Blog

How to stop free trial abuse without asking for a card

17 October 2026 · 8 min read · SignupVet team

Free trial abuse is when people sign up again and again to get your free trial or free credits without ever paying: with a new email address, a throwaway inbox or a script that creates accounts in bulk. You can stop most of it without asking every user for a credit card.

This guide shows what trial abuse usually looks like, seven steps to stop it, and the mistakes that end up blocking real customers. Most steps take less than an hour to build.

What free trial abuse looks like

• The repeat trial. One person creates a new account every time the trial runs out. Often with the same Gmail address written differently (anna+2@gmail.com, a.nna@gmail.com) or with a throwaway inbox.
• The credit farm. A script creates dozens of accounts in a few minutes to collect free credits, usually from one server or one network and with numbered addresses like user1@, user2@, user3@.
• The quiet freeloader. A handful of accounts that use every free credit on day one and never come back.

The first is annoying. The second is the expensive one, especially for AI products where every free request costs you compute. If you want to put a number on it, the fake signup cost calculator takes about five minutes.

Why a credit card is not the whole answer

Asking for a card at signup is the classic fix, and it works against most abuse. It also stops many honest people who just want to try your product before talking to their team. If your growth depends on a generous free tier, that is a high price.

The better approach for most products: let clean signups in without friction, and add friction only for signups that look risky. That is what the steps below do.

How to stop free trial abuse in 7 steps

1. Normalize email addresses before you check for duplicates

Gmail ignores dots and everything after a +, so anna+2@gmail.com and a.nna@gmail.com reach the same inbox as anna@gmail.com. Compare a normalized version when you check whether an address already had a trial. Keep the address the user typed for sending emails.

function trialKey(email) {
  const [local, domain] = email.trim().toLowerCase().split("@");
  let base = local.split("+")[0];
  if (domain === "gmail.com" || domain === "googlemail.com") base = base.replaceAll(".", "");
  return base + "@" + domain;
}

Many other providers support + tags as well. Removing the tag for all domains is usually fine for a duplicate check.

2. Block throwaway email domains

Temporary inbox services exist to receive one confirmation email and disappear. There is little reason to give them a free trial. Open lists of these domains are maintained on GitHub, for example disposable-email-domains. New services appear all the time, so update the list regularly. You can test single addresses with our free disposable email checker.

3. Unlock free credits only after the email is confirmed

Let people sign up, but hand out the free credits once they click the confirmation link. Accounts with invented addresses never get there, and bulk scripts need a working inbox for every single account.

4. Limit signups per IP address and network

Real users rarely create several accounts from the same connection within a few minutes. Count recent signups per IP and per network (the first three blocks of an IPv4 address) and slow down or review anything above a small number. Keep the limit loose enough for offices and universities, where many real people share one address.

5. Look at where the signup comes from

Signups from cloud servers and datacenters are often automated, because real people browse from home or mobile connections. Tor and known VPN providers hide the real location. None of these prove abuse on their own, but they are good reasons for a closer look. The free IP checker shows what an address reveals.

6. Give borderline signups a smaller trial

Instead of a yes or no, use three outcomes: allow gets the full trial, review gets a smaller one (or the full trial after a phone number or card), block gets nothing. A real person with an odd signal still gets in. An abuser gets so little that it is not worth the effort.

7. Watch for waves

Abuse rarely comes one account at a time. A spike of signups from one network, or a series like max1@, max2@, max3@ within an hour, is a strong sign. Check your signups per hour now and then, or alert on unusual spikes.

Common mistakes

• Blocking every VPN. Many privacy-minded people and companies use one. Review instead of block.
• Blocking email forwarding services like Apple's Hide My Email or DuckDuckGo addresses. They protect real people's privacy. They make repeat trials easier, so a smaller trial is fair, a block is not.
• Silent rejections. If you block someone, say so clearly (for example "Please use a permanent email address"), so a real user can fix it.
• Never checking the results. Look at what you blocked and reviewed every few weeks. If real customers show up there, loosen the rule.

Doing it with one API call

You can build all of this yourself. If you would rather not maintain domain lists, IP ranges and signup counters, SignupVet does it in one request from your signup handler and returns allow, review or block with the reasons:

const res = await fetch("https://www.signupvet.com/score", {
  method: "POST",
  headers: { Authorization: "Bearer " + process.env.API_KEY, "Content-Type": "application/json" },
  body: JSON.stringify({ email, ip: req.ip }),
});
const { recommendation } = await res.json();

// full trial, smaller trial, or none
const credits = recommendation === "allow" ? 100 : recommendation === "review" ? 10 : 0;

What it does not do: it does not remember a person across weeks. The series and velocity checks look at the last hour or minutes, and the phone check at the last 24 hours. For repeat trials months apart, keep the duplicate check from step 1 in your own database; our guide on detecting multiple accounts shows how to store it without raw personal data. The documentation lists every reason code.

Frequently asked questions

Should I require a credit card for a free trial?

It stops a lot of abuse, but it also turns away real people who only want to try your product. A common middle path is to let most signups in without a card and ask for one only when a signup looks risky.

Can I detect the same person creating several accounts?

Partly. Normalizing email addresses catches the easy cases (name+1@, n.a.m.e@). Signups from the same IP or network and numbered address series catch waves. Someone who switches device, network and email provider every time is very hard to spot, so make each new account less valuable as well.

Does a CAPTCHA stop free trial abuse?

A CAPTCHA stops simple scripts. It does not stop a person who signs up by hand again and again, and it adds friction for every real user. Use it as one layer, not as the whole answer.

Will these checks block real users?

Some signals, such as VPNs or email forwarding services, are also used by honest people. That is why they should lead to review or a smaller trial, not to a hard block. Block only on strong signals like throwaway email domains.