On a typical membership or eLearning site, 15-20% of accounts are being shared. Not stolen – shared. A member hands a login to a friend, a colleague, a whole classroom, and because the content plays the same for whoever logs in, nothing breaks and nobody gets alerted.
Ahmed Saleh, founder and CEO of Rupt, has built a company on measuring that number and acting on it. His argument is counterintuitive: account sharing is the rare abuse problem that is also a growth channel. The people using your product without paying already know it, use it, and like it. The only step left is getting them to pay – and how you ask decides whether they convert or leave.
This is a breakdown of the math, the psychology, and the execution details, straight from the episode.
How Common Is Account Sharing on Membership Sites?
Rupt ran a study across subscription businesses to measure what percentage of accounts are shared. In eLearning and memberships, the account sharing range ran from 5% on the low end to 45% on the high end, with most membership sites landing around 15-20%. Ahmed's explanation for why account sharing ranks so high in these verticals is structural: the value is right there in the content. There is no inbox, no CRM, nothing personal attached to the login – you sign in, consume, and move on.
The reason most operators have no reliable account sharing number of their own is tooling. Generic analytics can produce estimates, but they are not built for account sharing detection, so the estimates stay guesses. Ahmed ran into this at his previous company, an eLearning business that charged per seat. Institutions would sign up with 30 or 40 instructors, then subscriptions would drift down to four or five seats while usage kept climbing. The customers had figured out they could just share, and no mechanism existed to measure the account sharing, let alone address it. That gap is why Rupt built its own device identification technology instead of relying on standard browser fingerprints – to say exactly how many distinct devices, and likely how many distinct people, sit behind one login.
The Back-of-Napkin Math
Ahmed's rule of thumb: 5-10% net new revenue from stopping account sharing. At $1M in revenue, that is $50-100k. His derivation runs like this: assume 20% of accounts are shared, apply the 30-60% conversion rate he sees for eLearning, and you land around 10% growth on average – 5% as the conservative floor, 20% as the high end he has seen. Either way, it is money from people already using the product.
On the ROI of the tooling itself, Ahmed's instruction is to count the entire timeline, not just the first month. His example: pay $100 a month for an account sharing tool, convert two members at $30 a month each in the first month, and you have recovered 60% of the cost. Convert two more the second month and you are at $120 in MRR – ROI positive, and every conversion after that stacks, because converted members stay in MRR.
There is a calculator on rupt.dev that runs the account sharing projection for your own numbers.
The Mistake: Treating Sharers Like Thieves
The instinct with account sharing is to block. Ahmed has watched operators go further – limiting accounts to a single session so a second tab logs out the first, forcing two-factor authentication on every login. That punishes every paying member to get at the sharers, and it degrades the product for the people who fund it.
The personal email is the same mistake in a politer costume – it comes from trying to be careful but feels accusatory. One of Rupt's early customers detected clear account sharing, but hesitated to turn on the automated challenges, worried they would seem accusatory and hurt the customer relationship. So they did what felt like the gentle thing: they picked a short list of flagged accounts and emailed them by hand to talk it through. What they got back was denial – we are not sharing, why are you accusing us – and when the company pointed to the data, the customer disputed the data. The account really was being shared, it turned out: a few employees had let the credentials leak, and they spread far beyond the original company.
But the data being right did not save the conversation, because the channel was wrong. A personal accusation puts a human on the defensive, and a defensive human denies. An automated challenge never becomes that conversation. It is not a person pointing a finger – it is a prompt from the system, and it always arrives with an off-ramp: verify you are the owner and carry on, or take the incentive and get your own account. That is the logic behind Ahmed's rule for the whole flow: act in an incentive way, never an accusatory one.
The incentive framing is not just a courtesy – it is the entire business case. “Account sharing is kind of a nice form of fraud,” Ahmed says. “It is one of the few forms of abuse that represents an opportunity for your business.” The customer who emailed suspected sharers by hand was trying to protect a relationship – and the relationship is exactly what makes account sharing valuable.
Sharers already know the product, use it, and keep coming back. Few marketing channels put you in front of an audience that pre-qualified.
Convert, Don't Punish: The Challenge Flow
The flow Ahmed recommends borrows from Netflix. Detect the account sharing, show a polite challenge – we noticed multiple people on this account, here is a free trial or a discount on your own – and let the sharer convert themselves. Rupt builds the incentives in so operators can experiment: a free month here, a discount there, and tracking on which challenge produced which conversion.
