Risk Engine

Multi-Account Behavior Detection
for Prop Firms

Detect coordinated trading across challenge and funded accounts — copy-trading abuse, synchronized hedging, shared device fingerprints, and prop firm collusion patterns identified in real time across your entire account base.

Book a Demo Rules Library
5+
Correlation Signals
Cross
Account Analysis
100%
Auto-Enforced
3 Accounts Correlated
Copy-Trade Cluster Flagged
Cross-Account Correlation Analysis
#4401 ↔ #4402 98.2% match Copy-Trade
#7710 ↔ #7711 96.4% match Copy-Trade
#3301 ↔ #3305 82.1% match Hedge Pair
#9901 ↔ #9902 74.3% match Monitoring
#1105 ↔ #1108 14.8% match Clean
Capabilities

Every Cross-Account Abuse Vector

From identical trade timing to shared device fingerprints — five independent correlation signals built to catch collusion at scale.

Trade Timing Correlation

Compare trade open/close timestamps across accounts in millisecond resolution. Accounts consistently opening the same instrument in the same direction within 500ms of each other trigger an automatic copy-trade flag.

Coordinated Hedging Detection

Identify account pairs where one consistently trades long and the other trades short on the same instrument at the same time — a hedging structure designed to guarantee funded account payouts through challenge manipulation.

Device & Browser Fingerprinting

Match accounts sharing the same device ID, browser fingerprint, platform login, or MT4/MT5 terminal identifier — even when accessed through different IP addresses or login credentials.

IP Cluster Analysis

Map accounts sharing login IP addresses across sessions. Clusters of 3+ accounts consistently logging in from the same IP — with different credentials — are flagged as potential farm or shared-access operations.
Abuse Patterns

Multi-Account Schemes We Detect

From simple copy-trade farms to sophisticated challenge-to-funded hedging structures — every known cross-account abuse pattern covered.

Critical
Challenge-to-Funded Copy Trading
A funded account trades normally while challenge accounts mirror every trade in real time — ensuring the challenge accounts pass easily without genuine risk, creating systematic payout exploitation at scale.
Critical
Guaranteed Payout Hedging
One account takes a large long position, another takes an equal short position on the same instrument. One account will always win — guaranteed profits extracted from the firm regardless of market direction.
Critical
Account Farm Operation
Dozens of challenge accounts operated from the same device or IP, all copying trades from a single source account. Designed to pass multiple evaluations simultaneously using one signal provider.
High
Loss Allocation Scheme
A group deliberately routes all losing trades to challenge/trial accounts while winning trades are allocated to funded accounts — passing evaluation on managed funded accounts while sacrificing throwaway challenges.
High
Third-Party Signal Copy
Multiple unrelated accounts all receiving trades from the same external signal service within milliseconds — creating high trade correlation without a direct account relationship, detectable through timing and instrument overlap analysis.
Medium
Credential Sharing
A single trader logged into multiple funded accounts simultaneously or in rapid succession — accessing accounts purchased under different identities to circumvent per-trader payout or capital limits.
How It Works

Cross-Account Correlation at Scale

Five independent signals computed across every account pair in your firm — in real time, every session.

1

Trade Event Streaming

Every trade open, modify, and close event is streamed into the correlation engine with microsecond timestamps. No batch processing — correlation windows update with every trade event across the full account base in real time.
2

Pairwise Correlation Scoring

For every active account pair, the system computes a correlation score across five dimensions — trade timing overlap, instrument overlap, direction correlation, lot-size ratio, and session overlap — producing a composite match percentage.
3

Identity Signal Matching

Device fingerprints, browser IDs, platform terminal IDs, and login IP history are cross-referenced across all accounts. Shared identity signals are weighted into the composite score even when trade timing differs.
4

Cluster Graph Construction

High-scoring pairs are grouped into clusters — networks of accounts that appear to be operated by the same trader or group. The cluster graph updates in real time as new correlation evidence accumulates or decays.
5

