Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say I create a site to rank doctors/lawyers based on reviews/ratings by people who have used their services.

How do I prevent that constituency from logging on, creating fake accounts and adding fake reviews/ratings to say how awesome they are in an effort to boost the perception of their own reputation?

share|improve this question
up vote 2 down vote accepted
  • Require email verification for accounts. Google even requires an SMS verification; not sure if you want to go that far.
  • Look for high correlation between matching IP's and identical opinions. Keep a log of all the IP's a user has logged in with. See if those IP's match other users' logs. harrymc explains how this can be circumvented, but maybe geolocating suspicious IP's could show trends indicating abuse. 2 legit cases though: Users are within the same corporate network so they all have the same IP, an ISP that assigns dynamic IP's could give 2 different users the same IP (very rare).
  • Sometimes you can just smell a rat, in which case, just do a little checking to see if something's amiss.
  • Sheer volume. The more reviews you get, the harder it will be for any one bogus review to sway the public perception.
  • Require a certain level of participation before a review is posted. e.g., member for 3 months, 20 posts in the forum (if you have a forum).

As "A Dwarf" said, none of this will prevent gaming. The best you can hope is to minimize it. It'll always require some vigilance on your part to constantly adjust tactics: as they begin to understand how you're detecting gaming, they'll try to find ways around it. You find out, they change strategy, etc. ad nauseum.

share|improve this answer

As the first answer states, you can't guarantee that someone isn't going to attempt to "game" your site...

But the question really becomes, how much effort do you want to spend? How can you validate who someone is? Your going to need to have people register for your site... Are you willing to charge a fee? Do you want to force email registration?

All of these methods can help, but there are ways to defeat each of them.

share|improve this answer

You can try and track the answers by their IP address.

If their ISP allocates fixed IP addresses, this would prevent them from answering multiple times from the same connected line.

Even in the case of non-fixed IP, it normally requires one to turn off his router for a certain length of time to be allocated a new IP. As many people today leave their routers on 24/24, with a bit of luck their IP doesn't change that often.

EDIT: This scheme can be defeated if your doctor was sophisticated enough to understand about proxy servers. According to my experience with doctors, there isn't much chance of it.

share|improve this answer

Here are my suggestions

  1. Force registration. That will slow down most spammers already. Log their IP when they register, and make the IP logged and email address both unique - this will prevent someone from the same IP from registering from a different address. Sure, it can be a pain in the neck for anyone who uses a shared IP, but it's not that big a deal. Perhaps develop your system so that particular IP can't be used again for a few hours?

  2. Comments that are reasonably close to each other with a similar score (within minutes or hours of one another with a similar rating) might be legitimate, but if they're that similar and that close to each other someone is probably trying to break the system. For the sake of transparency, these comments should be allowed - but they should have a much lower weight than a comment that doesn't exhibit these signs.

  3. Allow peers to vote up good comments - but make it one vote per comment per account, just like it is here on SuperUser. (And stackexchange sites in general)

  4. Watch out for serial downvoting / negative comments as well - if an account generates a lot of downvotes / negative comments in a short period of time, they're probably not valid and should be weighted / ignored accordingly.

Above all else, make sure that you log all the information to prove that someone is gaming the system if you need to. If someone says "prove I was cheating" you should be able to produce records showing their signup, and activity (voting, commenting, etc).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .