---
title: "Follow the thread: a new dashboard to investigate account abuse"
description: "Cloudflare’s new Account Abuse Protection dashboard helps fraud teams investigate account abuse by moving beyond stateless identity checks to a stateful trust model. The dashboard uses cryptographically hashed identifiers, called Hashed User IDs, created from customer-provided identifiers like email or username, to anchor account activity across login and signup events. It provides an account population overview with metrics like total events, unique IPs, and devices to spot anomalies such as leaked credential matches or unusual login failure rates, then allows analysts to filter and drill into individual accounts. Each account view shows historical behavioral, network, and device signals, enabling teams to reconstruct events and decide on responses like WAF rules. The dashboard also introduces two new roles—Account Abuse Protection and Account Abuse Protection PII—to enforce least privilege for dashboard access and PII exposure."
---

# Follow the thread: a new dashboard to investigate account abuse

[Cloudflare](https://yomu.fyi/company/cloudflare) · Nicole Justus · Oct 2, 2026

**Type:** Announcement

## Summary

Cloudflare’s new Account Abuse Protection dashboard helps fraud teams investigate account abuse by moving beyond stateless identity checks to a stateful trust model. The dashboard uses cryptographically hashed identifiers, called Hashed User IDs, created from customer-provided identifiers like email or username, to anchor account activity across login and signup events. It provides an account population overview with metrics like total events, unique IPs, and devices to spot anomalies such as leaked credential matches or unusual login failure rates, then allows analysts to filter and drill into individual accounts. Each account view shows historical behavioral, network, and device signals, enabling teams to reconstruct events and decide on responses like WAF rules. The dashboard also introduces two new roles—Account Abuse Protection and Account Abuse Protection PII—to enforce least privilege for dashboard access and PII exposure.

## Context

Traditional identity verification checks are stateless and can be bypassed by AI-generated synthetic media and stolen credentials. Cloudflare’s Account Abuse Protection introduces a stateful trust model that evaluates account behavior over time using edge-generated signals.

## Approach / What changed

The dashboard uses Hashed User IDs, cryptographically hashed from customer-provided identifiers, to aggregate login and signup events with network and device signals. It provides an account population overview for spotting anomalies, filters to narrow investigations, and individual account views with event logs. Two new roles control access to the dashboard and PII.

## Takeaways

- Account Abuse Protection uses Hashed User IDs to create privacy-preserving, per-domain account profiles from login and signup events.
- The dashboard provides an investigative funnel from population-level metrics to individual account event logs, enabling reconstruction of abuse patterns.
- Two new roles—Account Abuse Protection and Account Abuse Protection PII—allow customers to enforce least privilege access to the dashboard and sensitive data.

## FAQ

### How does Account Abuse Protection create privacy-preserving identifiers?

Customers configure an identifier like email or username from their login flow. Cloudflare cryptographically hashes that value to create a per-domain Hashed User ID, which anchors account activity without exposing the original identifier.

### What is the investigative funnel in the dashboard?

The dashboard starts with an account population overview showing total events, unique IPs, devices, and country/ASN breakdowns. Analysts can filter to suspicious cohorts and then drill into individual account views with event logs and historical signals.

### How can analysts respond to a compromised account?

After reviewing the account's event history and signals, analysts can use the Hashed User ID in a WAF rule to challenge or block future requests associated with that identifier.

**Tags:** [Application Security](https://yomu.fyi/topic/application-security), [Cloudflare](https://yomu.fyi/topic/cloudflare), [Fraud Detection](https://yomu.fyi/topic/fraud-detection), [Security](https://yomu.fyi/topic/security)

- Source: [Cloudflare](https://blog.cloudflare.com/account-abuse-protection-dashboard)
- Source URL: https://blog.cloudflare.com/account-abuse-protection-dashboard
- Ingested by Yomu: 2026-10-02T15:00:12.488Z

[Read original post](https://blog.cloudflare.com/account-abuse-protection-dashboard)