check is. It's checked by default.
Unchecked (default)
Repeat responses from the same device are flagged and does not check Pool at all. Any participant re-taking the study on the same device gets a ⚠️ Suspicious tag on every response after the first. This setting works on all plans in Ethnio, and does not require Pool.
Checked (less strict)
A repeat response is only flagged when the shared device was used by two or more different Pool profiles. One person taking your study twice from the same device is not flagged. This requires an Enterprise plan with Pool.
What you'll see in Responses
This is an example:
Pool
If the account owner or admins have enabled this option, a scan will run once per day automatically and you can see the results in Pool › Fraud queue. The scan uses IP addresses, fingerprints, and shared emails as well as payment emails to identify participants that appear suspicious from an incentive standpoint. In other words, if people seem to be manipulating your research to get via multiple emails they might appear in the fraud queue.
📧 The most common reason for suspicious flag: shared emails
If you've paid someone with an email like bob@a.com but they've redeemed reward using a different email like bobsrealemail@gmail.com , and that email is in turn associated with more than three other emails, that's a bad sign. That typically is a signal that someone has one email for receiving payments but is generating more than three other fake emails to qualify for multiple studies across all Ethnio customers and our network of incentive providers.
More detail below 👇
Understanding Fraud in Participant Incentives
Fraud in incentive programs can take many forms, including:
- Fake Participants: Individuals creating multiple accounts to claim incentives.
- Identity Theft: Using stolen email addresses or identities to participate in multiple studies.
- Inaccurate Information: Providing false information to qualify for studies.
Incentives
Ethnio runs automatic checks on every incentive recipient before a reward reaches them. When a recipient matches one of the fraud rules, the reward is held rather than issued, and the order lands in the fraud queue at Incentives › Activity › Fraud queue.
Nothing is paid out while an order sits in the queue. A person on your team decides whether to release it or block it. Account owners and admins control which checks run under Account › Fraud prevention.
What triggers a suspicious tag on incentives
The Fraud rule column in the queue names the check that caught the order.
| Fraud rule | What it catches |
|---|---|
| Shared or blocked emails | A payment email already used as a secondary payment email on other accounts. This is the most common reason an order is flagged. |
| Network check | An email, IP or device with a history of fraud across Ethnio accounts and our incentive providers. |
| Device fingerprinting | Many different email addresses redeeming from one device in a short window, which usually means fake emails or bots. |
| IP address tracking | Repeat registrations coming from a single source. |
A worked example of the first rule: you pay someone at bob@a.com, they redeem with bobsrealemail@gmail.com, and that second address is tied to more than three other emails. That pattern usually means one real inbox for collecting money and a set of throwaway addresses for qualifying into studies.
The Incentives Fraud Queue
We mark incentive recipients as suspicious and put them in a special fraud queue you can access from incentives › activity › fraud queue. The queue has three tabs, and each order moves through them as you work:
- Flagged holds orders waiting on a decision. Start here.
- Blocked holds orders you cancelled.
- Released holds orders you approved and sent on to the recipient.
Each row shows the date, status, order ID and mode, the recipient's name and payment email, the amount, and the fraud rule that caught it. Use the search box at the top to find a specific order by order ID, name or email, which is handy when a participant writes in asking where their reward went. An empty Flagged tab means nothing is waiting on you.
Releasing or blocking a reward
Every flagged order has two actions:
- Release issues the reward to the recipient as normal.
- Block cancels the reward, and the recipient is never paid.
A flag is a signal, not a verdict. Release the order when you have your own reason to trust the person, such as a participant you recruited directly, a known employee or customer, or someone who shares a household device with another participant. Block it when the recipient does not match anyone you expected in the study, or when the session itself looked rehearsed or inattentive. If you are unsure, check the response or session behind the order before deciding. The reward stays held either way, so there is no rush.
Criteria for flagging participants as suspicious
Across all types of fraud detection, these are all the elements that go into marking a participant as suspicious:
- IP Address Tracking: We monitor IP addresses to detect and block multiple registrations from the same source.
- Device Fingerprinting: This technology helps identify unique devices, preventing multiple sign-ups from the same device.
- Network check: Ethnio checks with incentive providers and their customers to see if there's a history of fraud for any given email, IP, or device
- Shared or blocked emails: Any email that has been used as a secondary payment method email in multiple accounts will be flagged as suspicious.