How do you stop fake and spam free trial signups?

To stop fake free trial signups, add controls in order of cost: block disposable email domains, verify the email, rate-limit signups per IP, then add phone verification, and ask for a card only if fakes persist. A card cuts paid visitor-to-trial from 7.1% to 2.2% in First Page Sage’s data, so it belongs last.

Rules of thumb

• The first two rungs cost nothing in licences: the open-source disposable-email-domains blocklist listed 10,100 domains when we counted it on 1 November 2026, and Cloudflare Turnstile’s free plan covers up to 20 widgets with unlimited challenges.
• Rate-limit new accounts per IP per day: Stripe’s own card-testing guidance suggests limiting the number of new customers a single IP address can create in one day.
• Phone verification costs about $58 per 1,000 verified US signups at Twilio’s list price of $0.05 per successful verification plus $0.0083 per SMS (Twilio Verify pricing, read 1 November 2026), before any fraud traffic.
• A card on file removes 69% of paid trial starts but about 9% of paying customers on First Page Sage’s paid-traffic rates (arithmetic in the table below).
• Never put a five-minute call in front of unfiltered signups: at a 40% fake share, 1,000 signups a month waste about 100 SDR hours (worked example below).

What is happening when I’m getting fake free trial signups?

Fake free trial signups come from three sources: scripts filling your form, people using throwaway inboxes to grab free usage, and fraud rings using your form for something else. Each one needs a different rung of the ladder, which is why one blanket fix rarely works.

• Bots and scripts submit the form at machine speed, often from a small range of IP addresses, and never open the product. A bot check and per-IP limits remove most.
• Freeloaders are real people using disposable addresses to repeat the free trial. A domain block and email verification remove most.
• Abuse of your verification steps is the dangerous one. Twilio describes SMS pumping as fraudsters using a phone number input field to trigger one-time passcodes to numbers on a mobile network they profit from, and Stripe says card testers prefer card setup because those checks rarely appear on cardholder statements.

Fake free trial signups: FAQ

How do I know if my free trial signups are fake?

Compare four signals with the previous 30 days: the share of signups that never verify their email, the share from disposable domains, signups per IP address per day, and the share that never take one action in the product. Fakes tend to fail all four at once.

Does requiring a credit card stop fake trial signups?

Requiring a card removes most casual fakes, but it also removes most real trial starts. In First Page Sage’s data from 86 SaaS companies, paid visitor-to-trial falls from 7.1% without a card to 2.2% with one, and a card form becomes a target for card testers, so add it last, not first.

Is phone verification worth it for a SaaS free trial?

Phone verification is worth it when fakes survive email verification and velocity limits, and only with fraud controls switched on. Twilio describes SMS pumping fraud as fraudsters using a phone number input field to trigger one-time passcodes to numbers they profit from, so restrict destination countries and enable fraud blocking before launch.

Should my SDRs call every free trial signup within five minutes?

Only after the cheaper rungs have filtered the list. Calling every signup on a five-minute clock spends the most expensive control on the dirtiest data: in the worked example on this page, 400 fake signups a month cost about $6,000 and 100 hours of SDR time before a single real conversation.

Can I block disposable email domains without losing real users?

Mostly yes, because a buyer who intends to pay has a reason to give a working address. Use a maintained list, such as the open-source disposable-email-domains blocklist (10,100 domains on 1 November 2026), show a plain error asking for a work or personal address, and log every block so you can spot false positives.

Is a wave of fake trial signups as urgent as it feels?

A wave of fake trial signups is urgent only if the fakes trigger real costs: SMS fees, card-testing declines, SDR calls or polluted billing data. A steady trickle of junk in a CRM is an annoyance; a sudden spike is an incident.

Two tests tell you which. Chart signups per hour for 14 days: a step change from a few IP ranges or one country is an attack. Then check whether money is leaving: Twilio says a pumping attack often shows as a spike of messages to a block of adjacent numbers with no completed verification, and Stripe says card testing shows as a spike in failed or blocked payments and 402 errors. If neither is happening, the 7-day plan below is enough.

The Signup Friction Ladder: which control to add first

The Signup Friction Ladder orders six anti-fake controls by what each one costs you in real signups, so you add the cheapest control first and stop climbing once fakes fall below a level you can live with.

