With all that said, and knowing this is a cat-and-mouse game, I still need to come up with something. How I can limit accounts to one per user is the part of the equation I don’t yet see—unless I request phone numbers too. Not perfect, but better than nothing, I suppose.
It is a mobile app - you could (if it is available in the SDK) look at the IMEI / serial number of the device? That way it isn't the personal information but merely the objective truth of the device used to register the account.
that is very clever... I'm going to talk to my bro about this.. very clever
Yes, and they will at least have to get a different phone to register, involving some outlay that is more costly than the potential opportunity to gain rewards through anti-social behaviour.
That's what I was thinking - some cost of entry that makes it too expensive to be worthwhile.