How Claude and similar services ban accounts 'for VPN' and 'for toxic passport'

What happened

On October 30, 2026, Habr published an article by Alexander from the company Aurorium. Aurorium makes an anti-detect browser — a tool that spoofs the device and browser fingerprint. The occasion for the analysis was a wave of reports about Claude account blocks.

Users write that they are banned after verification with a passport from a certain country. According to the author, the service rules do not explicitly prohibit holders of such a passport from using the services. At the same time, the company has a ban on conducting activities and providing services in a number of countries.

The difference is fundamental. A ban on operating in a country is about jurisdiction. Filtering by document is about a person. The author draws an analogy with 'a news story from another continent in the 1950s.' This is his formulation, not a conclusion from data.

There are precedents for blocks. The author describes the Reddit discussion as a 'mighty howl.' There are no exact figures — how many accounts were banned and for what exact reasons — in the source. There is no data.

The author separately notes: he himself does not use Claude and GPT, prefers Gemini, but has encountered blocks personally.

Why 'for VPN' and 'for passport' are usually the same signal

Anti-fraud (anti-fraud — a system for detecting fraudulent actions) rarely relies on a single attribute. Usually it collects a set: IP address, country of the payment method, phone number, document during verification, device fingerprint.

KYC (Know Your Customer — an identity verification procedure) adds another layer. The document ties the account to a specific country.

Example. A user logs in from the IP of one country, pays with a card from a second, and passes verification with a passport from a third. Each parameter separately may be legal. Together they create a mismatch. The system sees not 'a person with a passport' but a mismatch in the geo-profile.

VPN (Virtual Private Network — a virtual private network that changes the visible IP) breaks the first part of this picture. Hence the 'VPN and passport' link: these are not two different bans but two elements of one check.

How exactly Anthropic's check is structured, the company does not disclose. There is no data.

Where geoblocking ends

Geoblocking is a restriction of access by territory. Technically it is implemented by IP and payment details. Citizenship is not part of this scheme by definition: the service does not know the passport until you show it.

When a service introduces a document check, it acquires a new attribute. Then it is a policy question: use it to comply with sanctions or for broader filtering.

The author emphasizes: the service rules do not prohibit holders of a specific passport. That means either the ban is issued for another reason and the passport is a coincidence, or a rule is applied that is not in the published documents.

The second option is what discussions call a 'toxic passport.' The term is unofficial; it is not in the rules.

How it looks from the other side

Anti-detect browsers and anti-fraud are a paired race. The former spoof the fingerprint (canvas, WebGL, user-agent, etc.), the latter looks for inconsistencies between the declared and the actual.

Example from an adjacent area. If the browser reports a different operating system, but the font set and timings reveal the real one, anti-fraud will notice this. Same with geo: the IP says one thing, the time zone and language another.

With a passport it is more difficult. The document is checked by a KYC provider, often a third party. It gives the service the result: 'the document is genuine, the country is such-and-such.' Then the service decides what to do with this result. Sometimes nothing. Sometimes a block.

How many such checks pass and what percentage end in a ban — there is no data. There are estimates in discussions, but there are no verifiable figures behind them.

What to do about this

• Do not consider VPN sufficient protection. It changes the IP, but not the payment method, not the phone number, and not the document.
• Keep the geo-profile consistent. IP, card, phone, and document from one country reduce the number of mismatch signals.
• Read the rules before verification. If the document is not mandatory for your scenario, do not send it.
• If a ban has occurred, request the reason from support in writing. A link to a specific rule is more useful than emotions.
• Do not rely on one service. A backup account with another provider is planning, not paranoia.