Your welcome offer is funding a farm, not real users.
Free credits, signup bonuses and first-purchase discounts attract people who create account after account on one machine to claim the same reward over and over.
Does this sound like you?
If even a couple of these feel familiar, it’s probably already happening on your platform.
Promo redemptions are high, but those users never come back.
What it means: The offer, not the product, was the entire customer.
Acquisition cost looks healthy — until you check 30-day retention.
What it means: You're “acquiring” accounts that were built to leave.
You keep clawing bonuses back after the fact, and annoy real users by mistake.
What it means: Late, manual clawbacks land on the wrong people.
A lot of brand-new accounts claim the offer minutes after signing up.
What it means: Signup and claim are one scripted motion, not a customer.
How the attack actually works
No security background needed — here’s the whole play, start to finish.
The setup
A farm creates a stack of “fresh” accounts on a single device.
The claim
Each one grabs the bonus, drains the value, and is abandoned.
The discovery
You find out at reconciliation — after the credit is already gone.
How SignalGate stops it
One call on your critical path. The verdict comes back before anything happens.
Multi-account behavioral fingerprinting
Identifies when supposedly fresh accounts share the behavioral fingerprint of a single origin within a window — the tell of a bonus farm.
Signup-velocity anomaly detection
Learns the rhythm of genuine signups on your own base and flags those that move like a farm, not a person.
Pre-bonus verdict
The verdict fires when the user clicks "claim," not at month-end reconciliation. No clawback, no support tickets from confused legitimate users whose bonus disappeared retroactively.
Fingerprinting catches one device pretending to be many. SignalGate catches the opposite — many genuinely different devices working as one operation — the fraud that device fingerprinting alone was never built to see.
Wire it in, in minutes
Start with two fire-and-forget calls to /v0/log — log the action and the target action. No blocking, no user impact, nothing on your critical path.
Log bonus claims and cleared bonuses
from datetime import datetime, timezone
from signalgate import Client, Event, EncryptedPayload
client = Client(api_key="pk_live_...")
def sg_event(body: dict, method: str) -> Event:
# Each request carries its OWN "signalgate" envelope from the browser SDK
return Event(
user_id=body["user_id"],
ip=request.headers.get("X-Forwarded-For", request.remote_addr),
method=method,
timestamp=datetime.now(timezone.utc).isoformat(),
payload=EncryptedPayload(**body["signalgate"]),
)
@app.post("/api/bonus/claim")
def claim_bonus():
body = request.get_json()
# ...your bonus-grant logic...
client.log(sg_event(body, method="bonus.claim")) # AFTER the claim succeeds
return {"ok": True}
@app.post("/api/bonus/cleared")
def bonus_cleared():
body = request.get_json()
# ...your wagering-cleared logic...
client.log(sg_event(body, method="bonus.cleared")) # its own fresh envelope
return {"ok": True}Within days the dashboard shows how much of your traffic is one coordinated operation — before you turn on blocking.
Stop fraud before it reaches your backend.
Free for everyone through 2026. Two lines of code. No demo required.