Drop-off for rungs 1 to 4 is a labelled assumption: we found no credible public benchmark for real-signup loss from email or phone verification, so use your own before-and-after numbers. Rung 5 is benchmarked: First Page Sage’s free trial benchmarks (86 SaaS companies, 71% B2B and 29% B2C, Q1 2022 to Q3 2025) put paid visitor-to-trial at 7.1% for opt-in trials and 2.2% for opt-out trials that require payment details.

What does requiring a card actually cost in paying customers?

Requiring a card on a SaaS free trial costs about 9% of paying customers from paid traffic and about 21% from organic traffic, on First Page Sage’s rates, even though it cuts trial starts by roughly 70%.

The arithmetic for the paid row: 10,000 x 7.1% = 710 trials, x 17.4% = 123.5 paying; 10,000 x 2.2% = 220 trials, x 51% = 112.2 paying. First Page Sage counts even one paid month as a conversion, so refunds and early churn will shrink the card-required figure, and its opt-in and opt-out rates come from different client companies, not one A/B test, so treat the gap as a benchmark to test against. Add the card rung only when fakes cost more than the customers you would lose. For what a trial costs to buy in the first place, see the cost per trial signup benchmarks, and for the visitors who never start one, how to increase free trial opt-in rate.

The documented failure: speed-to-lead SDRs calling fake signups

Speed-to-lead SDRs calling fake signups is the costliest failure in this problem, because a five-minute call rule spends the most expensive control in the stack on the dirtiest data.

The pattern is easy to fall into in sales-assisted SaaS: a team reads that fast response wins, puts every trial signup on a five-minute call clock, and fake signups go into the dial queue alongside real ones. The model below uses labelled assumptions: 1,000 signups a month, three call attempts per signup at five minutes each (dial, voicemail, CRM note), and a loaded SDR cost per hour that you should replace with your own.

The mid row: $60 per hour divided by 60 = $1 a minute, x 15 minutes = $15 per fake worked, x 400 fakes = $6,000. The hidden cost is larger than the table: every real signup in the mid band now costs $25 of calling ($15 x 1,000 calls / 600 real signups) instead of $15. The fix is not to call slower; it is to put rungs 1 to 3 in front of the dialler, then call only the signups that carry a signal, as set out in when to call SaaS trial signups.

What to do in the next 24 hours

The next 24 hours of a fake-signup incident should go on stopping costs that leave the business, not on cleaning the database, which can wait a week.

1. Pause any automatic dial or SMS that fires on signup.
2. If you send SMS codes, restrict destination countries to the ones you sell into and switch on your provider’s fraud blocking; Twilio documents Verify Fraud Guard and Geo Permissions for exactly this.
3. If a card form is attached, follow Stripe’s checklist: identify the activity, refund fraudulent payments to avoid disputes, and add CAPTCHA and rate limits to the endpoints that save cards.
4. Add a bot check and a disposable-domain block to the signup form.
5. Tag, do not delete, suspect accounts so you can measure the fix.

What to do in the next 7 days, and the fix that stops it recurring

The next 7 days of a fake-signup fix should add email verification and velocity limits, then measure the fake share again before you consider phone or card rungs.

• Days 2 to 3: require email verification before the workspace opens, and limit new accounts per IP address and per device per day.
• Days 4 to 5: let callers work only verified signups with a buying signal; how to qualify SaaS demo requests covers the signals.
• Days 6 to 7: compare the fake share, verified-signup volume and trial-to-paid rate with the week before. Climb to rung 4 only if fakes are still costing money.

The permanent fix is a single rule: no signup reaches a paid channel (SMS, a call, a card check) until it has passed every free rung below it. Doing this yourself is mostly engineering time plus keeping the blocklist and limits tuned. The follow-up after filtering is the part that takes headcount; if you would rather not staff it, LeadsNow’s AI appointment setting calls, texts and messages each new verified lead within permitted calling hours, and speed-to-lead automation explains the timing side. See also SaaS lead generation.

Sources

1. First Page Sage, SaaS Free Trial Conversion Rate Benchmarks (last updated 5 September 2025; 86 SaaS companies, Q1 2022 to Q3 2025)
2. disposable-email-domains blocklist on GitHub (10,100 entries, counted 1 November 2026)
3. Twilio Verify pricing (read 1 November 2026, US prices)
4. Twilio, What is SMS pumping fraud?
5. Stripe, Protect yourself from card testing
6. Cloudflare Turnstile plans