SaaS teams celebrate rising signup totals, yet a large share of those new accounts can be fake and cost real money. Roughly one third of freemium accounts now use disposable email domains, and vendor research ties temporary inbox use closely to abusive behavior. MyEmailVerifier cites Clearout research that more than half of SaaS fraud starts with fake signups, and cites IPQS data that finds a near-perfect correlation between temporary email usage and abusive activity. Platforms that invest in layered, risk-based signup controls report lower trial abuse, cleaner analytics, and reduced infrastructure cost.

Blocking every free webmail address will stop many fake signups, but it will also cut legitimate customers who use privacy-relay or alias services.

1. Identify the attack surface

Start by naming the ways fraud gets in. Fake signups show up as Bot-generated accounts, registrations using disposable or temporary email addresses, scripted signups created to scrape or phish, stolen-identity accounts, and profiles made to renew free trials again and again. Multiple industry guides report that roughly one third of freemium accounts now use disposable email domains, a scale that turns raw signup growth into a misleading KPI.

Vendor research ties the problem to concrete signals. MyEmailVerifier cites Clearout research that over half of SaaS fraud begins with fake signups. MyEmailVerifier further reports a large and growing universe of disposable domains, with several new ones added daily. That explains why static blocklists fail: new disposable providers appear constantly, and what blocked a week ago may be bypassed tomorrow.

Worked example: a product team sees a 40 percent signup lift after running an acquisition experiment. If one third of those new accounts are disposable or abusive, server costs rise, support load increases, and conversion and engagement metrics become noisy. The arithmetic is simple. Countless product decisions have been biased by silent ghost users.

2. Stop risky addresses at the point of signup

The easiest durable win is to screen email domains before you create an account. Use a Domain-risk API that classifies domains in real time as disposable, privacy-focused, free webmail, or high risk.

These APIs let you block or flag suspect addresses before they enter your database, trigger additional verification steps, or route registrations to manual review.

RiskMail.io, for example, positions its Disposable Email Detection API to spot temporary inboxes, suspicious domains, and other domain-level risk signals in real time. Domain intelligence is different from syntax checks or mailbox existence checks. A syntax check will catch malformed addresses, and a mailbox-existence probe will tell you if an MX server responds. Domain intelligence finds the classes of domains most commonly used for trial abuse and mass account creation, which is the signal you actually need at signup.

Worked example: call your domain-risk API synchronously during the signup flow. If the API marks a domain as low risk, continue. If it marks a domain as medium risk, require OTP confirmation or a CAPTCHA. And if it marks a domain as high risk, block or route to manual review. That simple triage prevents many throwaway registrations without adding friction for normal users.

3. Choose the right verification gate

There are two distinct checks to consider, and they're complementary. SMTP-level verification probes whether a mailbox likely exists before the account is created. It's fast, cheap, and effective at rejecting gibberish or dead addresses before they hit your user store. One-time-password email confirmation, where the user clicks a verification link, proves the registrant controls the inbox and is recommended before enabling trial access.

BulkEmailChecker frames SMTP checks as complementary to OTP confirmation, and the common vendor recommendation is to do both when your UX budget allows. If you let trials start before email confirmation, you invite abuse: disposable addresses can receive a single verification message, then be discarded or forwarded in a way that prevents meaningful follow-up.

Practical sequence: First, run a domain-risk check and an SMTP probe at signup to reject obvious dead or gibberish addresses. Second, require email OTP confirmation before provisioning trial features. Third, if the domain-risk API flagged the address as medium risk, add a short additional step such as CAPTCHA or card verification before enabling a trial.

4. Apply graduated friction rather than blanket bans

Blocking entire classes of free webmail will eliminate many legitimate users. Services that preserve privacy, such as Apple Hide My Email, and forwarding tools like SimpleLogin are used by real customers who value privacy, yet they can also be abused to create multiple accounts. Guidance differs on how aggressively to treat these addresses. Some vendor tools classify privacy-relay and alias domains as risky and eligible for blocking. Other advice warns that these services are legitimate and recommends soft-fails such as flagging for review or requiring secondary challenges instead of outright blocking.

Mastheads

Implement risk-based responses. Allow low-friction signups for low-risk domains. Require OTP or CAPTCHAs for medium-risk domains. Block or require manual review for high-risk domains. The approach balances conversion with protection. It also gives product teams a way to target controls where they matter most, rather than imposing universal friction that will shrink your funnel.

Worked example: an enterprise prospect uses an alias or forwarding service. Your domain-risk check flags the domain as privacy-focused but not clearly abusive. Instead of rejecting the signup, let the account in but mark it for enhanced onboarding, require company verification later, and exclude the address from marketing blasts until verified. That preserves legitimate enterprise leads while isolating risky flows.

5. Add behavioral and device signals

Email checks reduce mass abuse but won't stop a motivated human creating new free webmail accounts. Combine domain intelligence with Device fingerprinting, IP and proxy detection, account-creation velocity checks, rate limits per IP or device, and honeypots. Score signups in real time from these multiple signals and route users based on the score.

OnSefy and other fraud-prevention vendors recommend this multi-signal scoring approach. Use the score to present lightweight challenges, require additional verification, or refuse registration. Device fingerprints and IP intelligence are especially useful to identify repeat abusers who simply change the email address but reuse the same device or network pattern.

