One Customer, Fifty Orders: How Address Tricks Beat Quantity Limits — and How to Stop Them

“Limit one per customer” is one of the most common sentences in e-commerce and one of the hardest to actually enforce. The problem is buried in the word customer. In a store, a customer is a person standing in front of you. Online, a customer is a loose bundle of an email, an account, a payment method, and a shipping address — every one of which can be duplicated, disguised, or faked. So the real question behind every quantity limit isn’t “how many did this person buy?” It’s “are these fifty orders actually fifty different people, or one person wearing fifty masks?”

That’s an identity-resolution problem, and the most common way people defeat it is beautifully low-tech: fake accounts and small lies about where the package is going.

The trick: make one address look like many

Suppose a limit is enforced per account and per shipping address. Spinning up extra accounts — fresh emails, slight name variations — handles the first half. The clever part is the address, because all those orders still have to physically arrive at the same house.

The way around that is to exploit how forgiving the whole delivery pipeline is with text. The same physical home can be written dozens of ways that a naive system reads as distinct addresses but a delivery driver reads as “same house”:

• Spelling and formatting variations. “123 Main St,” “123 Main Street,” “123 Main St.,” “123 Maine St” — different strings, same doorstep.
• Invented unit numbers. Adding “Apt 1,” “Apt 2,” “Unit A,” “#3” to a single-family home that has no units at all. The carrier ignores the phantom apartment and delivers to the house; the retailer’s database sees four different addresses.
• Punctuation, abbreviations, and extra whitespace — a hundred trivial mutations that all normalize, in the physical world, to one location.

Every one of these packages lands at the same door. But if the retailer is deduplicating by comparing address strings, each looks like a brand-new destination, and the quantity limit quietly falls apart. The limit was real; the identity check underneath it wasn’t.

The fix: stop comparing strings, start comparing places

The defense is to stop treating an address as text and start resolving it to a real-world location — which is exactly what postal and carrier address validation is built to do.

Canonicalization. USPS (via CASS-certified validation), UPS, and FedEx all offer address validation that takes a messy input and returns the single canonical form of that address — correct spelling, standardized abbreviations, verified unit. Run every order’s address through it before enforcing a limit, and all those spelling variants and formatting tricks collapse into one normalized address. “123 Maine St” and “123 Main Street” become the same record, and the dedup that was trivially defeated by a typo suddenly works. This single step neutralizes most casual address spoofing.

Unit validation. The same services can tell you whether a unit number actually exists for a given address (USPS delivery-point validation is the classic example). A single-family home suddenly sprouting “Apt 1” through “Apt 5” is a bright red flag — those units don’t exist, and five orders to five nonexistent apartments at one house is not five customers.

Residential vs. commercial classification. Carrier data can also tell you whether an address is residential or commercial — and flag when a residential address is being presented as, or routed through, something it isn’t. A residential home behaving like a shipping hub, or an address that resolves to a known freight forwarder or reshipping service, is a strong signal that goods are being consolidated and moved on rather than bought for personal use.

Bringing payment into it

Address validation catches the “one place, many labels” trick. Pairing it with payment signals catches something bigger.

AVS — the Address Verification System — lets you check whether the billing address a customer entered matches what their card issuer has on file. A mismatch doesn’t prove fraud on its own, but it’s one of the oldest and most useful risk signals there is, because someone using a stolen card usually doesn’t know the real cardholder’s billing address.

Billing-vs-shipping comparison. When the shipping address diverges sharply from the verified billing address — different region, a freight forwarder, an address with no connection to the cardholder — that gap is meaningful. Combine “the billing address doesn’t match the card” with “the goods are going somewhere unrelated to the buyer,” and you’re looking at the signature of either limit-evasion or outright payment fraud.

The double win: inventory and customers

Here’s what makes this worth doing well: the exact same checks defend two different things at once.

On one side, they enforce quantity limits honestly — keeping resellers and bot operators from vacuuming up limited stock behind a curtain of fake accounts and phantom apartments, so real customers get a fair shot.

On the other side, they protect people. The address and payment signals that expose one buyer disguised as fifty are the same signals that expose a stolen account or stolen card being drained by a bad actor — goods quietly redirected to an address the real owner has never seen. Catching “these orders are all going to one house” and catching “this order is going somewhere the real cardholder isn’t” are the same muscle. Invest in it for inventory fairness, and you get account-takeover and carding protection in the same motion.

The honest caveats

As with every defense worth having, the failure mode is punishing the innocent, so these have to be risk signals, not automatic rejections:

• Shipping ≠ billing is often completely legitimate. Gifts, sending something to a partner or parent, shipping to your office, a student at a dorm, someone mid-move. Auto-blocking every mismatch means blocking a huge amount of honest business, especially around the holidays. Weight it; don’t gate on it.
• Validators aren’t infallible. New construction, recently split units, rural routes, and some legitimate apartment setups don’t always validate cleanly. A failed validation is a flag to weigh, not proof of fraud — treat a validation miss as “look closer,” not “reject.”
• Real apartment buildings exist. Multiple orders to different real units at one building can be entirely legitimate. The signal is nonexistent or inconsistent units, not units as such.
• Handle the data responsibly. Addresses and payment details are sensitive; validate and score with the same care you’d want applied to your own.

The theme is the familiar one: these signals are powerful, and precisely because they’re powerful they can hurt real customers if you treat them as verdicts. Score, corroborate, and reserve hard blocks for the cases where several signals agree.

What a defender should take from this

• Never enforce a per-address limit on raw address strings. Canonicalize every address through postal/carrier validation first, or a single typo defeats your limit.
• Validate units and residential/commercial status. Phantom apartments and residential-addresses-acting-commercial are high-value tells.
• Use AVS and billing-vs-shipping as weighted signals. Great for catching both limit-evasion and stolen-card fraud — but never as a lone auto-reject, because legitimate mismatches are everywhere.
• Resolve identity to real-world entities, not fields. The whole game is collapsing “fifty accounts, fifty address strings” down to “one house, one card, one person.” Deduplicate on the real world, not the text.
• Remember it’s dual-purpose. The same system that keeps resellers from beating your quantity limits protects your customers from account takeover and card fraud. That’s two wins from one investment — budget for it accordingly.

“Limit one per customer” will only ever be as honest as your definition of customer. Get that definition right — a real place, a real payment, a real person, resolved from underneath all the small lies — and the limit finally means what it says.

---

This article is a defensive overview of order-level fraud signals and how to use them fairly. It describes how evasion works at a conceptual level and focuses on detection; it contains no operational guidance for committing fraud.