Why does Google sign-in create duplicate accounts?

Google sign-in can create what looks like “duplicate accounts” for a few common reasons:

1. The same person is logging in through different identity methods

   • Example: one account was created with email/password, and later the user signs in with Google using the same email address.
   • Many systems treat these as different auth identities unless they’re explicitly linked.

2. Google returns a different email than expected

   • If the user has multiple Google accounts, they may have signed in with a different one.
   • Sometimes users use email aliases, like name+tag@gmail.com, which some systems normalize and some don’t.

3. The app creates a new user record every time

   • If the backend matches users only by a Google “subject” ID or only by email incorrectly, it may fail to recognize the existing account and insert a new one.

4. Email verification or profile info isn’t handled consistently

   • One login flow may mark an account as verified, another may not.
   • If your app uses “verified email” as the unique key in some places and Google ID in others, duplicates can happen.

5. Account linking was not implemented

   • In many systems, Google sign-in should either:
     • create a new account only if none exists, or
     • link the Google identity to the existing account.
   • Without explicit linking logic, duplicates are easy to create.

How to prevent it

• Use a single canonical user ID in your database.
• Match accounts by a stable identifier such as:
  • Google sub claim / Google user ID for Google-auth accounts
  • and/or a verified email, if your rules allow it
• Implement account linking when a Google login matches an existing email-based account.
• Normalize email handling consistently if you use email as a lookup key.
• Make sure your auth flow is idempotent: logging in twice should not create two users.

If you want, I can also explain the exact fix depending on whether you’re using Firebase/Auth0/NextAuth/custom OAuth.