Learn · 7 minute read · updated 1 November 2026

How to stop free-trial abuse without blocking real users

Free-trial abuse is one person, or one script, taking many free accounts from a product that gives new users something for nothing. The fix is not a harder signup. It is deciding how much free value each new account gets, based on how it arrived and what it is linked to, and keeping that decision invisible to the people you want.

What free-trial abuse looks like

It rarely looks like an attack. It looks like growth: a good week of signups, a spike in usage, and a cloud bill that does not match revenue. Four patterns account for most of it.

• Account farmsOne person with fifty accounts, each used until the free credits run out. The same laptop, the same network, addresses like jake1041@, jake1042@, and a new account the moment the last one dries up.
• Scripted signupsA script creating accounts by the thousand, usually from hosting networks, with a browser that never moves a mouse. The crude version trips a CAPTCHA; the current version uses a real browser and a solver service.
• Disposable identitiesThrowaway email domains, a VPN per account, a clock that disagrees with the network. None of these is proof on its own. Together they are the signature of someone who intends not to come back.
• Credit resaleFarmed accounts whose API keys are sold on, so your free tier becomes someone else's paid product. This one shows up as credits burning at machine speed in the first hour.

AI products feel this hardest because the free credit is real compute. A free tier of generated images or model calls has a direct cost per account, so a farm of a thousand accounts is a bill, not a rounding error.

Measure it before you change anything

Most teams guess, and the guess is usually either "we don't have a problem" or "it's half our signups". Both are wrong often enough to be worth an afternoon with a spreadsheet. Export your signups for the last ninety days with the account's creation time, email, network, credits used and whether it ever converted or returned, and look for three things:

1. Burn and vanish. Accounts that used most of their free credits within a day and were never seen again. Real trials ramp up over days; farms use everything at once.
2. Groups. Many accounts sharing a device fingerprint, a network, or an address pattern. Individually they look fine. As a group they are one customer with fifty names.
3. Bursts. Twenty signups in a ten-minute window at 3 a.m. are not a marketing win.

Add up the free credits consumed by those accounts and multiply by what a credit costs you. That number is your budget for fixing it, and the argument you take to your team. If you would rather not build the spreadsheet, a free signup-abuse audit does the same arithmetic from a CSV export.

Why the usual fixes disappoint

Each of these decides access: in or out. Abuse is a question of value: how much should this account get for free? Once you frame it that way, the answer stops being binary and the real users stop paying for the fake ones.

The playbook

1. Decide credits, not access

   Give every new account a credit tier instead of a yes or no: full credits for most, a reduced allowance for the doubtful, a hold for the obvious, and a human review for the rare case worth a person's time. A real user who looks unusual still gets in and still gets something. A farm gets too little per account to be worth running.

2. Link accounts to each other

   Farms are invisible one account at a time and obvious as a group. Keep a keyed hash of the device, the shortened network prefix, and the pattern of the email address, and count how many earlier accounts share them. Three accounts from one device in a week is a signal. Fifteen is a verdict. Treat colleagues on identical company laptops as the exception they are.

3. Prefer signals that cost the attacker, not the user

   Disposable email domains, hosting and VPN networks, Tor, a browser clock from a different country than the network, a machine-made address, a form filled without a single keystroke or pointer movement. Each is cheap to check, costs a real user nothing, and costs a farm money or effort to fake. Weigh them; never let one decide alone.

4. Step up instead of blocking

   When the score is high, ask for something a person can do in thirty seconds and a farm cannot do a thousand times: verify the email, add a passkey, confirm on a phone. Unlock the full credits when they pass. Most flagged real users simply verify; most farms simply leave.

5. Keep watching after signup

   Signup is the first look, not the last. Credits burning at machine speed, several accounts acting in lockstep, usage with no sign of a person behind it: these show up in the first hour. Hold the remaining credits rather than clawing back what was used, and tell the customer why.

6. Start in shadow mode

   Run the decisions for a week without enforcing any of them. Compare what would have happened against accounts you know: the paying customers, the ones you banned. Tune the thresholds on your own traffic, then switch on. Nobody should enforce a rule they have not watched run.

7. Fail open

   If the check is slow or down, let the signup through with full credits and mark it as unchecked. Protection that can become an outage will be switched off the first time it does, and then it protects nothing.

Build it or buy it

A first version is a few weeks of engineering: a disposable-domain list, a velocity counter per network, a device hash, and a reduced-credits path in your signup flow. That version catches the crude cases and is worth doing if you have nothing. The part that does not finish is the rest: keeping the network and domain data current, linking accounts well enough to see farms without seeing colleagues, tuning thresholds as the farms adapt, and explaining each decision to the team that has to stand behind it.

That ongoing part is what honeyp.ai does: one API call at signup returns a decision and a credit tier, with plain reasons; it links accounts, keeps watching after signup, starts in shadow mode and fails open. The live demo is a pretend app whose signups go through a real check, if you want to see what the decision looks like before reading the docs.

Questions people ask