Beyond Bots: Cloudflare Targets Fraudulent Accounts at the Source

Cloudflare has introduced a new suite of fraud prevention capabilities, collectively branded Account Abuse Protection, designed to stop abusive behavior from both automated and human actors. The company argues that focusing on automation alone is no longer sufficient; attackers now combine scripts with human-powered fraud farms, synthetic identities, and massive credential leaks to compromise accounts and abuse promotions.

The new tools shift the focus from asking “Is this automated?” to “Is this authentic?” They build on existing offerings, including the free leaked credentials detection available to all customers since Birthday Week 2024, and the account takeover (ATO) detection IDs within the Bot Management solution. These previous features help identify bots attacking login pages, but the new additions are aimed at the wider problem of account creation fraud and identity-based abuse.

Account Abuse Protection is now in Early Access. Any Bot Management Enterprise customer can use the new features at no additional cost for a limited period, until the general availability of Cloudflare Fraud Prevention later this year.

Emails as an Early Warning System

Fake account creation is a primary entry point for abuse, allowing attackers to drain trial credits or build platforms for promotion fraud. To address this at the signup stage, Cloudflare is adding two tools for assessing the risk of an email address:

  1. Disposable email check: This binary detection flags when users sign up with throwaway email addresses, a common tactic used by attackers to spin up thousands of "unique" accounts without maintaining real infrastructure. Customers can use this field in WAF rules to block disposable emails entirely or issue a challenge at signup.
  2. Email risk: Cloudflare analyzes email patterns and infrastructure to produce risk tiers (low, medium, high). This allows customers to differentiate between the risk profile of an address like [email protected] and one like [email protected]. Rule builders can then express different levels of tolerance for risk and user friction.

Both detections are available in Security Analytics and Security Rules. The logic is that mitigation is most effective at the moment of account creation, before a fraudulent user has burned through acquisition costs or promotional credits.

The Shift to User-Based Visibility

Traditional security signals based on IP addresses and isolated HTTP requests are losing effectiveness. Attackers rotate IPs effortlessly and use residential proxies to hide their tracks. Responding to these signals, Cloudflare says, is a game of whack-a-mole. The new defense strategy, therefore, is to map activity to a persistent account identifier—assuming the victim, not the network, is the target.

To support this, Cloudflare is releasing a Hashed User ID field for use in Security Analytics, Security Rules, and Managed Transforms. These are per-domain, cryptographically hashed identifiers generated from the username field in a customer's application. Each ID is a unique, stable identifier linked to a specific user on a specific domain. Critically, the actual username is not logged or stored as plaintext by Cloudflare—the service only processes the hash, prioritizing end-user privacy.

With this visibility, website owners can answer questions previously buried in network noise:

  • Which accounts have the most activity?
  • When does a unique user log in from a country they don’t usually use—or from multiple countries in a single day?
  • Which accounts are being targeted with leaked credentials?
  • What network patterns and signals are associated with a specific high-risk user?

This capability lets customers tie suspect behavior—such as credential stuffing or impossible travel—directly to a single user account and enforce block actions based on that persistent identity.

Why This Matters Now

The threat landscape has shifted from individual hackers to industrialized fraud. Cloudflare notes that 41% of logins across its network use leaked credentials, a figure that has grown following the exposure of a database of 16 billion records. Password reuse across platforms means old leaks can still unlock high-value bank or retail accounts today. In its Black Friday analysis in 2024, Cloudflare observed that over 60% of traffic to login pages was automated.

To combat this, ATO detections alone were catching an average of 6.9 billion suspicious login attempts daily across the network last week. The new email risk and Hashed User ID features are intended to complement these existing ATO checks and leaked credential checks as layers in a defense-in-depth posture.

The broader goal is to protect the entire user journey—from signup to login through checkout—against abuse by fake humans and masked bots alike.

Getting Started

Prospective and existing Bot Management Enterprise customers can sign up for Early Access to test the new Account Abuse Protection features today.