Preventing Automated Signups and Free-Tier Abuse in AI Apps
Automated signups and free-tier farming poison your user data and your inference bill at the same time. Six layers of defence, from credential reputation and device fingerprints to tiered quotas.
The economics: why AI apps are the better target
Free tiers are the most effective growth lever an AI product has, and the easiest hole to arbitrage. The difference is unit cost: for a conventional SaaS, one extra fake account is one extra database row. For an AI app, one extra fake account means inference that actually runs — GPU time, tokens, storage and egress, all of it hard spend.
So the goal of signup defence is not “eliminate every fake account” (impossible). It is pushing the attacker’s payout below what they spend on phone numbers and account farming. That single criterion settles every trade-off below: verification only needs to be strong enough to make automation unprofitable at scale. Do not chase zero false positives.
Four signup entry points and what they leak
| Entry point | Typical abuse | Observable signal |
|---|---|---|
| Email signup | Disposable mail, alias farming, domain rotation | New domains cluster; local parts look like random strings |
| Phone signup | SMS-receive platforms, virtual ranges | Ranges cluster; one number requests codes repeatedly |
| OAuth signup | Bought or stolen third-party accounts | Very new accounts, empty profiles, repeated avatars |
| Referral API | Scripts farming invite codes | Star-shaped invite graphs; invitees never act |
Defend all four, but in this order: judge credential quality first, then study behaviour. The credential itself is not trustworthy; only its history and its device are.
Six layers of control
1. Email and phone reputation. Feed disposable-mail lists and virtual-number ranges into a scoring step; down-rank or add friction for them. This stops most low-cost scripts with zero impact on real users.
2. Device fingerprinting and de-duplication. Cap signups per device fingerprint inside a short window. Cloudflare Bot Management returns a Bot Score (1–99 automation confidence) before traffic reaches your origin, together with signals such as TLS fingerprint, request-sequence regularity and browser environment integrity. Combining Bot Score with your own fingerprint beats any single signal.
3. Invisible challenges instead of CAPTCHAs. CAPTCHAs depress conversion and are already solved by commercial solving farms. Use Turnstile: it validates in the background, most legitimate users pass with no interaction, and only suspicious requests escalate to a click. Place it on both signup and quota-claiming, not just signup.
4. Post-signup behaviour grading. Signup is only the door; the real evidence comes after: profile completion, request cadence, whether the account only calls generation endpoints and never reads results. Put new accounts into an observation period and unlock capability gradually.
5. Tiered free credit. Never hand out the full amount at once. Release a tiny call budget first, then raise the ceiling as the account verifies email or phone, accumulates normal behaviour, or binds a payment method. Even fake accounts then stay locked into negligible arbitrage.
6. Cost-side alerting. Track inference cost per newly registered account. In a healthy product that number is flat; under a farming attack it rises before signup volume looks abnormal.
How to give away credits safely
| Credit type | Recommended practice | Why |
|---|---|---|
| First-time grant | Small, gated behind email/phone verification | Unverified credit is an open withdrawal |
| Daily refresh | Limit by account + device + IP together | Single-dimension limits are trivially bypassed |
| Referral reward | Settle after the invitee shows real usage | Prevents farming invite graphs for cash-out |
| High-cost tasks | Separate limits, or queue them / downgrade the model | Video and high-resolution tasks cost far more per call |
Caveats and where this does not apply
- Enterprise trial requests do not suit aggressive invisible challenges: low volume, corporate domains and human review work better, and automated blocking risks real pipeline.
- Referral-driven growth campaigns should enforce controls at reward settlement rather than at signup, or you damage growth and experience simultaneously.
- Fingerprinting touches privacy: device and behaviour collection must be disclosed in your privacy notice and assessed against local compliance requirements.
FAQ
Should we block every virtual number range outright? No. Virtual ranges include real users (expats, privacy numbers). Down-rank them and request extra verification instead of refusing registration.
Can Turnstile be bypassed? Any client-side check can, including CAPTCHAs. Its value is raising the engineering cost of automation by orders of magnitude, not being unbypassable — so it must be layered with quotas and behaviour analysis.
We already have a batch of fake accounts. Now what? Clean by absence of behaviour: accounts that never produced valid calls after signup, or that only claimed credit and never used it. Reclaim their quota, stop their calls, then add the entry-side checks.
What should the rate limit be? Derive it from unit economics: free-credit budget per account ÷ cost per call = maximum calls, then spread that ceiling across time. A threshold without unit margin behind it is meaningless.