How to prevent fake signups without hurting conversion

Signup fraud is painful because the obvious fix often hurts good users. If every visitor must solve a challenge, verify a phone number, and wait for review, conversion drops. If nobody is checked, fake accounts pollute metrics, abuse trials, and reach expensive product features.

The better approach is risk-based friction. Check quietly first, then add friction only when the request deserves it.

What to check before account creation

At signup, send RequestGuard the signals your backend already sees:

• Client IP from your trusted edge.
• Email and email domain.
• User agent and session ID.
• Claimed company domain.
• Signup source, invite state, plan, and campaign metadata.

const assessment = await requestGuard.assess({
  ip,
  email,
  domain: email.split("@")[1],
  userAgent,
  event: "signup",
  sessionId,
  metadata: {
    plan,
    signup_source: source,
    claimed_company_domain: companyDomain,
  },
});

Use decisions instead of blanket rules

Map the response to clear actions:

Decision	Signup action
allow	Create the account normally.
challenge	Require email verification or CAPTCHA.
review	Create a limited account or route to review.
block	Stop account creation.

This gives real users a fast path while making automation pay a cost.

Where fake signups become expensive

Fake accounts are not only a form problem. They become expensive when they can create API keys, invite team members, consume credits, scrape data, redeem trials, or reach payment flows.

Use RequestGuard at signup and again before sensitive actions. Rechecking at value boundaries is often more effective than making the initial form hostile.

Conversion-friendly policy

Start with quiet checks. Challenge only when the score and reasons justify it. Keep a review path for important accounts that look unusual but may be legitimate.

The goal is not maximum blocking. The goal is clean growth: fewer fake accounts, less trial abuse, and fewer real users punished by generic friction.