Gmail Alias Abuse: Detecting Plus and Dot Tricks
One Gmail inbox can generate unlimited unique-looking addresses using plus and dot tricks. Learn how alias abuse fuels multi-accounting and how to normalize and detect it.
To Gmail, john.smith@gmail.com, johnsmith@gmail.com, and johnsmith+promo@gmail.com all deliver to the same inbox. That's a convenience feature, and a gift to anyone who wants to look like many different customers. Alias abuse is one of the most common ways a single person spins up dozens of accounts to farm referral bonuses, free trials, and promo credits.
The two tricks: plus and dot
- Plus (tagging): everything after a
+in the local part is ignored for delivery, soyou+anything@gmail.comall reachyou@gmail.com. - Dot: Gmail ignores dots entirely, so
j.o.h.n@gmail.comequalsjohn@gmail.com.
Combine them and one inbox becomes an effectively unlimited supply of addresses that look unique to any system doing a naive string comparison.
Why it matters
If your fraud checks and uniqueness constraints key on the raw address, alias abuse walks right through them. The fix is normalization: reduce each address to its canonical form before you compare, rate-limit, or count. john.smith+a@gmail.com and johnsmith+b@gmail.com should both collapse to johnsmith@gmail.com.
Detecting alias tricks with RiskUnified
The Email Risk API flags alias manipulation with a single group_control boolean, it combines the Gmail plus-tag and dot-variant tricks into one signal, so you can catch aliasing without maintaining provider-specific normalization rules yourself.
{
"email": "john.smith+promo@gmail.com",
"email_features": {
"prefix": "john.smith+promo",
"group_control": true
},
"risk": { "level": "medium", "signals": ["group_control"] }
}A group_control: true result doesn't mean the user is malicious, plenty of people legitimately tag their mail. But when you see many group_control signups that normalize to the same base inbox, that's multi-accounting, and it's exactly the pattern you want to rate-limit.
Frequently asked questions
Are plus and dot aliases against Gmail's rules?
No, they're legitimate Gmail features. The problem is abuse: using them to appear as many distinct users to a system that compares raw addresses.
How do I stop alias-based multi-accounting?
Normalize addresses to their canonical form (strip +tags, remove dots for Gmail) before enforcing uniqueness, rate limits, and promo eligibility, and flag high volumes of aliased signups.
Does alias detection cause false positives?
Tagging is common and harmless on its own, so treat group_control as one weighted signal rather than an automatic block. It's most useful when many aliases collapse to one inbox.
Try RiskUnified free
Score email, phone and IP risk from one API. 500 free credits every month, no credit card required.