Free-trial and free-tier credit abuse starts with one disposable email
One person, unlimited accounts: disposable addresses let someone burn through the credits, seats, or compute you meant to give away exactly once. This pattern — sometimes called SaaS signup fraud — is what Mailsurity checks for on every signup, in real time, before you hand out anything free.
Three ways one disposable email drains a free tier
It rarely looks like an attack. Three patterns account for most of it:
- Multi-account farming — the same person cycling through burner inboxes to keep re-claiming a free tier.
- Referral-credit stacking — self-referring with throwaway addresses to trigger a bonus meant for a second real user.
- Seat-limit workarounds — inviting disposable addresses as "teammates" to unlock a plan tier gated on seat count.
All three look like a normal signup until the email domain gets checked.
Catch it before the credit gets granted
Mailsurity's own free tier runs on the same model — 500 credits at signup, funded by a metered API — so this isn't hypothetical for us either. Every check runs through a layered cascade of rules, lists, and adaptive detection; see the full technical breakdown.
That cascade runs on the Starter plan for about $1.00 per 1,000 checks (see current plans) — cheap enough to gate every signup, not just the ones that look suspicious. Full-stack verifiers built for deliverability charge more for the same volume: Kickbox, for example, lists $10 per 1,000 verification credits (full comparison; Kickbox figure last verified 2026-07-25).
Gate the trial, not just the signup
One API call before you grant free credits or seats catches abuse where it actually starts.
Rules for your own edge cases
Per-team allow/deny rules for investor, partner, or known-abuse domains, evaluated first, ahead of every other check.
Catches domains before any list does
New disposable domains show up constantly, so brand-new ones get caught on the first signup, not the thousandth.
One call before you grant anything
import { mailsurity } from '@/lib/mailsurity';
export async function POST(req: Request) {
const { email } = await req.json();
// createUser() and TRIAL_CREDITS are illustrative — swap in your own
// user-creation call and free-tier constant.
if (await mailsurity.isDisposable(email)) {
return createUser({ email, credits: 0 }); // skip the free-credit grant
}
return createUser({ email, credits: TRIAL_CREDITS });
}That's the whole integration for a Next.js route — see the full walkthrough for client setup and error handling.
Running a different stack?
The same check drops into Auth0's Pre User Registration Action, Clerk + Supabase Auth via webhook, or a Vercel edge middleware, or check the full request/response shape in the API docs.
Frequently asked questions
See how much of your free tier is already disposable
Run your current list through the same check Mailsurity uses on every new signup — results come back in seconds, no account required to try it, and the part before the @ never leaves your browser.