A free trial is a bet: you give away a few days of your product and hope the right people stay. Free trial abuse is when the same person, or the same script, takes the bet again and again. A new email, a new account, another 14 days or another batch of free credits. The market calls it multi-accounting or promo abuse; for you it is a cost that grows with every new account and never pays.
How free trial abuse works
- By hand. One person signs up again with a new address when the trial ends. Email aliases (
name+1@) and disposable inboxes make it take seconds. - With a script. A sign-up bot creates accounts in batches, each to collect free credits, API quota or AI tokens, often to resell them.
- With a farm. Anti-detect browsers and residential proxies give each account a fresh fingerprint and IP address, so the accounts look unrelated at first sight.
The first is a nuisance. The second and third are where the money goes, and where a product that gives away compute, storage or model calls loses the most.
What gives multi-accounting away
An abuser can change the email, the IP address and the browser fingerprint. What is hard to change for every account, at once and consistently, is everything else:
- One device, many accounts. The same browser behind several networks, or one session token used from several places.
- One fingerprint, many sessions. An anti-detect browser that reuses a profile shows up on many sessions and many subnets.
- Fresh sessions in a row. Ten new sessions from one subnet and User-Agent in a few minutes is not a household.
- How the form was filled. People move a mouse or touch a screen and type key by key; scripts paste the text and click without moving.
- A browser that contradicts itself. A User-Agent that claims one system while the browser reports another.
No single one of these is proof, and a VPN alone never is. Together, over a window of minutes, they are what a farm looks like.
Check at sign-up, act on the reward
Ask for a decision on your server, before the account is created, with the visitor's IP, User-Agent and the token the browser tag left. Then decide what the account gets, not only whether it exists:
- bot high: refuse the sign-up.
- bot: create the account without the free credits; give them once the email is verified, a card is on file or a phone number checks out.
- unknown, human, human high: the full trial, as usual.
Holding back the reward, instead of blocking the form, keeps the cost of a mistake low: a real prospect with an odd set-up still gets in and only waits for the credits. A script that cannot collect them has no reason to come back.
Close the loop
When an account turns into a paying customer, tell Bot Protection with feedback; when one turns out to be abuse, say so too. A good customer's next visits are trusted; a device tied to abuse is not. And record the class with every new account, so your trial conversion rate is measured on people, not scripts.
Keep it fail-open
The check sits in your sign-up, so it must never take sign-up down. Use a short timeout and let the visitor through on any error: a few extra trials during an outage cost less than a sign-up page that stops working. More in why a bot check must fail open.