How to Prevent Fake Signups: A Layered Checklist

Fake signups waste free-trial costs, skew your metrics, pollute your CRM and can be a first step toward bigger fraud. No single check stops them all, but a few layers together stop most of them while keeping signup easy for real people.

1. Validate the email at the form

Check every address the moment it's entered:

• Syntax and live MX lookup to reject addresses that can't receive mail.
• Disposable-domain detection to stop throwaway inboxes.
• Typo suggestions ("did you mean gmail.com?") to recover real users who mistyped.

See how to detect disposable email addresses.

2. Check the IP address

The signup request's IP tells you whether the person is behind Tor, an anonymous proxy, a VPN or a cloud server, and roughly where they are. Treat Tor and anonymous proxies as strong signals; treat VPNs as a reason to look closer, not an automatic block. See detecting VPN, proxy and Tor signups.

3. Ask for a phone number where it matters

For flows that grant real value, such as free credits or payouts, a verified mobile number is a strong limit of one account per person. Detect VoIP numbers, especially non-fixed VoIP, so the requirement can't be bypassed cheaply. See VoIP numbers and signup fraud.

4. Combine the signals into one decision

Individual signals are noisy; together they're powerful. A free Gmail address is fine. A free Gmail address from a Tor exit with a VoIP number from another country is not. Score the signup as a whole:

• Start from the riskiest individual check.
• Add weight when several checks are risky at once.
• Add weight for inconsistencies, such as a phone country that doesn't match the IP country.

Then turn the score into allow, review or block, and keep the reasons so your support team can explain any decision.

5. Write rules for your business

Every product has different risks. Useful rules include:

• Block disposable emails and Tor on free trials.
• Review VPNs, data-center IPs and VoIP numbers.
• Allow your own company domain and known partners, always.
• Block known bad actors by email, domain, IP range or phone number.
• Limit signups to the countries you serve, sending others to review.

6. Add friction only to risky signups

Reviewed signups don't have to be rejected. Ask them for one more step, such as verifying a mobile number, confirming their email, or waiting for manual approval, while low-risk users sign up instantly.

7. Clean what's already in your database

Fake accounts that got in before you added checks still skew your numbers. Export your user or lead list and run it through the same checks to find and remove them.

Doing this with VerifyGrid

VerifyGrid's signup check takes the email, phone and IP in one request and returns a single allow, review or block decision with every reason listed. Your decision rules cover thresholds, per-signal actions, allow and block lists and allowed countries, and apply to every API call and every row of a cleaned CSV list.

Try the checks on the free tools, or see pricing: new accounts get 100 free credits.