← back to blog

When a platform changes how it enforces

detection enforcement account-isolation fleet-operations

When a platform changes how it enforces

Somebody asked me in January whether a platform had changed its rules. He was certain it had. I asked him which clause.

He sent me the terms page. I opened it beside a copy I had saved eleven months earlier and they were the same document, down to a paragraph about advertising that had shuffled a little further down. Nothing written had changed.

Something had changed anyway, because accounts he had run the same way since the previous spring were suddenly getting stopped.

The published rules barely move. The threshold moves whenever somebody internally decides it should, and it has never once been announced. Most of the confusion in this business lives in that gap.

Where I am watching from

I run mobile proxy lines on carrier SIMs and a rack of Android phones let out as cloud phones. I sell the layer that sits under other people’s fleets. I do not operate a large social presence myself.

That makes me a bad source on what to post and a reasonable one on rates. There are a few hundred lines out at any time, and when something shifts I hear it from people who have never met each other, in the same week, on different stacks.

An operator gets an anecdote. I get a sample. Most of what is useful here falls out of that difference.

This is the thing a wave leaves behind

A ban wave is an event. Accounts die in a batch on a Tuesday, they turn out to have shared a trait, and a scoring pass caught the lot at once. I have written about that machinery and will not repeat it.

What I am describing here is slower. After the sweep, the standard settles somewhere new and stays there. You notice a wave by dinner. A change in posture takes three or four weeks to become undeniable, and by then most people have already told themselves a story about it.

Four dials, none of them labelled

The first is what gets looked at. A signal the platform has been recording and ignoring for a year starts being read. Nothing about your setup got worse. It got read.

The second is how much evidence opens a review. Same signals, same accounts, lower bar. This one is invisible from outside by design and it is probably the most common of the four.

The third is what the consequence looks like at a given score. A verification prompt turns into a hold. A hold turns into a termination. The detection did nothing new that week; the response got heavier.

The fourth is where the gate sits, and this is the one people miss entirely. A check can move from signup to login, from login to the first payout, or onto the moment a second device appears on an account. Overall strictness has not moved at all. The wall is somewhere else, and traffic that used to sail through now stops at a point nobody was watching.

The version that reaches backwards

That last one is irritating. This one takes accounts you thought were long since settled.

When a platform starts reading a signal it was only logging before, it does not usually begin at today’s date. It runs the new reading across the history it already holds. Something you did in March gets judged in August, under a standard that arrived in June.

Which is why stopping helps less than people expect it to. You can change what you do tomorrow. You cannot change what has already been written down about yesterday.

It is also why the account that dies is often one you cleaned up months ago. The cleanup went into the record too, sitting on top of half a year of the thing you cleaned up.

Nobody is going to publish this

Platforms publish rule changes. No platform has published a threshold change and I do not expect one to.

Consider what the notice would have to say. We now open a review at a score of point six rather than point seven. That is a map of exactly where the line sits, handed to the people who want it most, who will be at point five nine by the weekend.

So the change arrives as silence, and the only thing you get to see is your own failure rate moving.

The search that goes to the wrong place

When accounts start failing, the first explanation anyone reaches for is that they did something. It is the natural reading, it is usually wrong, and it is expensive, because it sends you off to audit your own setup.

You will find something. Everyone finds something. There is always a profile carrying a stale user agent, a line quietly holding more accounts than you meant to put on it, an automation still firing from a test somebody ran in April.

So you fix it. Failures continue for another fortnight and then settle, because the rollout finished. You conclude the fix worked, and now you are carrying a false lesson permanently. You will reach for it next time and it will do nothing next time either.

Your fleet is already an instrument

If you run more than a handful of accounts you are running an experiment on that platform every day. Failed logins, verification prompts, holds, captchas, actions that go through and actions that quietly do not. All of that is data about the platform rather than about you, and almost nobody reads it.

One account dying tells you nothing. Sample size of one. It could be the account, the operator, or the afternoon.

Twelve accounts across four exits and three profile bases, registered at different times, doing different work, all stiffening in the same week, is a platform side event and you can call it inside a few days.

The catch is what unrelated has to mean. Different exits, different profile bases, different registration dates, different content. If all twelve sit behind one provider’s pool, a rate change across them tells you about the provider and nothing whatever about the platform. I have watched people conclude a platform had tightened when an address range had been reclassified underneath them.

So the reading only works if the fleet was genuinely separated to begin with, which is inconvenient, because separation is expensive and this is never the argument anybody buys it on.

Friction moves first

Counting bans means reading the slowest indicator on the board.

Count the small stuff instead. How often a login asks for a code. How often a captcha lands on an ordinary action. How many posts sit in review for an hour before they appear. How often an app throws away its session.

That moves weeks ahead of anything terminal, and hardly anyone logs it, because taken one at a time each event is too small to be worth writing down. One row in a sheet, once a day, per account. It is dull, and it is the only early warning anybody gives you for free.

The denominator nobody posts

When something shifts, everyone goes hunting for confirmation in a thread, and threads are close to useless for this particular question.

People report the lock. Nobody reports the base rate. Forty posts saying my account is gone, on a platform with millions of accounts, is a number divided by nothing.

The sample is bent as well. The people who post are having the worst time, running the hardest, on the thinnest setups, so you are reading the tail and treating it as the middle. And nobody has ever posted to say their accounts were fine this week. Every bad week therefore looks like the end of the platform.

I still read them. I read them for what people are doing, and I do not treat them as evidence about a rate.

One change, then wait

The first hour after a flag lands is its own subject and I have covered it separately. This is the wider decision, made over a week.

The reflex is to fix everything at once. New exits, new profiles, different scheduling, different content, replacement accounts, all inside a weekend. It feels like taking the problem seriously. What it actually does is destroy your ability to attribute anything. Five changes, one outcome, no way to tell which mattered. If things improve you do not know why, and if they do not you have spent five options and gained nothing.

Each of those changes also leaves a bill behind. You end up paying every month for a second provider you never needed, because you added it in a panic on a Saturday.

Waiting before you rebuild is not cleverness either. Standing up replacements while the line is still moving means building against a standard you cannot see yet, and information is arriving daily at no cost.

Where you already were

This is the uncomfortable part and I think it is true more often than people will accept.

A threshold change does not make you guilty of something new. It measures where you already were. If a modest tightening took a quarter of your accounts, that quarter had been sitting a quarter of a step from the line the entire time. They were never fine. They were unmeasured.

That points somewhere useful. The accounts that walked through every tightening for two years are the ones worth studying. The dead ones mostly confirm what you already suspected.

I would rather run twenty accounts I measure than two hundred I do not. That sounds like a small operator making a virtue of being small, and it might be. But a fleet nobody is reading is only a cost, and it is producing a live feed about how a platform behaves, daily, for free, straight into the bin.

The part I cannot give you

I cannot tell you whether a change is permanent. Platforms test enforcement the way they test everything, on a slice of the population for a fortnight. I have watched friction spike hard and then drop back to precisely where it started, with nothing actioned and no explanation. In week one that is indistinguishable from a permanent tightening, and I have not met anybody who can tell them apart either.

My own sample is bent too. Customers write to me when things are going badly, and lines that are quietly working produce no messages at all, so I see trouble at a higher rate than the world contains. Same distortion as the forums, in a nicer costume.

What I will stand behind is the shape. The page does not change. The line does. And the only instrument you own that reads the line is the fleet you are already paying for.

Guides and the stack we run and test are at Multi Account Ops.

Get new guides and videos first — join the Telegram channel.

need infra for this today?