> What RestoreCord's alt detection compares: the IP and a browser visitor ID, why it is collected right after verifying, per-server matching and false positives.

Source: https://restorecord.tech/alt-signals

# How RestoreCord's alt detection signals work

Alt detection rests on two signals captured while a member verifies in their browser. Knowing exactly what they are, and what they're not, is the difference between catching ban evaders and banning siblings.

[Get started free](https://restorecord.com/register)[View pricing](https://restorecord.com/pricing)

Short answer

RestoreCord compares the request's IP address and a browser visitor ID with earlier verifications in the same server. The visitor ID is only accepted right after the OAuth callback. A match triggers the owner's chosen policy: warn, block or auto-ban.

## The two signals

* IP address: the address the verification request came from
* Browser visitor ID: an identifier derived from the browser environment, posted by the verify page

Neither is proof on its own. Together, and checked against the server's own history, they're strong enough to act on, especially when the matched account was recently banned.

## When the fingerprint is collected

After the OAuth callback succeeds, the verify page posts the visitor ID to RestoreCord along with a short-lived, encrypted reference to the new member record. The server checks how old that reference is and refuses late submissions. The window is long enough for a normal page load and short enough that a fingerprint can't be bolted onto someone else's verification later.

The first visitor ID on a record also wins, so a later visit from a different browser can't quietly replace the value alt detection relies on.

## What gets compared, and what doesn't

Signals are compared with **previous verifications in the same server**. RestoreCord offers no public alt search, and knowing someone's Discord ID tells you nothing about their other accounts. That restriction is deliberate: it keeps the data tied to the community the member chose to join.

## What members can do about it

The visitor ID and IP belong to the member's record in that one server. From RestoreCord's [Manage My Data](https://restorecord.com/mydata) page, members can unauthorize a server or remove their personal details from it, such as IP address, email, location and device. The Discord ID, country and the anonymous fingerprint are kept for security, which is exactly what stops a removal from becoming a way to reset alt detection. Owners who switch off IP logging get a badge on their verify page telling members so.

## From match to action

| Policy        | Effect                                              | Use when                              |
| ------------- | --------------------------------------------------- | ------------------------------------- |
| Warn          | A webhook log flags the match for moderators        | You're just starting out              |
| Block Alts    | Verification is denied with an alt accounts message | Matches have looked right for a while |
| Auto Ban Alts | The matched account is banned automatically         | The server is under active attack     |

## How the signals combine with other layers

Alt matching is strongest when it isn't working alone. VPN and proxy blocking, also on Premium, closes the easiest way to change the IP. The blacklist and Auto-Blacklist on Ban make sure the account behind the original ban is already known. Together they mean an evader needs a new account, a new connection and a new browser at once.

## Reviewing a match

1. 1Check which signal matched: IP only, visitor ID only, or both
2. 2Look at the matched account's history in your server, including recent bans
3. 3Compare behaviour: username style, channels used, timing
4. 4Decide, and if it was a household or school network, let the member through

## False positives and blind spots

* Households, schools, offices and mobile carriers often put many people behind one IP
* A shared family computer can produce the same visitor ID for different people
* A different browser, device or privacy setting can change the visitor ID
* A VPN changes the IP, which is why VPN and proxy blocking is a separate layer

An IP match plus a visitor ID match is far stronger than either alone. Review single-signal matches before taking permanent action.

Alt detection is included on Premium, Business and Enterprise. For the consent side of verification, read [the OAuth2 scopes](https://restorecord.tech/oauth2-scopes), or return to the [overview](https://restorecord.tech/).

## Alt signal questions

### 

### 

### 

## Let the signals do the spotting

Turn on alt detection and start with warnings, then tighten once you trust the matches.

[Try RestoreCord](https://restorecord.com/register)[Alt detection](https://restorecord.com/alt-detection)