Free Trial Abuse: Stop Repeat Trials Without Breaking Visa Rules
Free trial abuse: multiple accounts, prepaid and throwaway cards, card testing through sign-ups, the signals to watch, and the Visa trial rules to keep.
Article summary
TL;DR
Free trial abuse is taking a trial again and again, or with no intent to pay: new emails, new accounts, prepaid or single-use cards, bots. Stop it by tying each trial to a card, device and address rather than an email, adding friction only to risky sign-ups, and keeping Visa's trial rules: clear terms, a 7-day reminder, online cancellation.
- An email is free to change. Tie the trial to the card fingerprint, the device and the delivery address.
- A free trial sign-up that saves a card is a favorite target for card testing: card setups don't usually show on statements.
- Visa monitors card testing at 300,000 enumerated transactions and 20% of authorizations in a month, both reached.
- Blocking prepaid cards isn't a free choice: in the US, Visa puts prepaid in the debit category you agreed to accept.
- Anti-abuse measures can't touch Visa's trial rules: terms at checkout, a reminder 7 days before the first charge, online cancellation.
ChatGPT
Claude
Perplexity
GrokOn this page
A free trial is a bet: you give the product away for a while because enough people stay. Free trial abuse breaks the bet. The same person takes the trial ten times under ten emails, a bot farm opens trial accounts by the hundred, or someone uses your sign-up form to check which stolen cards still work.
The fixes are well known. The trap is fixing abuse in a way that breaks the card network rules for trials, which costs more than the abuse did.
What is free trial abuse?
Free trial abuse is using a free trial with no intent to pay, usually by resetting it with a new identity. It's different from a customer who tries the product and cancels before the first charge: that customer is using the offer as designed, and Visa requires you to make that cancellation easy.1Visa Core Rules and Visa Product and Service Rules, October 24, 2026
Abuse comes in three shapes:
Serial trials
One person, many sign-ups: new email, sometimes a new card, to restart the free period again and again.
Bulk accounts
Scripts creating trial accounts by the hundred, to resell access, farm referral credits or consume free resources.
Card testing
The trial form is used to check stolen cards: a card saved for a trial is a card the issuer just confirmed as valid.
A fourth pattern sits at the edge: the customer takes the trial, then disputes the first paid charge as "not authorized" or "cancelled". That's friendly fraud on a trial, and the defense is your consent record, covered below.
How people abuse free trials
Fig. 1Trial abuse tactics and what they get past
| Tactic | What it gets past | What catches it |
|---|---|---|
| New email for each trial (aliases, throwaway domains) | A one-trial-per-email check | Same card fingerprint, device or address as an earlier trial; disposable email domain |
| Prepaid or single-use virtual cards | A one-trial-per-card-number check, and the first charge, which declines | Card funding type; renewal declines right after the trial |
| Same card, new account | Account-level limits | Card fingerprint seen on several customers |
| Proxies and VPNs | IP-based limits | Anonymous IP flags; device fingerprint |
| Bots filling the sign-up form | Manual review | CAPTCHA, rate limits per IP and per device |
| Card testing through the trial form | Payment fraud rules that only look at charges | Spike in card setups and declines, odd names and emails |
| Trial, then dispute the first charge | Your sign-up checks | Consent record, reminder sent, easy cancellation |
most beat an email check, few beat a card fingerprint
On physical products, a "free" trial that ships a full-size product is the most expensive version of the problem: each abusive sign-up costs the goods and the shipping, not just server time. Those offers also draw the strictest processor scrutiny, as explained in free trials and negative option billing.
Card testing through trial sign-ups
This is the abuse that hurts your payment account, not just your margins. Stripe explains that card testers favor card setup over payments, "because card validation and authorizations during card setup don't typically show up on cardholder statements."2Stripe Docs, Protect yourself from card testing A trial that saves a card without charging it is exactly that endpoint.
The consequences, as Stripe lists them: disputes when some tests succeed, a higher decline rate that can stick to your account after the attack, extra authorization fees, and possible enrollment in card network monitoring programs.2Stripe Docs, Protect yourself from card testing
Visa watches enumeration directly. Under its Acquirer Monitoring Program (VAMP), a merchant is flagged for card testing when it reaches both 300,000 enumerated transactions and an enumeration ratio of 20% of authorizations in a month.
