Repeat free trials
The same person starts trial after trial with new emails, often from a private window. The device is what stays the same.
One free trial. Per customer, not per email.
A free trial is only free for you until someone takes it twenty times. Fingerly gives every signup a visitor ID that survives cleared cookies and private windows, so repeat trials, fake accounts and bot signups are visible before the trial starts.
- Survives cookiesSame device, new email.
- Private windowsReported, still recognised.
- Bot signupsNo captcha required.
- Light frictionGenuine signups flow through.
[ 01 / 06 ]Abuse patterns
How abuse reaches SaaS free trials.
Free trials and freemium plans attract the same few abuses. Most of them rely on looking like a first-time visitor again.
Freemium limit evasion
Free-tier limits on seats, projects or credits are bypassed with extra accounts. A visitor ID counts the devices behind them.
Bot signups and spam accounts
Scripts create accounts in bulk to send spam, scrape or resell access. Automation and hosting networks are reported without a captcha.
Account sharing
One paid login used by a whole team or sold on. The number of distinct devices behind one subscription shows it.
Referral and credit farming
Invite-a-friend credits claimed by accounts the inviter controls. A shared device between inviter and invitees is a clear lead.
Card testing through the trial form
Stolen cards tried against a free-trial card form because it looks harmless. The session is flagged for automation and unusual activity.
[ 02 / 06 ]Pattern to decision
From pattern to decision.
Each pattern maps to what Fingerly reports on the signup request and to the first decision a product team usually makes.
01
Repeat trials
Connect the fifth trial to the first four.
Identify when the trial starts and store the visitor ID with the account. A returning device in a private window is worth a look before the trial is granted. The usual first decision is to ask for a card or a verification step, not to refuse.
- Check at
- SignupFree trial start
- Reads
- Visitor IDNew or returningIncognito mode
02
Bot signups
Spot the script, welcome the person.
Bulk signup scripts use driven browsers and run from hosting networks. Read automation, virtual machine and hosting network signals together and hold the verification email until more is known.
- Check at
- SignupEmail verification
- Reads
- AutomationVirtual machineHosting network
03
Account sharing
Offer a plan, do not just block.
Count distinct devices per subscription at login. Past the limit you set, offer a team or household plan rather than a hard block. A location mismatch alongside many devices is a better reason to ask than either one alone.
- Check at
- LoginStarting a session
- Reads
- Visitor IDLocation mismatchCommercial VPN
04
Referral and credit farming
Check the claim, not the whole customer base.
Identify at signup and when a referral credit is claimed. The same visitor ID on the inviter and the invitee is a strong reason to withhold the credit and review.
- Check at
- Referral signupCredit claims
- Reads
- Visitor IDDevice farmHigh activity
[ 03 / 06 ]Integration
Integrate at the right moments.
Four habits keep a policy for SaaS free trials effective without turning it against genuine customers. A production identification is billed per request, from $0.0025, so it is worth placing where it earns its cost.
- 01 Identify at the moment
Call identify when a trial starts, a referral is claimed and at login for shared plans, not on every page view. Pass your own account reference as the tag so the result comes back with the account it describes.
await fingerly.identify({ tag: "trial-start" }) - 02 Verify on your server
Send only the request ID from the browser to your backend, read the stored result with a secret key, and check that its tag matches the action. Never grant a trial on what the client reports.
- 03 Observe before you enforce
Run in monitoring mode first. Teams and schools share devices and networks, so measure how many genuine signups a rule would affect before enforcing it.
- 04 Act in proportion
Prefer a gentle response: ask for a card or verification on a repeat trial, offer a team plan to a shared account, and keep refusal for clear automation.
[ 04 / 06 ]Moments
Where to check, what to do.
Where a SaaS product usually places the check and what it reads there.
| Moment | Identify when | Read | Usual first decision |
|---|---|---|---|
| Signup | The account is created | Visitor ID, new or returning, automation | Verify by email or card for linked accounts |
| Trial start | Before access is granted | Visitor ID, incognito mode | Ask for a card on repeat trials |
| Referral credit | Before the credit is applied | Visitor ID, device farm | Withhold when inviter and invitee share a device |
| Login | Credentials are submitted | Visitor ID, location mismatch | Offer a team plan beyond your device limit |
| Adding a card | Before it is saved | Automation, high activity | Challenge or refuse scripted attempts |
Every decision is yours. Fingerly returns the visitor ID, the signals and the suspect score, and never blocks a request by itself.
[ 05 / 06 ]Questions
Questions about SaaS free trials.
How a SaaS company uses device fingerprinting against trial and freemium abuse.
Talk to the teamHow do I stop free trial abuse in SaaS?
With Fingerly, you identify the device when the trial starts and store the visitor ID with the account. A device that keeps starting trials is visible even after cleared cookies or a private window, and your product can ask for a card, require verification or send the account to review.
Does the visitor ID survive incognito mode and cleared cookies?
In the ordinary case, yes. The browser SDK keeps nothing on the device, so clearing cookies does not reset the ID and a private window is still the same device. Browsers that randomise what they report are recognised less often, and the response says how sure it is.
Can Fingerly detect account sharing in a subscription?
It gives you the evidence. Count the distinct visitor IDs that use one subscription, and read location mismatch and VPN signals alongside. What happens past your limit is your policy, and offering a plan usually works better than a block.
Do I need a captcha on my signup form?
Not for Fingerly. It reports automation, virtual machines and hosting networks without asking the visitor for anything, and your application decides whether to challenge or refuse. You can still add a captcha where you want one.
Will it work if my app is a single-page application?
Yes. The JavaScript SDK has bindings for React, Next.js, Vue, Nuxt, Svelte and Angular that identify after the page reaches the browser, and the bindings share one identification across a page, so several components asking cost one request.
Less guessing. More knowing.
Make the next connection a trusted one.
Start with the signals, keep your own decisions, and pay as you go, only for what you identify. No credit card needed.