How to stop fake signups on your SaaS
Fake accounts waste your resources and distort your metrics. A layered approach works better than any single trick.
Photo by VISHNU_KV on Pixabay
If your sign-up form is open to the internet, sooner or later it will be used by people and scripts that have no interest in your product. They inflate your numbers, burn your credits, abuse free trials and sometimes probe for weaknesses.
What fake signups look like
- Random strings as names and addresses
- Many accounts created from the same IP range in a short window
- Throwaway email domains
- Accounts that never log in, or do exactly one thing and leave
- Bursts of signups at odd hours
Think in layers
No single check stops everyone. Combine cheap layers so that each adds a little friction for abusers and almost none for real people.
1. Verify the email
Check the address when the form is submitted. This catches:
- addresses that don't exist
- dead or mistyped domains
- disposable inboxes (more here)
Use the API and treat invalid and disposable as reasons to reject.
2. Require email confirmation
A confirmation link proves the person controls the inbox. Don't give a trial any real value until it is clicked.
3. Rate-limit by IP and by address
Limit signups per IP per hour, and per email domain if you see abuse. Return a polite message, not an error stack.
4. Add a bot check
An invisible challenge or a simple honeypot field (a hidden input a human never fills in) stops a lot of dumb scripts. Use a challenge service that respects privacy and accessibility.
5. Watch behaviour
Flag accounts that sign up and immediately call your API at high volume, or create many resources fast. Hold them for review instead of letting them run.
6. Limit what a new account can do
Cap trial usage, delay features that cost you money, and require payment details before expensive actions.
Don't punish real users
- Explain rejections ("please use a permanent email address").
- Offer a way out: support contact, or manual approval.
- Remember that some legitimate people use privacy-oriented addresses, so block only where the risk justifies it.
Measure it
Track the share of signups that confirm email, activate and return within a week, before and after each change. If a layer cuts fakes without cutting real activation, keep it. Combine this with protecting your free trial.
