Fake users in firebase with @gmail.com accounts

Viewed 1470

I have a firebase project. The next sign-in methods auth are enabled:

  • Google
  • Facebook
  • Apple
  • Anonymous

A mobile app interacts with the firebase.

Each day I get some weird new users sign-ups with fake accounts with the pattern: [name][numbers]@gmail.com. They don't do anything except sign up via google oauth once.

Is it possible to prevent it? Maybe I missed something with the google oauth configuration?

Updated:

Also, I noticed that these sign-ups started to occur when I had sent out the mobile app to google/apple verification. May these two events are correlated?

5 Answers

If you are sure those fake users have a specific pattern from their email address, I would make a trigger function on Cloud Functions for Firebase.

You can use functions.auth.user().onCreate() event handler like below.

exports.checkFakeUser = functions.auth.user().onCreate((user) => {
  // You can check if the user has suspicious email patterns and delete them here.
});

Or you can also make a Schedule function on Cloud Functions for Firebase and daily check if there are fake users and automatically delete them.

Plus, it would be a good step if you figure out that fake users still joining even you didn't expose your mobile app anywhere if you want to find out the reason how they are joining.

New accounts created coz of Play market Pre Launch Report

You can change Pre Launch Report settings to change it's behaviour (e.g. specify test account to use in auth)

Pre Launch Report Settings

Add the following Cloud Function will help you on check the email and delete the fake user

    exports.checkFakeUser = functions.auth.user().onCreate((user) => {
        const list = user.email.split(".")[1].split("@")
        const isFake = list[0].length === 5 && list[1] === 'gmail'
        if(isFake){
            admin.auth().deleteUser(user.uid)
            .catch(function(error) {
                console.log('Error deleting user:', error);
            });
        }
    });

You can't stop specific accounts from being created, as the underlying Google Auth APIs are accessible to anyone with an account. You could manually delete them, or write a program to delete them (bearing in mind that you could also be deleting actual user accounts).

Or if you suspect abusive behavior, you can contact Firebase support to report that.

Check, these e-mail addresses will be re-logged when they upload a new version to google play. The most likely reason for this is that google keeps your application to a number of tests with its automation infrastructure.

Related