Catching Fake Signups and Free Trial Abuse With Enrichment Data

Why fake signups quietly wreck PLG metrics

Every product-led SaaS company eventually runs into the same problem: a chunk of free trial signups aren't real prospects. Some are students testing a tool for a class project. Some are competitors poking around. Some are bots or scripted accounts probing your usage limits. A few are the same person cycling through disposable email addresses to reset a free tier or extend a trial that already expired.

None of this is catastrophic on its own. What actually hurts is what these accounts do to your numbers. Activation rate looks worse than it is, because a chunk of "signups" were never going to activate anything. Trial-to-paid conversion looks worse, because the denominator is inflated with accounts that had no buying intent. Sales gets routed leads that go nowhere, and eventually stops trusting the lead queue altogether. If you're reporting any of these metrics to a board or a CEO, fake signups are quietly lying to you every month.

Signup enrichment, the same data you'd normally use for ICP scoring and onboarding personalization, turns out to be one of the more effective tools for catching this before it pollutes your funnel. You already have the signals. The question is whether you're using them to filter, not just to personalize.

What enrichment actually catches, and what it doesn't

Enrichment won't stop a determined bad actor. If someone is willing to buy a burner phone number and a fresh LinkedIn profile to abuse your trial, no data vendor is going to flag that in real time. What enrichment is good at is catching the much larger volume of low-effort abuse and low-intent noise that doesn't bother covering its tracks.

Domain and email signals

A personal Gmail or Outlook address isn't inherently suspicious, plenty of real buyers sign up from personal email before looping in a work account. But a disposable domain (Mailinator, Guerrilla Mail, 10minutemail, and the hundreds of variants) is a near-certain signal of throwaway intent. Pair that with a plus-addressed Gmail pattern used to register multiple accounts (user+1@gmail.com, user+2@gmail.com) and you have a strong abuse fingerprint, not just a low-confidence match.

Company and role signals

When enrichment can't resolve a personal email to any company, LinkedIn profile, or professional footprint at all, that's meaningfully different from a resolved-but-unremarkable profile. A signup with zero findable professional identity, no company match, no LinkedIn, no discoverable employer, is a weak account by default. That doesn't mean block it. It means don't treat it like a warm lead.

Behavioral and volume signals

This is where enrichment needs to work alongside your own product data. A burst of signups from the same company domain, IP range, or device fingerprint within minutes of each other is a classic abuse pattern, especially when the accounts show no real product usage afterward. Enrichment tells you who these accounts claim to be. Your product analytics tell you whether they behaved like real users. You need both.

Building a trial abuse detection workflow

Most teams either do nothing (every signup gets treated as equally real) or overcorrect (aggressive email verification that adds friction and kills conversion for real buyers). The workaround is a scoring and routing system, not a gate.

Step 1: score every signup on arrival

Run enrichment the moment someone signs up, the same pipeline you're already using for ICP fit. Add abuse-relevant fields to the score: domain type (corporate, personal, disposable), whether a professional profile resolved, whether the email pattern matches known abuse patterns, and whether this is a repeat signup from an already-seen device or IP.

Step 2: route by confidence, not gut feel

Set three bands instead of a binary real/fake decision:

• High confidence, real. Resolved company, resolved professional profile, ICP-relevant role. Route normally, personalize onboarding, let sales-assist rules apply as usual.
• Low confidence, likely abuse. Disposable domain, or a known abuse email pattern, or part of a signup burst with no other resolvable signal. Keep the trial working (don't punish real edge cases by blocking access), but exclude these accounts from activation and conversion reporting, and don't route them to sales.
• Unresolved, needs review. No disposable domain, no company match, nothing conclusively fake, nothing conclusively real. This is the band that matters most, and it's usually 15 to 30 percent of signups for a company selling into a broad market. Don't discard it. Queue it.

Step 3: build a review queue for the middle band

The unresolved band is where most teams either give up or waste analyst time. A lightweight queue, even a shared spreadsheet or a Slack channel fed by your enrichment webhook, lets someone spot-check a sample weekly. You're not trying to clear the whole queue. You're trying to catch patterns: a specific domain showing up repeatedly, a signup source that's disproportionately unresolved, a marketing channel quietly attracting low-intent traffic.

Step 4: feed decisions back into your ICP profile

Every account you confidently mark as abuse or noise should update your detection rules, not just get archived. If a new disposable domain shows up three times in a month, add it to your denylist. If a marketing channel keeps sending unresolved, low-activation traffic, that's a channel quality problem worth raising with whoever owns paid acquisition, not just a data cleanup task.

A practical scoring checklist

Use this as a starting point and adjust weights to your own funnel:

• Domain type: corporate (+), personal but common (neutral), disposable (strong negative)
• Professional profile resolved: yes (+), no (negative, not disqualifying alone)
• Email pattern: standard (neutral), plus-addressed variant of a seen address (negative), sequential or randomized local part (strong negative)
• Signup velocity: isolated signup (neutral), part of a same-domain or same-IP burst with no product usage (strong negative)
• Company size and role match to ICP: matches (+), doesn't match (neutral, not evidence of abuse by itself)
• Repeat trial: previously seen device, browser fingerprint, or billing detail on an expired or canceled account (strong negative)

None of these signals should trigger an automatic block by itself. Combined, they let you separate "probably fine, treat normally" from "probably noise, exclude from reporting and sales routing" without adding verification friction to your signup form.

Common mistakes teams make

Treating every unresolved signup as fake. Plenty of real buyers use personal email, work at small companies with thin online footprints, or have LinkedIn privacy settings that block enrichment. Unresolved isn't the same as fraudulent.

Blocking instead of downgrading. Hard-blocking suspicious signups at the door creates support tickets from real users and teaches abusers to get slightly better at hiding. Letting the trial run while excluding the account from metrics and sales routing gets you most of the benefit with none of the friction.

Never revisiting the rules. Abuse patterns shift. A disposable-domain list from a year ago misses new services. A scoring model that isn't reviewed quarterly against actual outcomes (which "abuse" flags turned out to be real customers, and vice versa) will drift out of accuracy.

Reporting funnel metrics without excluding known noise. If your board deck shows trial-to-paid conversion including a denominator full of disposable-domain signups, you're not measuring your funnel, you're measuring how many burner accounts your product attracts.

Where Groful fits

Groful runs signup enrichment on every new user, resolving company, role, and professional context from nothing more than an email address. The same pipeline that powers personal email resolution and ICP scoring gives you the domain, profile-match, and company signals this kind of abuse detection depends on, without adding a single extra field to your signup form.

For growth and RevOps teams building this workflow, the practical starting point is routing: use enrichment confidence to decide which accounts get sales-assist attention, which get excluded from reporting, and which get queued for a human look. If you're also tightening up data quality more broadly, the companion piece on reducing enrichment false positives covers the evidence and confidence model this abuse-detection workflow builds on.

If fake signups are muddying your activation and conversion numbers, talk to us about wiring enrichment-based scoring into your signup flow, or see pricing to get started.