SaaS Signup Fraud: 5 Signals to Score Before Granting a Trial

Every free trial you provision without evaluation is a bet that the signup is legitimate. For most SaaS products, that bet is wrong 5–15% of the time. Signup fraud — fake accounts, multi-accounting, and automated registration — inflates your infrastructure bill, corrupts conversion metrics, and wastes support time on users who will never pay.

The fix is signup risk scoring: evaluating multiple fraud signals at registration and returning a decision before you create the workspace, issue API keys, or start a compute job. Stripe, SEON, and other fraud platforms call this identity risk scoring or email risk assessment. For SaaS teams, the goal is simpler — score the signup, then allow, block, challenge, or limit.

This guide covers the five highest-signal fraud indicators to check before granting a trial, how to weight them, and when to act.

What is signup risk scoring?

Signup risk scoring is the process of evaluating fraud signals at account registration and producing a risk score or structured decision. Unlike post-signup fraud detection (which analyzes transaction patterns), signup scoring happens synchronously at the point of registration — typically in under 50 milliseconds.

A signup risk score aggregates signals like:

• Email reputation and domain age
• Device and browser fingerprint
• IP address velocity and ASN classification
• OAuth provider metadata
• Behavioral timing and automation indicators

The output is not just a number — production systems return actionable decisions: ALLOW, BLOCK, CHALLENGE, or LIMIT. AntiTrial uses this four-decision model so your application code has clear enforcement paths.

Signal 1: Email reputation

Email is the highest-volume signal at signup and the fastest to evaluate.

What to check:

• Is the domain on a disposable or temporary email list?
• Was the domain registered in the last 30 days?
• Does the domain have valid MX records?
• Is it a catch-all domain accepting any local part?
• Has this exact email been seen across multiple accounts in your system?

Scoring guidance:

Do not block all free email providers. Block disposables and flag velocity on aliases.

Signal 2: Device and browser fingerprint

Multi-accounting — one person creating many accounts — is the core trial abuse pattern. Device fingerprinting detects when multiple signups originate from the same physical machine, even if email and IP differ.

What to check:

• Browser fingerprint hash (canvas, WebGL, fonts, screen resolution)
• Device ID from Web SDK or mobile SDK
• Cookie and local storage identifiers
• Whether this fingerprint is linked to blocked or churned accounts

Scoring guidance:

Privacy browsers and VPN users can trigger false positives. Use device signals as one layer, not the sole gate.

Signal 3: IP velocity and ASN classification

Signup velocity from a single IP or network range is a strong indicator of automated registration.

What to check:

• Signups per IP in the last hour and 24 hours
• Whether the IP belongs to a datacenter, VPN, or residential ASN
• Geographic consistency (IP country vs. claimed timezone vs. email TLD)
• Whether the IP range has prior abuse history in your system

Scoring guidance:

Shared office and university IPs cause false positives. Pair IP velocity with email and device signals rather than blocking on IP alone.

Signal 4: OAuth identity metadata

Social login (Google, GitHub, Microsoft) is convenient for users and abusers alike. Basic OAuth verification confirms the token is valid — but says nothing about whether the identity is legitimate.

What to check:

• OAuth account creation date (brand-new Google account = higher risk)
• Whether the OAuth subject ID has been used for prior signups in your system
• Provider-specific signals (GitHub account age, commit history, profile completeness)
• Email associated with the OAuth token — still run email reputation checks

Scoring guidance:

OAuth identity laundering — creating a fresh Google account to pass social login — is increasingly common. Account age is one of the strongest OAuth signals.

Signal 5: Behavioral and automation indicators

How the signup form was completed reveals automation that other signals miss.

What to check:

• Time from page load to form submission (sub-second = bot)
• Mouse movement and keystroke patterns (headless browsers lack these)
• Whether JavaScript challenges executed successfully
• Honeypot field completion
• User agent string anomalies (headless Chrome, automation frameworks)

Scoring guidance:

Behavioral signals are noisy in isolation. Combine with email and device data for reliable decisions.

How to combine signals into a decision

Individual signals are ambiguous. Production signup risk scoring uses weighted combinations:

High confidence BLOCK:   disposable email + datacenter IP + known device cluster
Medium CHALLENGE:        clean email + VPN IP + new OAuth account
Low risk ALLOW:          corporate email + residential IP + unique device
Soft LIMIT:              free email + shared fingerprint + no prior abuse history

Start in observe mode: log decisions without enforcing, review weekly, tune thresholds with your growth team, then switch to live enforcement.

When to use signup risk scoring

Signup risk scoring is most valuable when your product grants meaningful resources at trial — API quotas, compute credits, team seats, or data exports.

Ship scoring before your next signup spike

The five signals above — email reputation, device fingerprint, IP velocity, OAuth metadata, and behavioral timing — cover the majority of SaaS signup fraud. Implementing them individually is possible but slow; integrating a signup risk platform gets you to production enforcement in an afternoon.

AntiTrial scores all five signal categories in a single evaluate call, returning ALLOW, BLOCK, CHALLENGE, or LIMIT in under 50 milliseconds.

Create a free account — 5,000 evaluations per month, observe mode included.

Read the five-minute React quickstart — wire signup risk scoring into your registration flow.