How to prevent fake signups on your platform

Every signup form is an open door. Most of the people walking through it are real users you want, but some aren’t.

They're scripts farming free trials, bots inflating your metrics, spammers seeding abuse, and increasingly, AI agents creating accounts at scale. Fake signups quietly distort your analytics, burn through referral budgets, and pile onto your support and trust-and-safety teams. It's an issue that keeps coming up in communities like r/SaaS:

This guide explains what fake signups are, what they cost, and how to stop them with a layered defense. No single check is enough on its own — the goal is to stack methods so that getting past all of them is expensive and slow for an attacker, while legitimate users barely notice the checks.

What counts as a fake signup

"Fake signup" covers several related problems, and the right defense depends on which one you're facing:

• Promo and referral abuse: One person creates many accounts to claim a signup bonus, referral credit, or discount repeatedly.
• Free trial farming: Users spin up fresh accounts to keep resetting a free trial or free tier instead of paying.
• Bot and spam accounts: Automated scripts register thousands of accounts to post spam, scrape data, test stolen credentials, or seed fake engagement.
• New account fraud: Attackers create multiple fake accounts to exploit system weaknesses, commit payment fraud, or evade bans.
• AI agents at scale: AI tools — agents and assistants — now interact with sites and APIs programmatically, and they can create accounts far faster than a human.

These overlap. A free trial farmer might script their signups; a spam operation might lean on an AI agent to fill out forms and solve challenges. That's why prevention works best as a system rather than a single gate.

Why fake signups cost you more than you think

The damage rarely shows up as a single line item. It spreads across the business:

• Skewed metrics: Fake accounts inflate signup counts, activation rates, and daily active users, so growth and product decisions get made on bad data.
• Wasted spend: Referral bonuses, free trial compute, SMS verification costs, and welcome credits all get drained by accounts that will never convert.
• Direct fraud: Promo abuse and trial farming are revenue leaks; fake accounts are also staging grounds for credential stuffing and other downstream attacks.
• Support and trust-and-safety strain: Spam and fraudulent accounts generate reports, moderation work, and chargebacks that your team has to absorb.

Because the costs are diffuse, fake signups are easy to under-prioritize until the numbers stop making sense.

Fake signup prevention methods and their tradeoffs

There's no silver bullet to prevent fake signups completely. Each method below stops some attacks and misses others. Combining a few gives you depth.

CAPTCHA and challenges

CAPTCHA asks the user to prove they're human. It still filters out low-effort automation, but it's no longer a reliable gate on its own. Sophisticated fraudsters use CAPTCHA-solving services to bypass anti-bot protections, and modern AI tools can work through challenges that used to stop scripts. Just as bots have gotten better, real users are getting more fed up.

For businesses and security teams in 2026, there are other tools that improve upon CAPTCHA and help shift defense from challenge-response friction to intelligent, invisible identification.

>> Check out our guide on CAPTCHA alternatives to learn more.

Email and phone verification

Requiring a verified email or a one-time passcode over SMS raises the cost of each account. It's effective against casual abuse, but determined attackers use disposable email domains and bulk virtual phone numbers to clear the bar. Phone verification in particular adds real cost (SMS fees) and real friction, so it's best applied selectively rather than to every signup.

IP-based rate limiting

Limiting how many accounts can be created from a single IP address in a set time window slows down bulk registration. It's cheap to implement and good against naive scripts. The weakness is that attackers rotate through proxies, residential IP pools, and VPNs to spread requests across many addresses, so IP-based limits alone are easy to sidestep.

IP reputation

Scoring the IP a signup comes from — flagging known data-center ranges, VPN exits, or Tor nodes — adds useful context. But IPs are among the easiest signals to change. Fraudsters avoid detection by using VPNs to change IP addresses, clearing cookies, or tampering with browser settings, which makes any IP-only approach brittle.

Behavioral analysis

Looking at how a user interacts with the form — typing cadence, mouse movement, time-to-complete — can separate humans from automation. However, behavioral analysis needs enough traffic to tune and can misflag real users who rely on autofill, password managers, or assistive tech. Advanced bots also increasingly mimic human-like behavior, so it works best as one input among several.

Single sign-on (SSO)

Letting users register through an established identity provider shifts some verification burden onto that provider and raises the effort to create throwaway accounts. The tradeoff is that you depend on a third party, and attackers can still create or buy provider accounts in bulk.

Manual review

Human review of suspicious signups catches nuanced abuse that many automated rules can miss. It doesn't scale, so reserve it for high-risk or flagged cases rather than the general signup flow.

Why device intelligence stops fake signups

Most of the methods above key off something an attacker can easily change: an email, a phone number, a cookie, an IP. Device intelligence works from a more stable angle — the device and browser behind the signup.

Fingerprint's device intelligence analyzes over 100 device attributes like browser configurations, operating system details, and hardware settings to recognize returning visitors with industry-leading accuracy. It generates a unique visitor identifier for each browser or device accessing your application, and that identifier stays consistent even when someone switches on a VPN, clears cookies, or tampers with browser settings.

That stability is what makes it effective against promo abuse and free trial farming. If you store the visitor identifier alongside each new account, you can check how many times the same identifier has been used to create accounts in a given window — say, the last 30 days — and flag or block the fifth free trial account coming from a device you've already seen. Even when every account uses a different email, phone number, or IP, the identifier remains consistent and catches the repeat.

Catching bots and AI agents specifically

Since AI agents can now create accounts at scale, it helps to detect automation directly. Fingerprint Bot Detection analyzes browser attributes and network signals and returns one of three values: good bot, bad bot, or bot not detected. "Bad bot" covers unrecognized automation, including browser automation tools like Selenium, Puppeteer, and Playwright, or anything impersonating a verified tool or hiding its identity.

Bot Detection also identifies AI tools. When one is detected, it returns details including the tool's category, identity (signed, verified, unknown, or spoofed), provider (e.g., OpenAI), and name (e.g., ChatGPT). For traffic that never runs a browser — AI agents calling your API directly, MCP servers, or backend-to-backend requests — the Automation Intelligence API detects automation from HTTP request metadata alone (headers, method, URL, IP), with no JavaScript agent required.

Identification and Bot Detection produce the best results together, and Smart Signals add more context to the same signup. Proxy detection shows when a signup is routed through a proxy to hide its origin, and browser tampering detection shows when someone has modified their browser to look like a new visitor. You can combine them in your own rules, such as stepping up verification when a new visitor comes through a proxy and shows signs of tampering, while letting known or less suspicious visitors through with no added friction.

How the layers fit together to defend against fake signups

The right layers depend on which kind of fake signup you’re facing:

• Promo abuse and free trial farming: store the visitor ID with each account and flag repeats.
• Bot and spam accounts: run bot detection at the form.
• AI agents: use AI agent detection for browser traffic and the Automation Intelligence API for requests that hit your API directly.
• New account fraud: combine the visitor ID with signals like proxy detection and browser tampering detection.

Email verification and rate limiting still work as cheap first filters, and manual review covers the high-risk cases your automated rules flag.

A practical pattern is to keep the default signup flow frictionless and introduce friction — like an SMS one-time passcode — only when bots or suspicious behavior are detected, so legitimate customers get an uninterrupted experience. One important implementation note: client-side data can be spoofed, so verify signals server-side using the Server API before acting on them.

Where to start

If you're building this today, begin by storing a stable device identifier with every account and watching for repeats — that single change surfaces most promo and trial abuse that email and IP checks miss. Layer bot and automation detection on top to handle bots and AI agents, and keep your heavier verification steps for the signups that actually look suspicious. That way, real users get a frictionless signup while repeat abusers get caught early.