Visa counts card testing that reaches the processor, approved or declined, and doesn't fine merchants for it. Stripe still asks accounts placed in a monitoring program to act immediately.4Stripe Docs, Card network monitoring programs
Dunning can look like testing
Stripe warns that extreme spikes of retries with a low success rate look like card testing to issuers. After an attack, don't keep retrying the cards saved on fake trial accounts: that repeats the attack.2Stripe Docs, Protect yourself from card testing
What Stripe recommends against it: CAPTCHA on every request that validates a card, login or session checks before the payment form, rate limits such as new customers per IP per day, and limits on cards per account.2Stripe Docs, Protect yourself from card testing More on the pattern in our BIN attack definition.
Inside Tagada
Build the funnel once, route every customer to the right offer
Checkout, upsells and subscriptions on one flow, with conditions per country, order or customer.
Signals of free trial abuse
No single signal proves abuse. Stack them, and act on the combination.
- Card fingerprint already used on an earlier trialSerial trial under a new emailStart the subscription without a trial, or decline the trial
- Disposable email domain, anonymous IPThrowaway identityAdd a check: SMS code, 3-D Secure, or a paid trial
- Prepaid card, card country different from IP countryHigher risk the first charge declinesShorter or paid trial; ask your acquirer before blocking
- Burst of card setups, most declined, odd namesCard testing through the sign-up formCAPTCHA, rate limits, refund anything that got charged
- Same device on several trial accountsOne person or one scriptLimit trials per device
- Real usage, renewal reminder openedA genuine trial userLeave alone: they're the reason you run trials
Payment tools expose most of these. Stripe Radar, for example, has attributes for the card fingerprint ("a unique identifier of a particular card number"), the card funding type (credit, debit, prepaid), disposable email providers, proxy or Tor IP addresses, and counts such as how many customer records share one card.3Stripe Docs, Radar supported attributes
On the device side, a device fingerprint ties sign-ups together when emails and IPs change.
Can you block prepaid cards?
Prepaid cards are a classic trial tool: load a few dollars, take the trial, let the first charge fail. Many fraud tools let you block them in one rule. Whether you may is a card network question.
| Where your customers' cards are issued | What Visa allows |
|---|---|
| United States | You accept Visa credit, Visa debit, or both. The debit category includes prepaid cards issued in the US, so accepting debit means accepting prepaid. |
| EEA and UK | Prepaid is its own product category. A limited acceptance merchant, registered by its acquirer, can decline it, but must accept any valid card issued outside the EEA (or UK). |
| Anywhere | You must accept every valid card in the categories you accept, including foreign-issued cards. |
Source: Visa Core Rules, October 24, 2026, sections 1.5.4.2, 1.5.4.4 and 1.5.4.6, and the definition of the US Visa Debit Category.1Visa Core Rules and Visa Product and Service Rules, October 24, 2026 The details are in our Honor All Cards rule page.
Practical rule
Before writing a rule that blocks prepaid cards, ask your acquirer whether you're registered as a limited acceptance merchant and for which categories. Where you can't block, change the offer instead: a short paid trial filters prepaid cards with no balance without refusing the card.
Prepaid cards also break renewals for a structural reason: Visa doesn't require issuers to enroll prepaid BINs in Visa Account Updater, so a replaced prepaid card won't update itself the way most debit and credit cards do.1Visa Core Rules and Visa Product and Service Rules, October 24, 2026 See card account updater.