Sharers fall into three cohorts, and each needs different handling. The convenience sharers are the largest win: sharing was simply easier than signing up, and a little pressure tips them. In Rupt's experiments, 40% convert on the first few challenges. The second cohort genuinely cannot afford the product; discounts are the tool there, within whatever limits you set. The third cohort can afford it and will never pay. Those accounts cost you money indefinitely, and Ahmed is blunt about it – cut them off.
The data point that should shape every account sharing flow: 60% of conversions from account sharing happen after the tenth challenge. A flow that gives up early abandons most of its eventual revenue. Politeness plus persistence is the mechanism, and it only works if the challenges keep coming.
Two rules sit underneath all of it. Never hard-block a shared account – the legitimate owner always gets a path to verify ownership through two-factor authentication, email, or phone, and keep moving. And when a member insists the system is wrong, believe them fast: whitelist the account and move on. False positives churn the wrong people.
Does It Work? The Evidence
The Sketchy story is the clearest illustration of the psychology. A product leader at Sketchy, a longtime Rupt customer, told Ahmed how they discovered their account sharing problem: they went to the schools and asked students how they got access. The answer was a friend who loved the product so much they handed the login to the whole class. “We kind of feel good and bad at the same time,” the product leader told him – the students had no idea sharing hurt the company, and once they were told honestly, they were receptive to stopping.
The clearest illustration of the revenue comes from the early customer whose manual emails backfired. Once they switched to automated challenges – with the verification path and the whitelist escape hatch – they recovered more than $1M in ARR. The accounts flagged for account sharing turned out to include entire external organizations using one company's credentials, and those organizations converted into customers of their own.
Ahmed also points to the public version of the same math: when Netflix rolled out paid sharing, he recalls, revenue jumped. The streaming companies moved on account sharing because the number was big enough to matter. Membership operators are working with the same dynamic at a different scale.
When to Wait – and How Not to Punish Paying Members
Protection is not always the right move yet. Ahmed names two cases to skip.
Do not protect free plans – there is nothing to recover. And if the product is under $49 a month with fewer than 100 users, wait; there is not enough account sharing in the customer base for the math to work. It starts making sense around 500 users, or at any size when the product is high-ticket – at $100+ a month, a single conversion can pay for the tool.
For everyone past that line, the risk to manage is false positives, and Ahmed's definitions show how much precision that takes. Impossible travel only counts when the distance exceeds 500 kilometers inside a time window no plane could cover, with no VPN or proxy involved, on the same network type – because a mobile connection routing through another state is not account sharing. Concurrency only counts when two live, simultaneous connections run from two different IP addresses on the same device class. A phone and a laptop at the same time is normal life; two laptops on two networks at the same time is not.
The approach follows from that precision: assume good intent, act only on high confidence, and err on the side of caution. Sharers share repeatedly, so a cautious system still catches them – it just never burns a paying member to do it. Ahmed's own ROI figure for account sharing protection done properly is three to ten times the cost, sometimes twenty, and his advice is to take that and not get greedy.
What Membership and eLearning Operators Can Take From This
Ahmed runs a detection company, not a membership site, but the lessons land directly on membership operations.
Measure account sharing before you do anything about it. The prevalence range Rupt publishes – 5-45%, with most membership sites near 15-20% – is a planning assumption, not your number. Your number is knowable, and every downstream decision depends on it: whether to protect, how firmly, what it is worth.
A shared login is a warm lead. Sell to it. The sharer already consumes the content and keeps coming back, and a polite challenge with a real incentive converts 30-60% of sharers in eLearning. They know the product, they use it, they just have to pay for it.
Persistence beats force. Most conversions arrive after the tenth challenge, so the flow has to be polite, indefinite, and easy to escape for anyone who verifies ownership. Hard blocks and accusatory emails punish the members who pay you.
Ahmed Saleh is the founder and CEO of Rupt, which detects account sharing, payment fraud, and fake accounts for subscription businesses, with a WordPress plugin that installs in a few settings.
Learn more at rupt.dev.
See exactly which of your accounts are shared, how many people are on each one, and how much revenue is sitting there to recover.
MemberFix readers get 14 days instead of the standard 7, plus a setup call with the founder himself at https://rupt.dev/memberfix/
Running a Membership or eLearning Platform on WordPress?
MemberFix provides managed WordPress operations for membership, eLearning, and community platforms — so your team never has to worry about the tech breaking during a launch or losing members to site issues. We handle development, support, updates, and monitoring with SLA-backed guarantees. Trusted by industry leaders like Echelon Front, TechServe Alliance, and hundreds of others since 2014.
About MemberFix Radio:
We interview experts and share insights for membership site owners and subscription business leaders building sustainable, profitable recurring revenue models.
