How to Prevent Free Trial Abuse (Bootstrapped SaaS Guide)

Short answer: Measure what one trial account costs you, put a hard usage cap on every trial, then add free filters (email verification, a disposable email blocklist, Cloudflare Turnstile). Only if abuse still costs more than the fix do you pay for card checks, phone verification or device fingerprinting.

Every price and quote below comes from the vendor's own page, checked on 9 Nov 2026. The advice and the worked example are ours and are labelled as such.

TL;DR#

• Measure first. Work out your cost per trial account (compute, tokens, SMS, support). That number decides how much friction is justified.
• Cap the blast radius. Stripe's own guide says "Credit pools, API calls, and storage quotas should be enforced at the account level with hard caps" (Stripe).
• Free layer: email verification, the disposable-email-domains blocklist (CC0), Cloudflare Turnstile (Free plan, up to 20 widgets).
• Card layer: card-required trials plus Stripe's card fingerprint to catch the same card on many accounts (Stripe API docs).
• Paid layer: Twilio Verify at $0.05 per successful verification plus channel fees; Fingerprint Pro Plus at $99/month for 20K API calls.

Disclosure: ZeroRaised is a launch site for bootstrapped products. We have no commercial relationship with Stripe, Cloudflare, Twilio, Fingerprint, ZeroBounce or any other vendor named here and earn nothing if you use them. Facts come from the linked sources as checked on 9 Nov 2026.

What free trial abuse looks like#

Stripe defines it as "any deliberate behavior designed to extend access beyond a trial's intended limits" (Stripe: Free trial abuse). For a bootstrapped product it usually shows up in four shapes:

1. Account cycling. The same person signs up again when the trial ends, with a new email each time. Cheap for them, invisible to you unless you link accounts.
2. Disposable emails. Stripe puts it plainly: "Disposable email services generate unlimited addresses with no verification required."
3. Bots and scripted signups. Someone automates signup to farm free credits, often from an AI product where those credits map straight to model calls.
4. Throwaway cards and card testing. On card-required trials, Stripe notes that "Abusers use prepaid cards, virtual card numbers, or cards with balances too low to authorize a charge." Fraudsters may also use your signup flow to test stolen cards, which leads to disputes later. We cover that side in how to prevent chargebacks for SaaS, so we will not repeat it here.

Our read: for a SaaS with cheap hosting, a few repeat triallers are a nuisance. For an AI app where every trial can run up a token bill, abuse is a cost line that grows with your marketing.

Step 1: measure cost per trial account#

Before adding friction, pull the last 30 to 60 days of trial accounts and work out:

• Variable cost per trial account: tokens, compute, storage, email or SMS, third-party API calls.
• Share of suspicious accounts: shared IP ranges, devices or card fingerprints, disposable domains, or accounts that hit the cap within hours and never return.
• Conversion of clean vs suspicious trials. If suspicious accounts never convert, removing them is pure saving.

If abuse is constant, a capped free plan might suit you better than a trial; see our freemium vs free trial guide for solo founders.

The controls, cheapest first#

1. Hard usage caps on trial accounts (free)#

This matters most, because it limits what any account can cost you however it got in. Give trials a fixed allowance (credits, requests, generations) enforced on the server per account, plus per-minute rate limits so a script cannot burn it in seconds. For sizing caps and metering tokens, see how to set usage limits for an AI product.

2. Email verification and a disposable domain blocklist (free)#

Require a verified email before anything expensive unlocks, then reject or flag throwaway domains. The disposable-email-domains repository on GitHub describes itself as "a list of disposable and temporary email address domains often used to register dummy users in order to spam or abuse some services". It is licensed CC0, so you can use it commercially without asking, and it ships example code in many languages.

The README warns "We cannot guarantee all of these can still be considered disposable", so treat a hit as a strong signal, not proof.

Normalise addresses before checking duplicates (lowercase, plus-addressing, Gmail dots). Our read: flag rather than reject plus-addresses; plenty of honest developers use them.

For a paid email check on top, ZeroBounce offers 100 free validations per month on its Freemium plan (it says a business or premium email domain is required to sign up), and its pay-as-you-go option "starts at $39 USD for validating 2,000 email addresses". That is about two cents an email by our arithmetic.