The Visa trial rules your defenses must respect
Fighting abuse with friction is fine. Fighting it by hiding the terms, skipping the reminder or making cancellation hard isn't, and it shows up in your disputes. Visa's rules for trials apply to every merchant accepting Visa.1Visa Core Rules and Visa Product and Service Rules, October 24, 2026
| Visa requirement | Who it applies to |
|---|---|
| Trial length, amounts and dates of the first and later charges shown at consent, separately from your general terms | Every merchant storing a card for recurring charges |
| Consent through a "click-to-accept" button on the checkout screen | Negative option merchants selling online |
| Receipt or written confirmation right after sign-up, with the last 4 card digits and how to cancel | Negative option merchants |
| Notice at least 7 days before the charge when a trial or introductory offer ends, with the amount, the date and a link to cancel online or by text | Every recurring merchant |
| A simple cancellation procedure, online if the order was taken online | Every recurring merchant |
Source: Visa Core Rules, October 24, 2026, tables 5-19 and 5-20 (p. 467-470) and section 5.8.17.2 (p. 485-487).1Visa Core Rules and Visa Product and Service Rules, October 24, 2026
Skip them and the disputes are hard to fight. Visa's 13.5 "Misrepresentation" reason covers goods or digital goods bought through a trial when the cardholder "was not clearly advised of further Transactions".1Visa Core Rules and Visa Product and Service Rules, October 24, 2026
If you bill through Stripe, its hosted reminder emails go out 7 days before a trial ends, or at the start of trials shorter than 7 days.6Stripe Docs, Manage compliance requirements for trials and promotions The full set of laws and network rules for trials, including ROSCA and California, is in free trials and negative option billing.
How to prevent free trial abuse
- One trial per card, not per email. Store the card fingerprint with each trial and refuse a second trial on the same one. Add the device and the delivery address as second keys.
- Verify the card without charging it. A zero-dollar authorization confirms the card is valid before the trial starts.
- Protect the sign-up form like a checkout. CAPTCHA on every card validation, rate limits per IP and device, a cap on cards per account.
- Add friction only where the signals stack. An SMS code or 3-D Secure for risky sign-ups; nothing extra for clean ones.
- Consider a paid trial. Stripe presents trial offers, such as a reduced first period, as a way to "qualify high-intent leads, reduce trial abuse".5Stripe Docs, Configure trial offers on subscriptions A charge has to succeed before the trial starts.
- Limit what the trial unlocks. Usage caps on costly features; for physical products, a sample size rather than a full bottle.
- Keep the network rules. Terms at checkout, the 7-day reminder, cancellation online. They cut friendly fraud on the first charge, which is the costliest form of trial abuse.
- Watch the first paid charge. Decline rate, refunds and disputes on trial conversions, by acquisition channel. A channel that brings serial triers shows up there first.
Sources: Stripe Docs (card testing, Radar attributes, trial offers), Visa Core Rules, October 24, 2026.
Free, paid or no-card trials each move the balance between sign-ups and abuse:
| Trial type | Abuse exposure | What you still owe |
|---|---|---|
| NoCard required | High for serial trials and bulk accounts; no card testing risk | NoCard rules until the customer adds a card; consumer law on renewals if you later charge |
| Free, card required | Lower for serial trials; card testing target | All the Visa trial rules above |
| Paid trial ($1 or a reduced first period) | Lowest: a payment must succeed | The same disclosures and the 7-day notice before the full price |
What happens after the trial, from failed renewals to retention flows, is covered in subscription payment failures and subscription retention and cancellation flows.
How Tagada helps
Trials with a vault you own
Tagada follows Visa and Mastercard rules and the laws that apply to payments. TagadaPay runs "native 3DS2, device intelligence, and rules engine: approve real customers, block the rest," routes renewals to the processor most likely to approve them with retries on decline, and keeps your cards and subscription data portable: "Switch processors without re-onboarding customers." See TagadaPay to apply, or pricing for CRM plans.
Frequently asked questions
What is free trial abuse?
How do I stop people from signing up for multiple free trials?
Should I require a credit card for a free trial?
Can I block prepaid cards from free trials?
Is a paid trial better than a free trial against abuse?
What does Visa require for free trials?
Sources
Checked November 2, 2026- Visa Core Rules and Visa Product and Service Rules, October 24, 2026
- Stripe Docs, Protect yourself from card testing
- Stripe Docs, Radar supported attributes
- Stripe Docs, Card network monitoring programs
- Stripe Docs, Configure trial offers on subscriptions
- Stripe Docs, Manage compliance requirements for trials and promotions
Tagada
Running trials at scale? Keep a second processor ready
Funnels, one-click upsells, subscription billing and payment routing, on one customer record.
- 01Create your free account
- 02Connect your store or build a checkout
- 03Launch funnels, upsells and subscriptions