Two shops, one iPhone: what ties seller accounts together besides the IP

[exitanty]

I keep seeing threads where someone runs two legitimate shops (separate businesses, separate owners on paper), buys a clean Residential IP for each, and still gets them linked. The IP is usually the first thing people fix and the last thing that actually links them. Here is the list I go through before a second shop ever logs in on the same device.

1. Browser storage. Cookies are obvious, but localStorage, IndexedDB and cached payment-page data survive "clear cookies". If both shops ever opened in the same browser profile, assume they already share storage. One shop = one profile, from the very first login.

2. Device fingerprint. Timezone, language, screen size, fonts, canvas and WebGL output. Two accounts opened from the same Safari on the same iPhone look like the same device, whatever the IP says. The fingerprint also has to match the connection: a US Residential IP with a Moscow timezone and a Russian keyboard locale is a stronger signal than either one alone.

3. WebRTC and DNS. A proxy set at the app level does not always carry WebRTC and DNS. If a leak test shows your home IP or your ISP's DNS next to the proxy IP, the proxy is cosmetic. Check it inside the same profile the shop uses, not in a fresh tab.

4. Everything that is not the browser. Bank account, card, PayPal, return address, phone number, tax ID. Marketplaces link these directly and no browser setup changes that. If two shops share a card or a return address, they are linked, full stop.

5. Who logs in, and how. When a second person helps with a shop, sharing the password (and then the SMS code) creates a new login from a new device every time. Handing over a session instead of a password keeps the device history consistent and means nobody else learns the password.

What this does not fix. If an account is restricted or suspended, a clean second setup is not a way around it. Marketplaces treat that as circumvention, and it usually ends with both accounts gone. Reinstatement goes through the appeal. Separation is for shops that are legitimately separate from day one.

Full disclosure: I'm on the team behind ExitAnty, a browser for iPhone and Mac with isolated profiles, so this is the problem we look at every day. Not linking anything here, forum rules. Happy to answer questions about any of the checks above.

What would you add to the list? The "non-browser" section is where I see most people get caught.