What is free trial abuse? Define the entitlement first

Free trial abuse is repeated or otherwise ineligible use of an introductory benefit under a product's stated rules. The benefit might be time, API requests, storage or AI credits. To investigate it, connect the requested grant to earlier entitlements and relevant account evidence. A second account alone does not settle eligibility.

A useful starting question is concrete: who is allowed to receive this benefit, how often, and in which product context? Without that definition, even accurate device recognition leaves the team arguing about whether a linked signup should receive access.

A trial, a free tier and free credits have different boundaries

A time-based trial grants access for a limited period. A freemium plan may remain available within a recurring usage allowance. Introductory credits are a balance that can be consumed by work. Each design creates a different eligibility question.

Stytch's account-abuse guide discusses all three forms of free access and both manual and automated abuse. This matters operationally: bot detection can contribute evidence, but a human can also submit an ineligible repeat request.

Write the benefit into the entitlement record. “Trial used” is ambiguous when one account has tried a different product, one employee joins an existing organization or a customer starts a supported evaluation of another workspace.

These are product-policy choices. A device identifier helps investigate a relationship; it does not choose the commercial rule.

Decide who owns the entitlement

A product can grant a trial to a person, account, organization or workspace. Make that scope explicit in both the signup experience and the backend record. Otherwise, two parts of the application may enforce different rules against the same customer.

Consider two colleagues who join one organization from a shared office. Their common network can be entirely ordinary, and an invitation may carry no new introductory benefit. Compare that with a permitted test account requesting the same restricted entitlement after it was already granted. The relevant difference is the grant history and eligibility rule.

Keep the distinction in support tools as well. A reviewer needs to identify the affected account, the requested benefit and the earlier grant. “Linked device” without those details is an incomplete explanation.

Separate recognition from a trial decision

Recognition connects observations under the provider's supported scope. Risk analysis describes the current visit or account activity. Eligibility determines whether this account can receive this particular benefit. All three can contribute to prevention, but they are different records.

ShieldLabs combines device and network intelligence with ready-made multi-accounting detection. Its risk score and Trusted, Suspicious and Dangerous assessments add context for visitors, users, devices and IP addresses. Associate those findings with the account action and the prior entitlement being investigated.

Do not turn a recognition match into proof of one physical person. Shared devices exist, identifiers have defined semantics, and an account association depends on the supported integration. The multiple-account guide covers these relationships in more detail.

Investigate the benefit being consumed

Start at the point where the application creates value: enabling a workspace, issuing credits, creating an API key or permitting an expensive operation. Locate the trusted assessment and the corresponding account reference before examining a broader cluster.

Trueguard's trial-abuse material describes device, network and email correlation around signup. Its Event API illustrates why a verification reference must belong to the intended event. That relationship helps the operating team trace the finding to a requested grant.

The same investigation should retain pending and unavailable states. A failed request is not evidence of a new participant, and a completed assessment arriving after access was granted has a different operational role from a pre-provisioning result.

Use outcomes to improve the process

Track granted, held, rejected and reviewed requests separately. Retain the reason for any correction and whether the customer recovered access. A high signup count or low conversion rate can prompt investigation, but neither establishes abuse without supporting evidence.

For credit-based products, record consumption as well as grants. One repeated grant can have little cost while another enables significant work. The AI credit guide explains how eligibility checks and workload limits work together without treating every heavy user as abusive.

A small pilot should include an independently known legitimate case and an authorized ineligible repeat request. Inspect recognition, current risk, account association and the final grant. This can reveal an implementation error that a favorable risk screenshot would miss.

Choose the evidence your workflow needs

Use the comparison to distinguish ready-made account findings, hosted recognition, configurable fraud workflows and email screening. The public resource directory provides introductory views of visit and network evidence. An integrated evaluation still needs your account and entitlement context.

Before buying, verify the supported client, event timing, plan fields and workload unit. The useful question is whether the selected service supports an inspectable decision before the intended benefit is provisioned.

FAQ