Stopping Fake Sign-Ups on Your SaaS with Email Checks
Free trials attract fake accounts. A layered approach using email checks, confirmation and limits that stops most abuse without hurting real users.
Free plans and trials are great for growth and a magnet for abuse: throwaway accounts, repeated trials and bots that fill your database.
What fake sign-ups cost
- Compute, storage and support spent on accounts that never convert
- Misleading activation and conversion metrics
- Bounces that damage your sending reputation
- Abuse of free quotas or promotions
A layered defence
- Check the address at sign-up: block invalid addresses and disposable domains with a real-time email checker.
- Require confirmation: do not let an account act before the email is confirmed.
- Rate limit: limit sign-ups and sensitive actions per IP and per device.
- Watch patterns: many accounts from one subnet, sequential addresses or odd domains.
- Add a challenge only when needed: show a CAPTCHA to suspicious traffic, not everyone.
Be kind to real users
Explain why an address was rejected, offer another way to sign up, and never block for slow third-party responses.
Measure
Track the share of confirmed accounts, activation rate and bounces before and after. Mailbite gives every account 100 free verifications a month so you can pilot this on your own sign-up form.
Know what your fake sign-ups look like
Before you add a defence, look at a sample of 200 recent suspicious accounts. Most fall into a few patterns:
- Disposable domains used for trial abuse.
- Random-looking names (`kfjd83@...`) created in bursts from one source.
- Plus-addressing and Gmail dots used to make many accounts from one mailbox (`[email protected]`).
- Real mailboxes used by bots with automatic confirmation.
Each pattern calls for a different layer, which is why one rule never closes the problem.
Layers that work together
- Email verification at sign-up: syntax, domain, mailbox and disposable checks.
- Normalisation: treat `[email protected]` and `[email protected]` as one mailbox if you want one trial per person.
- Rate limits per IP and per device on the sign-up and the confirmation endpoint.
- Confirmation links that expire, with no benefit before confirmation.
- Behavioural checks: many accounts from one IP, accounts that consume credits within seconds.
Support real users
Show clear errors, allow a retry and give a way to contact support. A false positive costs you a customer; a false negative costs you a trial. Review blocked attempts regularly.
How to measure it
Track the share of new accounts that confirm, log in a second time and use the product. Compare before and after each change. Add the email checker or the API to your form and clean older accounts with the bulk verifier.
