Detection of fraudulent account usage in distributed computing systems

A computing device in a distributed computing system having a plurality of servers interconnected by a computer network for providing a computing service to users, comprising:

• a processor and a memory operatively coupled to the processor, the memory containing instructions executable by the processor to cause the computing device to:
• receive, via the computer network, an indication that usage of an account of the computing service violates a usage restriction imposed by a provider of the computing service or a government entity, the account having one or more content items accessible to users of other accounts of the same computing service;
• and
• in response to the received indication,
• disallow access to any of the one or more content items associated with the account while maintaining the account as being a valid account of the computing service such that the one or more content items are shown as present in the account but access to view or download the one or more content items by the users of the other accounts is disallowed, including to:
• upon receiving, from a user, an access request to access the disallowed one or more content items associated with the account,
• indicate, to the user, that the account is a valid account;
• provide, to the user, a list of the one or more content items associated with the account;
• and
• prevent any of the one or more content items in the list from being viewed or downloaded by the user;
• collect usage data related to the account or the one or more content items associated with the account before and/or after disallowing access to the one or more content items associated with the account;
• determine that another account of the computing service also violates the same usage restriction imposed by the provider of the computing service or the government entity by comparing the collected usage data related to the account having access to the one or more content items disallowed and usage data related to the additional account;
• and
• deactivate the another account determined to violate the same usage restriction imposed by the provider of the computing service or the government entity.

A method performed by a computing device in a distributed computing system having a plurality of servers interconnected by a computer network to provide a computing service to users, the method comprising:

• receiving indications that usage of multiple accounts of the computing service violates a usage restriction imposed by a provider of the computing service or a government entity, the multiple accounts individually having a content item accessible to users of other accounts of the same computing service;
• in response to receiving the indications,
• continuing to present the multiple accounts as valid accounts of the computing service while preventing access to view or download any content items associated with the multiple accounts such that the content items are shown as present in the multiple accounts but cannot be viewed or downloaded by the users of the other accounts, including:
• receiving, from a user, an access request to access the disallowed one or more content items associated with one of the multiple accounts;
• and
• in response to receiving the access request,
• indicating, to the user, that the one of the multiple accounts is a valid account;
• providing, to the user, a list of the one or more content items associated with the one of the multiple accounts;
• and
• preventing any of the one or more content items in the list from being viewed or downloaded by the user;
• collecting usage data related to the multiple accounts or to the content items associated with the multiple accounts while the content items are shown as present in the multiple accounts but access to view or download the content items in the multiple accounts is disallowed;
• aggregating the collected usage data to identify a commonality of the multiple accounts;
• determining whether usage of an additional account of the computing service also has the identified commonality;
• and
• in response to determining that the usage of the additional account also has the commonality, indicating that the additional account also violates the usage restriction and deactivating the additional account without accessing any content items in the additional account.