Threshold Breach Enforcement

When a pair or cluster exceeds your configured correlation threshold, the system automatically flags all involved accounts, queues them for operator review, and optionally suspends trading or payouts pending investigation.
6

Evidence Package Generation

Every flagged cluster generates a full evidence package — correlation scores by dimension, overlapping trade list with timestamps, shared identity signals, and a timeline of the coordination pattern — ready for compliance review or dispute escalation.
Multi-Account Correlation Panel
Cluster A — 3 AccountsCorr: 97.1%Suspended
Cluster B — 2 AccountsCorr: 91.4%Payout Hold
Pair #3301–#3305Corr: 82.1%Flagged
Pair #9901–#9902Corr: 74.3%Monitoring
Account #1105Corr: 14.8%Clean
At Scale

Firm-Wide Correlation — Every Account Pair Scored

The system doesn't sample — every account in your firm is evaluated against every other account continuously. As your account base grows, the correlation graph scales automatically without performance degradation.

  • Real-time pairwise scoring across your entire account base simultaneously
  • Five-dimension composite score — timing, instrument, direction, lot-size, identity
  • Auto-generated evidence packages ready for compliance or legal action
  • Configurable thresholds per account type — stricter for funded payout requests
5+
Correlation Signals
Per Account Pair
Real-Time
Pairwise Scoring
Across Firm
6+
Abuse Patterns
Detected
100%
Automated Evidence
Package Generation
Frequently Asked Questions

Multi-Account Behavior FAQs

Everything you need to know about how FXPropTech detects coordinated trading and cross-account abuse in prop firm environments.

Multi-account behavior detection identifies traders who operate multiple prop firm accounts — challenge or funded — in a coordinated way to guarantee payouts or minimize risk. Common abuse patterns include copy-trading between accounts, placing hedged positions across challenge and funded accounts simultaneously, and using the same device or IP to access multiple accounts.

Every trade event is streamed with microsecond timestamps. For every account pair, the system computes a timing overlap score based on how frequently trades on the same instrument and direction open and close within a configurable time window. High timing correlation is a primary indicator of copy-trading or manual coordination.

Coordinated hedging detection identifies accounts that place opposite-direction trades on the same instrument at the same time — one account going long while another goes short. This pattern is used to guarantee one account passes a challenge while the other absorbs the loss, removing all risk from the challenge at the firm's expense.

Device fingerprinting captures hardware identifiers, browser attributes, trading platform terminal IDs, and OS metadata on each login. When the same device fingerprint appears across multiple accounts — even with different IPs or names — it is flagged as a shared-identity signal and weighted into the composite correlation score for those accounts.

IP cluster analysis groups accounts that share the same login IP address within a configured time window. When 3 or more accounts log in from the same IP, they are placed in a shared-IP cluster. This cluster data is combined with trade correlation scores to identify whether the shared access represents a coordinated abuse network.

When an account pair or cluster exceeds the configured correlation threshold, all involved accounts are automatically flagged and queued for operator review. Trading and/or payouts can be suspended automatically pending investigation. Every flagged cluster generates a full evidence package including correlation scores, overlapping trades, shared identity signals, and a coordination timeline.

Yes. Prop firm operators configure the correlation threshold percentage, the minimum number of overlapping trades required before flagging, the shared-IP cluster size limit, and the enforcement action at each score level. Thresholds can be set independently per account phase to avoid false positives during early challenge stages.

Yes. The Multi-Account Behavior module receives shared-IP cluster signals directly from the IP & VPN Tracking module. These signals are merged into the pairwise correlation score, so accounts connected by both trade timing patterns and shared network access receive a higher composite score and trigger enforcement sooner.
Get Started

Close the Loopholes
Across Every Account

Multi-account abuse is the most financially damaging exploit in prop trading. Deploy the correlation engine and stop systematic payout farming before it compounds.

Book a Demo Explore Platform
Cross-Account Correlation
Real-Time Scoring
Evidence Packages
Auto-Enforcement