Cloud Account Verification: What Providers Actually Check

Account verification is usually described from the outside as a barrier. From
the provider’s side it is a risk assessment, and knowing what is being assessed
explains both why it exists and why some entirely legitimate people have a
harder time with it than others.

Identity, and whether it is consistent

The central question is whether there is a real, accountable person behind
the account. The evidence is mostly consistency: does the name on the account
match the name on the payment method, does the billing address belong to the
same person, is the phone number reachable, does the email address look like
something a real organisation or individual uses.

No single one of these decides anything. They are weighed together, which is
why one unusual detail is usually fine and three together is usually not.

Payment method, as proof rather than payment

A card is required for free tiers on almost every platform, and this confuses
people who reasonably ask why they must supply payment for something free. The
answer is that a card is an identity document that happens to also work for
payment. Obtaining one requires passing a bank’s own checks, so presenting one
transfers some of that assurance to the cloud provider.

A small authorisation may appear and be reversed. Oracle’s is documented as a
single unit of currency, refunded immediately. It is a validity check, not a
charge.

Geography, and whether the signals agree

Providers compare the country of the IP address, the billing address and
sometimes the phone number. Agreement is unremarkable. Disagreement invites a
closer look, because it is a common pattern in account fraud.

This is the check that most often catches honest people: someone travelling,
someone living in one country with a card issued in another, someone using a
corporate VPN. None of those is wrongdoing, and all of them look like the thing
the system is designed to catch.

Connection reputation

VPN exit nodes, anonymising proxies and data centre IP ranges carry worse
reputations than residential connections, because abuse disproportionately
arrives from them. Hetzner states directly that using a VPN during registration
makes identity verification harder. This is not a judgement about privacy
tooling; it is that the provider loses a signal it would otherwise use.

Duplicate and related accounts

Platforms with generous free tiers care about this most, because the
incentive to create repeat accounts is highest there. Kamatera limits each
customer to one account and one free trial and is explicitly built to detect
duplicates and suspicious activity, with locking as a possible outcome. Oracle
monitors for multiple accounts from the same address and for disposable email
domains.

The signals used include email address, payment method, IP address, device
characteristics and phone number. Changing one of them does not make an account
unrelated.

What happens after approval

Verification is not only a gate at signup. Providers continue to watch for
behaviour that does not match the account’s established profile: a sudden change
in login geography, an unusual spike in resource creation, or outbound traffic
patterns that look like abuse.

This is why an account that passed verification can still be suspended later,
and it is the specific mechanism that makes purchased accounts fragile. The
account was verified against one person’s identity and is then used by someone
else, from somewhere else, in a different pattern. For what that means in
practice, see
why purchased accounts get
suspended.

If your genuine situation looks unusual

Some people’s circumstances legitimately trip these checks. A few things
help:

• Remove the variables you can. Register without a VPN, from the location
  your billing address is in, if that is possible.
• Use a business email address and business details if you are registering as
  a business, consistently across every field.
• Have an identity document ready. The document route is usually the fastest
  resolution when a registration is held.
• If a provider genuinely will not accept your situation, choose a different
  provider rather than trying to disguise it. Verification strictness varies a
  great deal between the ten platforms, and the
  verification
  comparison sets out which are strictest.

That last point is the practical one. The requirement is not negotiable, but
it is not identical everywhere either, and picking a platform whose process you
can actually satisfy is a legitimate strategy in a way that working around a
process is not.