Free trial abuse: how to detect it and stop it without losing real users

Throwaway inboxes

Disposable email services hand out a working inbox in seconds, long enough to confirm an account. Check the domain against our disposable email domains list, or test a single address in the disposable email checker.

A new real account for every trial

Some people create a fresh Outlook or Gmail account each time. No email rule can link jane.trial.may@outlook.com to jane.trial.june@outlook.com. This is where you need signals outside the address: the IP and network, the device, or the payment card.

VPNs, cloud servers and scripts

A VPN gives each trial a new IP; a script on a cloud server creates dozens of accounts an hour. Both leave traces: a hosting or VPN network, a browser time zone that does not match the IP, and signups faster than humans type. Our guide to detecting fake signups has code for each of these checks.

How to detect free trial abuse on a website

1. Enforce one trial per inbox, not per string

Keep the address exactly as typed for login and email, and store a normalized matching key next to it. Lowercase it, fold googlemail.com into gmail.com, drop the +tag, and remove dots on consumer Gmail only (on Google Workspace domains, dots matter). Then put the unique index on the key:

-- Keep the address as typed; enforce "one trial per inbox" on the key.
ALTER TABLE users ADD COLUMN email_key text;
CREATE UNIQUE INDEX users_email_key ON users (email_key);

// On signup (aliasKey: lowercase, googlemail.com -> gmail.com,
// drop the +tag, drop dots on gmail.com only)
const key = aliasKey(email);
const existing = await db.users.findOne({ email_key: key });
if (existing) return res.status(409).json({ message: 'You already have an account. Sign in instead?' });

The full aliasKey() function is on the Gmail alias checker page. To find the alias clusters already in your database, run a user export through the free email list audit.

2. Block throwaway and dead domains

A set lookup against a disposable-domain list, plus a DNS check that the domain has a mail server. Throw in a typo check while you are there, so jane@gmial.com gets a one-click fix instead of a dead account (try the email typo checker).

3. Watch the network and the pace

Look up the signup IP's network (ASN) and flag hosting providers, VPNs and Tor. Count signups per IP per hour and act on bursts. Neither proves abuse on its own, but together with a repeat inbox they make a strong case.

4. Use the card, if you collect one

If your trial asks for a card, the processor can tell you when the same card number comes back. Stripe, for example, returns a fingerprint on each card payment method that uniquely identifies the card number; for Apple Pay and Google Pay it may reflect the tokenized number instead (Stripe docs):

// After the customer adds a card for the trial (Stripe)
const pm = await stripe.paymentMethods.retrieve(paymentMethodId);
const seen = await db.trials.findOne({ card_fingerprint: pm.card.fingerprint });
if (seen) {
  // Same card number already used for a trial: start a paid plan, not a trial.
}

What to do when you catch it: friction vs blocking

A repeat signup is a risk signal, not proof. The same inbox signs up twice for honest reasons: an agency opening a workspace for a client, a founder who forgot last year's trial, a couple sharing one address. Match the response to the confidence:

Soft friction is often enough. A message such as "You already have an account. Sign in instead?" nudges casual repeaters to sign in, and people with a real reason click through. You can also limit what a trial unlocks until the email is confirmed, so an abuser gets less for each new account.

The card-on-trial trade-off

• For: stops casual abuse, catches card reuse, and filters for people ready to pay.
• Against: fewer people start a trial, the signup has more steps, and prepaid or virtual cards still get through.

For most indie SaaS products, start with a no-card trial plus email and network checks. Add a card later if abuse still costs real money.

Best tools to detect free trial abuse

There is no single best tool, only categories that catch different tactics. We describe categories rather than quote other vendors' prices, which change.

The auth-provider row refers to Clerk's documented restrictions; for a closer look at one verification API, read Vetto vs Kickbox. A sensible setup: a lightweight gate on the form first, and a fraud platform or card checks only if abuse at scale justifies the cost.

Vetto: the lightweight option for indie SaaS

Vetto is a free trial abuse prevention layer you add with one script tag. It normalizes every address the same way as the alias checker above, remembers inboxes for 90 days as salted hashes (never plain emails), and warns when the same inbox comes back. It also blocks throwaway and dead domains, rescues typos, and on Pro flags datacenter and VPN networks and blocks signup bursts.

• Free: 1 site, 1,000 checks a month. Alias, datacenter and burst signals run in shadow mode, so you see how many repeat trials you get before you pay.
• Pro: $12/month or $99/year. Repeat warnings on, custom actions per signal, Slack and Discord alerts, and a server-side API: a signed token checked with POST /v1/verify, or POST /v1/check with your secret key for signups that never touch a browser.
• Founding Lifetime: $69 once for the first 100 buyers, until November 27, 2026. See pricing.

If Vetto does not answer within 800 ms, the form submits as if it were not installed. It does not do device fingerprinting or payment fraud; it handles the cheap, common tricks.