3. Bot protection on the signup form (free)#

Cloudflare Turnstile is a CAPTCHA alternative. Its plans page lists the Free plan's price as "Free", with "Up to 20 widgets", "10 hostnames per widget" and unlimited challenges. Enterprise (contact sales) adds unlimited widgets, ephemeral IDs and removal of Cloudflare branding. For one signup form, the free plan is plenty.

It stops scripted signups, not a human making a fifth account by hand.

4. Social sign-in as friction (free)#

Making Google or GitHub sign-in the default raises the cost of cycling, because each new account needs another real-looking identity at that provider. Our read: keep email signup, but give it a tighter cap.

5. Card-required trials and Stripe card fingerprints (payment fees only)#

Asking for a card up front filters out most casual abuse. If you use Stripe, every card object has a fingerprint field that, in Stripe's words, "Uniquely identifies this particular card number. You can use this attribute to check whether two customers who've signed up with you are using the same card number, for example" (Stripe API docs). Store it at signup and refuse a second trial on the same fingerprint. Stripe notes that for Apple Pay and Google Pay the tokenized number may be used instead, so wallet payments can slip past this check.

On fraud screening, Stripe's Radar pricing page says Radar Lite gives "AI-based fraud prevention for card payments and card testing, plus fraud alerts included at no additional charge for businesses on standard payments pricing". Paid tiers list Radar Standard "Starting at $10 per month", Radar Plus "Starting at $14 per month" and Radar Pro "Starting at $20 per month", with pay-as-you-go options. Stripe describes Radar Pro as built to "Defend against multi-account, free trial, bot abuse" (Stripe Radar pricing). Check the live per-transaction figures on that page before choosing; we could not confirm them in text today.

Our read: a card requirement lowers signups, so use it when trials cost real money and skip it when they are nearly free to serve.

6. Phone verification (about six cents per US check)#

Stripe's guide says "Phone number verification is an effective deterrent" (Stripe), because phone numbers are harder to mint than emails. Twilio Verify charges "$0.05 per successful verification plus standard channel fees". For SMS in the US that is $0.05 plus $0.0083 per SMS, and Twilio notes SMS "Message attempts are always charged and not subject to delivery". The base fee includes SMS pumping protection via Verify Fraud Guard.

Our read: trigger it only when something looks off (repeat device, data-centre IP), not for every signup.

7. Device fingerprinting ($0 to $99+ per month)#

Fingerprinting links new accounts to devices you have seen before, which is the most direct answer to account cycling.

• FingerprintJS (open source): MIT-licensed and free, but its own README warns "the accuracy is significantly lower than in the commercial version" and that it is "vulnerable to spoofing and reverse engineering" (GitHub). Use it as a soft signal.
• Fingerprint (commercial): a Free plan "up to 1,000 API calls per month", and Pro Plus at "$99 /month for 20K API calls, then $4 per 1,000 additional API calls" (Fingerprint pricing).

Call it once per signup and the free tier covers a small product.

8. Progressive feature gating (free)#

Unlock the costly parts (bulk generation, long-context runs, exports) only after verification, a card, or a few days of normal use. Abusers want the expensive bit fast; honest users mostly want to see the product work.

Controls compared#

Worked example: an AI app with $0.40 of compute per trial#

This is an illustrative example with our own numbers, not data from a real product.

Say your AI writing app gets 1,000 trial signups a month. Each trial account, if fully used, costs $0.40 in model calls, and you estimate 30% of signups are abusive (repeat triallers and bots) and always max out their allowance.

• Abusive accounts: 1,000 x 30% = 300.
• Monthly cost of abuse: 300 x $0.40 = $120.

Now layer controls:

1. Free layer (Turnstile, verified email, disposable blocklist). Suppose it removes half the abusive signups. Abuse cost drops to 150 x $0.40 = $60, for $0 in fees.
2. Fingerprint free plan to flag repeat devices for a lower cap. 1,000 signups fits within 1,000 free API calls, so still $0.
3. Phone verification for everyone would cost up to 1,000 x ($0.05 + $0.0083) = $58.30 a month if every signup completes a US SMS check. That is roughly the same as the remaining $60 of abuse, so it does not pay for itself here. Triggering it only for the flagged accounts does.

