I’m working on a free service web application where a user registers with username, email, password… standard user account stuff. There is a referral system where if the user refers three other users to sign up (using their referral code) the original user gets account upgrades.
There is incentive to game this by creating three other accounts using their referral code. Any ideas on how to prevent this? Could block IP or use a cookie but these seem like they are easily defeated. I want to make it easy for a user to create an account so I’d rather not do anything that requires extensive effort in account creation.
You could send them a text message and make them reply via text message or email from the mobile.