How to prevent free trial abuse: one device, one free trial
Updated
To prevent free trial abuse, check eligibility on your server before granting the trial: allow one trial per device and per normalised email, cap claims per network, refuse disposable email domains, and require a human check for a device's first claim. Ask for a human check instead of denying when the evidence is weak, so real users can still get in.
What free trial abuse looks like
The same person creates a new account every time the trial ends. They use plus-addressing ([email protected]), Gmail dots, disposable inboxes, private windows, a second browser or a VPN. Each new account costs you the trial's compute, support and payment-processing risk, and it hides your real conversion rate.
Checks that stop it
No single check is enough. Layer them and decide on the server, where the client cannot skip a step.
- One claim per device: a server-verified device ID that survives private windows and cleared cookies.
- One claim per email after normalisation: fold +tags on every domain and dots on Gmail.
- Block disposable email domains and optionally cap claims per email domain.
- Per-network limits: one claim per network per year by default, counted per IPv6 /64 or exact IPv4.
- Hourly limits per IP, subnet and ASN, and a stricter path for datacenter networks.
- A human check (Cloudflare Turnstile or proof-of-work) on a device's first claim.
Where to put the check
Run the check in your sign-up or trial-start endpoint, after the user submits the form and before you start the trial or credit the account. The browser collects signals and sends a sealed attestation with the form; your backend forwards it with the email to the eligibility API and acts on the answer.
The API answers allow, turnstile, pow or deny. Grant the trial only on allow. On turnstile or pow, show that human check and call again with its token. On deny, offer a paid plan instead of an error page.
Keeping legitimate users unaffected
Households and offices share a network, and identical phone models share most signals. Treat these as reasons to ask for a human check rather than to deny. Make retries idempotent so a user who double-clicks is not counted twice, and give a claim back when you refund, so a genuine user can come back later.
Free trial abuse prevention with FingerPrint Checker
FingerPrint Checker answers "may this user claim a free trial?" in one API call that applies every check above and returns allow, a human check (turnstile or pow) or deny. The same call covers coupons and sign-up bonuses as separate claim kinds with their own limits. New accounts get 2,000 free checks; after that, prepaid packs start at $19 for 10,000 checks.
Frequently asked questions
Is asking for a credit card enough to stop trial abuse?
It reduces it but costs conversions, and prepaid or virtual cards are cheap to get. A device and email check stops repeat trials without asking honest users for a card up front.
Will a VPN get around a device check?
A VPN changes the IP address, not the device. The device ID still matches, and datacenter VPN exits get a stricter path, such as a mandatory human check.
What happens when a real user is flagged?
Weak evidence produces a human check, not a deny: the user completes Turnstile or a short proof-of-work and continues. Deny comes from hard limits: a device or email that already claimed, a disposable email domain, or a network or rate limit that has been reached.
Try FingerPrint Checker free
Every new account gets 2,000 free checks. No card required to start.
Create a free account