Change one number and the answer flips. At $4 of GPU time per trial, the same 300 accounts cost $1,200 a month, and a card requirement, phone checks and Fingerprint Pro Plus at $99 all pay for themselves.

Mistakes to avoid#

• Blocking every VPN. Plenty of honest users, especially developers and people on work networks, use VPNs. Treat IP reputation as a signal that tightens caps or triggers verification, not a hard block.
• Making the trial worse for everyone. Five verification steps to stop a few abusers cost more conversions than the abuse costs money.
• Client-side limits. A script ignores a cap that lives in the browser. Enforce it on the server.
• Treating one signal as proof. A shared IP might be an office. Combine signals and route borderline cases to a lower cap, not a ban.
• No cost alerts. Set spend alerts with your model provider so a new abuse pattern shows up in hours, not on next month's invoice.

A 7-day implementation plan#

This is our plan for a solo founder with a live product.

• Day 1: Measure cost per trial account and the suspicious share.
• Day 2: Enforce server-side trial caps, rate limits and usage alerts.
• Day 3: Email verification, the disposable domain list and normalisation.
• Day 4: Turnstile on signup; social sign-in as the default.
• Day 5: Add a device signal (FingerprintJS OSS or Fingerprint's free plan) and store it with IP and email.
• Day 6: If trials are expensive, require a card and block repeat card fingerprints, or add Twilio Verify for flagged signups.
• Day 7: Compare signups, abusive share and conversion with Day 1. Loosen anything that cost more honest signups than it saved.

Frequently asked questions#

What is free trial abuse?#

Stripe defines it as "any deliberate behavior designed to extend access beyond a trial's intended limits". In practice it means one person cycling through new accounts, disposable emails or throwaway cards to keep getting free access, or bots signing up in bulk to consume free usage.

What is the cheapest way to prevent free trial abuse?#

Hard usage caps on trial accounts, email verification, a disposable email domain blocklist and Cloudflare Turnstile on the signup form. All four cost nothing in fees: the disposable-email-domains list is CC0 and Turnstile's Free plan lists its price as Free.

Should I require a credit card for a free trial?#

If each trial costs you real money (LLM tokens, GPU time, SMS), a card requirement is one of the strongest filters, and Stripe's card fingerprint lets you spot the same card on multiple accounts. It also lowers trial signups, so for cheap-to-serve products a no-card trial with caps is often fine. Stripe notes abusers also use prepaid and virtual cards, so a card is a filter, not a guarantee.

Is phone verification worth it for a SaaS trial?#

Only if a trial account costs more than a verification. Twilio Verify charges $0.05 per successful verification plus $0.0083 per SMS in the US, so roughly six cents for a US SMS check. That is worth it when a trial burns dollars of compute, and overkill when it burns a fraction of a cent.

Is the open-source FingerprintJS good enough to stop trial abuse?#

It is a useful free signal, not a gate. Its README says it is MIT-licensed but that "the accuracy is significantly lower than in the commercial version" and that it is "vulnerable to spoofing and reverse engineering". Use it to flag accounts for review or tighter caps, not to block on its own.

Launch with a trial you can afford#

Once your trial is protected, put it in front of real users. ZeroRaised is a launch directory for products built without institutional VC: submit your product for free. For more practical guides on running a product without investors, join the ZeroRaised newsletter.

Sources#

• Stripe: Free trial abuse: Patterns, signals, and prevention tactics for SaaS platforms, last checked 9 Nov 2026
• Stripe Radar pricing, last checked 9 Nov 2026
• Stripe API reference: the Card object, last checked 9 Nov 2026
• disposable-email-domains on GitHub, last checked 9 Nov 2026
• Cloudflare Turnstile plans, last checked 9 Nov 2026
• Twilio Verify pricing, last checked 9 Nov 2026
• Fingerprint pricing, last checked 9 Nov 2026
• FingerprintJS on GitHub, last checked 9 Nov 2026
• ZeroBounce email validation pricing, last checked 9 Nov 2026