Worked example: if a device fingerprint appears five times creating accounts in an hour, escalate the flow to a manual review or require a credit-card token before issuing a trial. If the IP is a known proxy or the velocity threshold is exceeded, present a CAPTCHA before allowing the flow to proceed.

6. Consider payment-method gating and uniqueness logic carefully

Requiring a card on file or tokenizing a card without charging it's a strong deterrent against trial abuse because it raises the cost of creating throwaway accounts. Several vendor guides list credit-card verification as an effective anti-abuse control, typically implemented without an initial charge. That said, requiring a card imposes UX friction and will reduce conversion among legitimate prospects, so treat it as a conditional step applied to users flagged as higher risk rather than a universal mandate.

Hardening uniqueness logic also helps. Normalize Gmail addresses that use plus addressing so [email protected] and [email protected] map to the same base account. Map known forwarding or alias providers to a canonical identity where appropriate. These normalizations prevent simple tricks that multiply perceived user counts while actually representing one person.

Worked example: during onboarding, normalize common alias patterns and check for existing accounts with the same canonical address. If a match exists and the device or IP resembles previous suspicious activity, require additional verification before granting a new trial.

7. Route for manual review and keep policies adaptive

No automated rule will be perfect. Use tiered controls: automated blocking for high-confidence disposable domains, additional verification for medium-risk signups, and manual review for ambiguous cases that score high on abuse signals. Maintain an updatable allowlist for enterprise or known good domains and a dynamic blocklist refreshed by your email-risk provider.

Vendors that maintain domain risk databases relieve engineering teams from chasing new disposable providers that appear daily. Keep an audit trail so manual reviewers can update rules based on observed false positives and new abuse patterns. That feedback loop is how defenses stay ahead of attackers who constantly shift tactics.

Worked example: a manual reviewer spots a pattern of false positives from a new privacy-forwarding provider. The reviewer updates the allowlist for specific domains while the dynamic blocklist continues to catch clear disposable services. Engineering doesn't need to edit code to react.

8. Protect deliverability and your analytics

Sending onboarding and marketing email to disposable or dead inboxes hurts sender reputation and deliverability to real customers. Quarantine suspect accounts and remove flagged addresses from bulk sends until verification completes. Blocking or filtering fake signups also protects product metrics: fewer ghost users improves trial-to-paid conversion accuracy, engagement metrics, and the quality of cohort analysis used for product decisions.

Worked example: exclude medium- and high-risk addresses from automated marketing journeys and postpone welcome drip campaigns until OTP confirmation. That preserves deliverability and gives your mail streams more predictable engagement rates for future optimization.

9. Monitor, measure, and iterate

Instrument every control and measure its impact on conversion, support load, infrastructure cost, and fraud incidents. Track the ratio of free webmail to corporate email among new signups and whether conversion from those cohorts differs materially. Run experiments before rolling out aggressive blocking; legitimate users will be affected by overly broad rules.

Keep specific telemetry: conversion rates by risk tier, false positive rate of manual reviews, delivery error rates for marketing sends, and the infrastructure cost of ghost accounts. Review those metrics regularly and update thresholds and rules based on observed trade-offs.

Worked example: launch an A-B test where flow A applies OTP confirmation before trials and flow B allows trials before confirmation. Measure trial-to-paid conversion, support tickets, and churn for both flows. Use the results to pick the version that preserves revenue while minimizing abuse.

Operational checklist you can implement now: First, add a domain-risk API at signup to detect disposable and suspicious domains. Second, perform SMTP-level probing before account creation to reject dead or gibberish addresses. Third, require email OTP confirmation before enabling trials. Fourth, layer device, IP, and velocity checks and trigger CAPTCHAs or honeypots for suspicious flows. Fifth, use risk scoring to route users to card verification or manual review only when necessary. Sixth, normalize email aliases for uniqueness checks. Seventh, quarantine flagged accounts from bulk email sends. Eighth, monitor conversion, false positive rates, and deliverability metrics and iterate.

Throughout this sequence, remember the three complementary verbs that protect a signup funnel: detect, verify, and adapt. Detection at the domain level filters the mass of throwaway addresses. Verification at the mailbox level proves control of the inbox. Adaptation via scoring and manual review lets you keep conversion healthy while denying abuse.

Finally, use vendor tools where they reduce maintenance. Domain lists and email-risk databases are a headache to operate in-house given the large and growing disposable domain universe. Outsourced providers free engineering teams to focus on product features rather than chasing new disposable providers that appear daily.

Related Articles

In Short: - Add a domain-risk API at signup to detect disposable, privacy-relay, and suspicious domains. - Probe SMTP and require OTP confirmation before provisioning trials, and add CAPTCHAs or card verification for medium- and high-risk flows. - Layer device fingerprinting, IP/proxy detection, velocity limits, and scoring to route risky signups to manual review. - Quarantine flagged addresses from bulk marketing sends and normalize alias patterns to avoid inflated user counts. - Instrument conversion, false positive rates, deliverability, and infrastructure cost, and iterate on thresholds. Vendors and researchers report a large and growing universe of disposable email domains, so layered, risk-based signup controls are the only practical path to fewer fake signups, lower costs, and cleaner analytics.

This article was created with AI assistance.