A free tier is compute, storage and outbound network handed to anyone who can complete a signup form. That is the point of it, and it is also a standing offer to everyone who wants those things for a purpose you did not intend.
The abuse is rarely sophisticated. It is automation against a form with one weak check, repeated thousands of times.
This post is what the abuse looks like and which controls are worth their friction. For whoever owns a product with a free tier or a trial.
What people actually do with it
Compute for its own sake. Mining, distributed processing, anything where your free allowance is cheaper than renting. If your product runs jobs, builds, scans or containers, this is the primary risk.
A clean network position. Your outbound addresses are reputable, so they are useful for scraping, for probing other targets, and for traffic that would be blocked from a hosting provider's range. This one damages you twice: the cost, and your addresses landing on blocklists.
Storage and bandwidth, when you offer file hosting, because a link on your domain has better deliverability than one on theirs.
Referral and credit fraud, where signup bonuses are the product being farmed.
Reconnaissance, where an account is a way to study your product before attacking a paying tenant.
The first two are the expensive ones and the last is the one nobody is watching for.
The signals that actually separate abuse from users
Not the ones that come to mind first.
Payment method as proof of cost. Requiring a card, even without charging, removes the overwhelming majority of automated signups, because a card is expensive to obtain at volume. It also removes real users who were evaluating you, which is a genuine conversion cost and the reason many products decline it. It is the single most effective control available.
Email properties. Disposable domains are easy to reject and they are a moving target. Distinguishing a free mailbox provider from a disposable one matters, because rejecting all free providers rejects a lot of legitimate developers.
Velocity, keyed on something that costs money to rotate. Signups per network range per hour is more useful than per address, because addresses are cheap and ranges are less so. Also useful: per device fingerprint, per payment instrument, per phone number.
Behaviour after signup. This is the strongest signal and the most underused. A legitimate new user explores, reads documentation, creates one thing. An abusive account goes straight to the expensive endpoint, at volume, within seconds. You do not need to decide at signup; you can decide two minutes later with far better information.
Similarity across accounts. The same configuration, the same workload shape, the same timing pattern across many new accounts is a cluster, and clusters are what you want to act on rather than individual accounts.
Design the free tier so abuse is not worth it
Cheaper than detection, and more reliable.
Cap the expensive resource specifically. Not a general quota: a limit on the thing that costs you, whether that is job minutes, egress, or calls to a metered third party.
Make the valuable capability require a paid step. If outbound network access from your runners is the attractive part, restrict it on free accounts to what a legitimate evaluation needs.
Bound concurrency, not just totals. A monthly allowance consumed in an hour is the shape of abuse, and a concurrency limit makes the resource much less attractive without affecting someone trying the product.
Shorten the trial. A fourteen-day trial with a real limit is evaluated by real users and is not a useful platform for anyone else.
Progressive friction rather than a wall
The mistake is putting all the friction at signup, where it costs you the most conversions and where an attacker has the most patience.
Let people in easily. Apply friction when they do something expensive: a verification step before the first large job, a card before the first run above a threshold, a phone check before outbound network access. Real users hit these having already seen value, which is exactly when they are willing to complete them.
Abusers hit the same friction before they have extracted anything.
Measure whether it is working
Two numbers tell you most of it.
Cost per free account, over time, and the shape of its distribution. A long tail consuming orders of magnitude more than the median is your abuse, and it is visible without any detection system.
Conversion rate by cohort, so that when you add friction you can see what it cost. A control that halves abuse and halves signups is not obviously a win, and without this number the argument about it is unresolvable.
The concession
Every control here reduces signups, and for an early-stage product that is the wrong trade. Free tier abuse costing a few hundred a month is a rounding error next to the growth a frictionless signup buys, and teams that harden it too early optimise for a problem they do not have yet against a goal they urgently do.
The trigger is the cost curve, not the principle. When the long tail of free accounts becomes visible in your bill, or when your addresses start appearing on blocklists, the trade has changed. Before that, watch the numbers and leave the door open.
The implication
A free tier is a deliberate gift of resources, and the question is not whether some of it is taken by people you did not intend to give it to. It is whether you can see it happening and whether the amount is one you chose.
Sort your free accounts by cost this month. The shape of that list tells you whether you have a problem, and it takes one query.
