The short answer
Device fingerprinting detects multiple-account patterns by comparing the browser environment observed during one signup with environments seen during earlier signups. A repeated project-scoped identifier is useful evidence that the same browser installation returned, even if its cookies were cleared or its IP address changed.
It does not prove that both accounts have the same owner or that either account is abusive. Families share computers, employees use managed fleets and public terminals serve unrelated people. The reliable unit is an event relationship: these attempts appear to come from the same observed browser environment.
Why email, cookies and IP addresses are not enough
Email addresses are cheap to create and aliases are easy to vary. Cookies work well for ordinary returning sessions but disappear when site data is cleared or a new browser profile is used. IP addresses rotate, and mobile carriers, offices and households can place many legitimate users behind one public address.
Each signal still has value. A cookie can make a known return explicit. An IP can reveal a burst of signups from one network. An email domain can expose disposable inboxes. Device fingerprinting adds continuity across some of the gaps, but the strongest rule combines independent observations instead of declaring any one of them decisive.
A practical matching sequence
Collect the fingerprint when the protected form is submitted, not indiscriminately across every page. Exchange the short-lived token on the backend and compare the project-scoped device ID with the history relevant to the offer or policy. An exact repeat can follow a simple, auditable rule.
When an exact identifier does not match, component similarity can sometimes reveal a browser that changed slightly. That requires more care. Common values should receive less weight, unstable values should not dominate, and thresholds must be tested against known examples from the product's own audience. A threshold copied from another dataset can create convincing-looking but unreliable links.
Turn evidence into proportionate friction
A repeated device does not require an immediate block. A free-trial flow might request a payment method, offer a limited plan or delay an expensive credit. A marketplace might request another identity step. A security team might place the event in a review queue alongside the reason that triggered it.
Graduated responses protect good users when the context is ambiguous. A repeat device plus the same payment fingerprint and a rapid signup sequence is more meaningful than a repeat device alone. Conversely, two accounts on a shared laptop with different established payment and profile histories may be completely legitimate.
Measure false positives, not just prevented attempts
Track how many flagged attempts complete an additional check, appeal successfully, contact support or later become paying customers. Those outcomes reveal whether a rule is detecting abuse or merely creating friction. Run new similarity rules in observation mode before they affect access, and review performance across browsers, regions and device types.
Document the policy, retention window and recovery path. Store only the fingerprint evidence needed for the decision, restrict access and remove old links when their purpose expires. A multiple-account system becomes enterprise-grade through measurable accuracy and accountable decisions, not by claiming that its identifiers never change.