Seven signs your free tier is being farmed.
Credit farming hides in your signup numbers. These are the signs we look for, and most of them show up in data you already have.
The signs
Signups outpace activation
Signups climb while the number of accounts making a real API call stays flat.
Credit drained right after signup
Accounts that spend the whole grant within minutes and never come back.
Clusters on one parent domain
Many signups from subdomains of the same domain, or from a domain registered days ago.
Variations of one inbox
Gmail-style aliases and dot variations that all deliver to the same mailbox.
A rush through one signup route
A sudden jump in signups through a single route, often OAuth, especially one without a captcha.
Fresh accounts behind OAuth
Sign-in-with-GitHub or Google accounts created days before they sign up with you, with no other activity.
Your name in someone else's repo
Scripts on GitHub or a self-hosted git server that name your product, endpoints or signup flow. This is the sign that tells you who's doing it.
What to do next
Close the route the farm is using with the changes in how to stop free credit farming. Then go after the source: a farm leaves a toolkit, and a toolkit can be taken down.
Our free farm exposure report searches public sources for toolkits aimed at your signup flow.
Questions
How much farming is normal?
Any free tier attracts some abuse. What matters is whether it comes from a toolkit, because a toolkit scales and gets shared.
Can fraud scoring catch this?
It can catch some of the signups. It can't see the toolkit behind them or take it down. See Esuba vs fraud scoring.