How to prevent free trial abuse in SaaS (when rate limits are not enough)

Free trial abuse is simple: someone (or something) creates many accounts, burns the free grant, and never converts. On AI products this is often trial farming by scripts or agents. Rate limits, CAPTCHA, and email checks still matter, but they reset when the farm mints a new identity.

If you are trying to prevent free trial abuse in SaaS, or stop users farming free credits, this is the stack that usually works, and where each piece fails.

What fails alone

Control	What it catches	What slips through
Rate limits	One noisy IP or key	Farms rotate identities under every threshold
CAPTCHA / Turnstile	Casual bots	Solver farms and agent-driven browsers
Email verify	Dead addresses	Fresh aliases and domains that receive mail
IP / ASN lists	Known bad ranges	Residential proxies
Card on file for everyone	Casual duplicates	Kills conversion; prepaid cards still exist

None of these notice that account 4,001 behaves like the 4,000 before it. None of them learn when an account later burns credits and never returns.

What works better: price the grant

Treat signup (or API key issuance, or the free credit grant) as a decision with a cost, not a password gate.

1. Decide before the grant
   
   Return allow, challenge, or deny on the consequential action. On timeout or uncertainty, fail to challenge (or deny). Never silently allow.

2. Make the middle expensive for farms
   
   Challenge with something cheap for one real user (short proof-of-work, step-up) and expensive when multiplied across thousands of signups.

3. Close the loop
   
   Persist an eventId on the account. When you later see conversion, chargeback, or credit burn, send that outcome back. The next similar signup gets a sharper boundary.

4. Keep volume caps for accidents
   
   Rate limits still bound runaway scripts. They are not a substitute for judging whether this signup deserves the free tier.

That is rate limiting vs fraud prevention at signup in practice: volume caps for mistakes, per-action trust decisions for farms.

A concrete order of operations

At signup / first grant:

1. Optional bot/device signal you already run (Turnstile, fingerprint).
2. Trust decision: allow / challenge / deny before credits move.
3. If challenged, clear friction, then grant.
4. Persist the decision id on the account row.
5. Later: feedback on burn, conversion, or abuse confirmation.
6. Optional: progressive unlock (small starter grant, rest after scarce signals) if you also use payment or phone verify.

Progressive trust and card holds are good complements. They are not the same as joining business outcomes to the original decision.

Where to go deeper

Longer write-up on the pattern:

How to prevent free trial abuse in SaaS

Rate limits vs verification:

Rate limiting vs fraud prevention at signup

Allow / challenge / deny API shape:

Allow, challenge, or deny API for signup

Cost calculator for free-tier burn:

Protect your SaaS free tier from credit farming

Side-by-side with CAPTCHA, fingerprinting, Stripe Radar:

Compare

I work on Chitmark, which implements that verify → feedback → challenge loop. The links above are the public explainers; use them even if you build the decision layer yourself.