Claude's Hidden Credit Score: A Clean IP Is Worth 14 Points, Linux Gets Penalized, Old Accounts Can Withstand It

A screenshot of Python code described as Claude's internal risk-control script has been going viral on X over the past two days.

In the screenshot is a file called scoring_engine.py, with a path reading anthropic/trust/. Its contents are a points system: an account receives an initial score at registration, then gains or loses points based on behavior, and is banned outright if it falls below a threshold. The Chinese community claims to have reverse-engineered this mechanism and lists the factors that affect the score. When Andrew Curran reposted it, he offered a new phrase: New status symbol: Claudescore.

First, let's lay out the rules circulating online.

The code states it plainly: INITIAL_SCORE = 72, BAN_THRESHOLD = 40, WATCH_THRESHOLD = 55, SAFE_FLOOR = 80. In translation: you start at 72 points, enter a watch period around 55, and get banned at 40. Score recovery is very slow, SCORE_DECAY_RATE = 0.003 per day, and passive growth has a cap.

At registration, a clean IP carries the most weight: ip_clean: 14; a residential IP adds another 4 points, a data-center IP deducts 8 points, and a flagged IP deducts 22 points. Gmail is no longer the optimal choice; the material says there are email services with higher weight. An account that immediately triggers KYC at registration can be thrown away. Registering via the mobile app adds 6 points; registering on the web adds none.

At the payment stage, subscribing right after registration deducts points, and going straight to Max causes a large deduction; it's best to wait two days and start with Pro. A foreign physical bank card adds 8 points, Google Play adds 6 points, and a virtual card deducts 11 points. If KYC pops up during payment, it means the account is in an evaluation period, but it won't necessarily be banned.

At the usage stage, don't use up the entire quota in one go; better to rotate between two accounts than to drain one account completely. The Desktop client gives a small point bonus, and mobile also gives a small bonus. Enabling the memory feature adds points; the more memory files, the higher the score. Heavy use of Fable deducts points—this product name is unfamiliar to most people, so set it aside for now.

For IP and devices, stability is key. Don't jump IPs; try to keep using the same one. The proxy must be in global mode and have TUN enabled. Logging in from multiple devices causes a large deduction; the ideal state is one computer, one client. Frequently changing IPs, frequently logging in, and high concurrency all cause large deductions.

For account age, old accounts have enormous tolerance. In the code, LEGACY_ACCOUNT_BONUS says a 2023 account gets 38 points, 2024 gets 22, 2025 gets 11, and 2026 gets zero. There is no difference between Windows and macOS; Linux loses points. A netizen asked why, and the reply said it's not discrimination: in risk-control models, Linux users have a higher proportion of anomalous behavior, and the Linux population overlaps too much with bulk registration and automated scripts. The model doesn't look at what system you use; it looks at the group profile behind that system.

The typical feature of the watch period is getting logged out. As the account approaches the threshold, it may enter a watch period, and continued deductions will lead to a ban. High-score accounts can survive multiple watch periods.

But this code screenshot was quickly questioned. Some pointed out that listing Outlook email as a high-weight email is unreasonable, because Outlook accounts are too easy to bulk-register, and many services now flag Outlook accounts without phone verification. Others picked at the code: the file header says Last modified: 2020-09-14, but a comment below says calibrated 2026-03, which looks manually assembled; there are no version-control traces in the code, yet the modification date and author email are written in comments. A more direct comment was: This has to be fake.

Set authenticity aside for now. These rules spread because they fit the common logic of platform risk control: defensive scoring, give enough initial points, and after that it's all about you not stepping on landmines. A recovery mechanism exists but is extremely slow, basically relying on time. Old accounts are valuable not because they have more features, but because they can withstand deductions. Some netizens added two points: once you fall into the watch period, stop changing cards and environments and fiddling around—the more you move, the more you lose; a single clean point isn't enough—the registration IP, payment-card region, and login IP must be aligned long-term, and that's what matters. Register with a Japanese IP, pay with a US card, then switch login to Hong Kong: what the system sees is not three clean points, but one untrustworthy person.

Treating an internal trust score as a status symbol—that itself is more interesting than whether the code is real. Users can't get their score and can only infer it from behavior, then remind each other 'clean IP,' 'don't jump IPs,' 'subscribe to Pro first.' The more opaque the platform, the more the folk knowledge around it resembles mysticism. Some joke that this is a polite social credit score; others worry that such scoring logic might one day affect real-life credit. Joke aside, next time you see advice like 'a clean IP matters most,' you can think about the score table behind it that you've never seen.