How to Prevent Fake Signups Without Killing Your Conversion Rate

You have two goals that seem to contradict each other: keep your signup flow as frictionless as possible, and keep fake accounts out of your product. Add too many verification steps and your conversion rate drops. Remove them and your database fills with disposable emails, bot accounts, and serial free-tier abusers.

The good news is that this is a false tradeoff. The best fraud prevention is invisible to legitimate users.

The Fake Signup Problem

Fake signups come in three main flavors:

1. Disposable Email Signups

Disposable email services let anyone create a throwaway inbox in seconds. Users sign up with these addresses to access your free tier, download gated content, or abuse trial periods without any intention of becoming a paying customer. These accounts are effectively dead on arrival.

2. Bot Signups

Automated scripts that create accounts at scale. Some bots are harvesting free-tier resources. Others are creating accounts to spam your platform or test stolen credentials. Characterized by data center IP addresses and high velocity from a small number of IPs.

3. Multi-Accounting

Real humans who create multiple accounts to exploit your product: resetting free trials, stacking referral bonuses, or circumventing usage limits.

Why Traditional Approaches Fail

CAPTCHA adds friction to every signup, not just suspicious ones. Sophisticated attackers use solving services that cost $2 per 1,000 solves.

Email verification does nothing against disposable emails. Disposable services receive verification emails just fine.

Phone verification is effective but expensive ($0.01-0.05 per SMS) and excludes users in regions with unreliable SMS delivery.

The Tiered Approach: Security Without Friction

Tier 1: Silent API Checks (Zero Friction)

Every signup passes through server-side validation that the user never sees. This catches 80-90% of fake signups with zero UX impact.

curl -X POST https://api.fidro.io/v1/validate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "user@tempmail.com", "ip": "185.234.72.19"}'

Check for: disposable email domains, invalid MX records, VPN/proxy/Tor connections, data center IPs.

Tier 2: Progressive Challenges (Only for Risky Signups)

When Tier 1 flags a medium-risk signup, add a lightweight verification step. This affects only 5-10% of signups.

• Email verification link (only for elevated risk scores)
• CAPTCHA (only when IP or email triggers a risk signal)
• Delayed access (gate features behind email confirmation)

Tier 3: Hard Blocks

When the signals are unambiguous, block immediately with a polite rejection:

• Known disposable email providers
• Tor exit nodes combined with other risk signals
• Emails that fail DNS validation

Decision Flowchart

User submits signup form
    |
    v
Call Fidro API with email + IP
    |
    v
Email disposable? --> YES --> Block, show "Please use a permanent email"
    |
    NO
    v
Valid MX records? --> NO --> Block, show "This email appears invalid"
    |
    YES
    v
Risk score > 70? --> YES --> Block, log for review
    |
    NO
    v
Risk score 30-70? --> YES --> Allow, require email verification
    |
    NO
    v
Risk score < 30 --> Allow, full access immediately

Code Example: Risk-Based Signup Flow

app.post('/api/signup', async (req, res) => {
  const { email, password, name } = req.body;
  const ip = req.headers['x-forwarded-for'] || req.ip;

  try {
    const riskCheck = await checkSignupRisk(email, ip);

    if (riskCheck.disposable) {
      return res.status(422).json({
        error: 'Please use a permanent email address.',
      });
    }

    if (riskCheck.risk_score > 70) {
      return res.status(422).json({
        error: 'We were unable to process your signup.',
      });
    }

    const user = await createUser({ email, password, name });

    if (riskCheck.risk_score > 30) {
      await sendVerificationEmail(user);
      return res.status(201).json({
        user,
        requiresVerification: true,
      });
    }

    return res.status(201).json({ user, requiresVerification: false });

  } catch (error) {
    // Fail open if API is unreachable
    const user = await createUser({ email, password, name });
    return res.status(201).json({ user, requiresVerification: false });
  }
});

Measuring the Impact

The true cost of fake signups extends far beyond the obvious. Every fake account consumes infrastructure, skews analytics, damages sender reputation, and wastes engineering time.

Getting Started

1. Try the email checker with a disposable email to see how it is flagged
2. Try the IP checker with your own IP to see the risk analysis
3. Review the API documentation
4. The free plan includes 200 requests per month

The goal is not to build an impenetrable wall. It is to make your signup form unrewarding for abusers while keeping it effortless for real users. For more on protecting free tiers specifically, see Free Tier Abuse: How to Protect Your SaaS.