Skip to main content

Free trial abuse: 7 ways people farm your free tier and how to stop each

· 4 min read
Signitize
Signitize
Email checks for signup forms

A free tier is a marketing budget. Every account costs you something: compute for an AI tool, seats for a SaaS, a coupon for a shop. Most people use it as intended. A few create dozens of accounts, and for products with expensive free credits, those few can cost more than everyone else combined.

Here are the seven tricks we see most, what each one costs to stop, and which ones an email check can and can't solve.

1. Email aliases​

The trick: one Gmail inbox, many addresses: [email protected], [email protected], [email protected]. Each one looks new to your database.

The fix: store a canonical version of every email in a unique column, so all aliases of one inbox collide. The rules differ per provider (dots matter at Outlook, not at Gmail), so this needs care: see How to stop users creating multiple accounts with Gmail aliases.

Cost to you: one column and one lookup. This is the cheapest win on the list.

2. Disposable inboxes​

The trick: a temporary inbox from yopmail, mailinator or one of hundreds of similar services. No account, no phone, a new address every time.

The fix: check the domain at signup and reject throwaway domains. A static list goes stale quickly, so use a check that also detects new domains. See How to block disposable email addresses at signup.

3. Made-up addresses​

The trick: signing up with [email protected] or an address on a domain that doesn't exist, because your product works before the email is verified.

The fix: two layers. Reject addresses that can never receive mail (domain doesn't exist, publishes "no mail", or the username breaks the provider's rules). Then make the verification email the gate: don't hand out the free credits until the link is clicked.

4. Many real accounts at free providers​

The trick: creating several genuine Gmail or Outlook accounts. Each one is a real, separate inbox.

The honest answer: no email check can tell that [email protected] and [email protected] belong to the same person, and anyone who claims otherwise is guessing. Making new Google accounts takes effort and, increasingly, a phone number, which limits how far this scales. Beyond that, you need signals other than email:

  • a payment method on file for the higher tiers, even if you don't charge it;
  • phone verification for the most valuable perks;
  • rate limits per IP address range and per device on account creation.

5. Scripts and bots​

The trick: automating the signup form to create accounts in bulk.

The fix: a challenge on the signup form (Cloudflare Turnstile, hCaptcha, reCAPTCHA) and per-IP rate limits on the signup endpoint. Email checks help here too: bots need many addresses, and the cheap sources of addresses are aliases and disposable inboxes.

6. Referral and coupon loops​

The trick: referring yourself. Sign up a second account with an alias, claim the referral bonus on both sides, repeat.

The fix: pay referral rewards only when the referred account is verified and has done something real (made a purchase, used the product for a week). Compare canonical emails of referrer and referred: [email protected] referring [email protected] is the same person.

7. Restarting a trial after it ends​

The trick: when the trial ends, sign up again with a variation of the same address. Or come back after being banned.

The fix: never delete expired or banned accounts outright; keep at least their canonical email. A returning alias then matches the old account, and you can show "Your trial has ended" instead of starting a new one.

Put the perks behind the checks, not the user​

The pattern that ties these together:

  1. Check the email at signup. Reject disposable, undeliverable and duplicate addresses with a clear message.
  2. If the check can't run (timeout, outage), don't block the signup. Create the account as pending.
  3. Hand out free credits, trial time and referral rewards only when the account is checked and verified.

Real users barely notice step 3. Abusers lose the reason to sign up. Never block a signup has the code for this, including the job that rechecks pending accounts.

Where Signitize fits​

Signitize covers tricks 1, 2 and 3 with one call: a canonical email for duplicates, disposable for throwaway domains and deliverable for addresses that can never receive mail. It does not solve 4 to 7 on its own; those need the product rules above.

The Free plan includes 2,500 checks a month, enough for most early products. Get a free API key, or read the Quickstart.