Detect Fake Signups
A visitor arrives at your signup form, considers at some length what to put in the name field, and settles on "asdf jkl;". A second, feeling that this lacks polish, runs a name generator and pairs the result with an inbox that will cease to exist before lunch. Neither of these blots has the slightest intention of returning. Your user table takes them both in anyway, no questions asked — and your metrics count them as growth.
Dregs sizes up every new arrival on the spot: genuine prospects pass without friction, and the junk never makes it past the door.
The Junk Signup Problem
Every SaaS product with a signup form attracts a certain class of visitor, and not the class you advertised for. Some are bots, collecting accounts to spam, scrape, or stockpile credentials against a rainy day. Rather more are human: the tire-kicker who cannot be troubled to invent a surname, the cautious soul who declines to hand real data to strangers, and the merely curious, who'd like to see what's behind the login wall and has no plans whatever beyond that.
The result, in every case, is the same. Your user table acquires accounts with no discernible person behind them. Names along the lines of "test test" and "aaa bbb". Addresses at disposable providers that will bounce inside the hour. The occasional profanity, submitted with feeling. Data that satisfies your form validation while meaning nothing whatsoever.
The usual defenses are not equal to it.
| The Traditional Defense | Why It Often Fails |
|---|---|
| Email verification | Disposable providers hand out verified inboxes that live exactly long enough to click the confirmation link, then vanish without leaving a forwarding address. The address was real; the person never was. |
| CAPTCHAs | A human typing rubbish into your form sails through every puzzle without breaking a sweat, and the automated operations route their traffic through solving farms that charge pennies per thousand. |
| Form validation | Validation checks the shape of the data, never its substance. "John Doe" at a throwaway domain is a perfectly well-formed signup, and still rubbish. |
| Double opt-in | Plenty of junk signups confirm the address, never return, and leave a "verified" account squatting in your database in perpetuity, now wearing a badge that says it belongs there. |
| Manual cleanup | Someone has to notice the junk before anyone can remove it, and by then it has already had its way with your metrics, your deliverability, and your conversion math. |
Fake signups are difficult to turn away at the door because they arrive in so many guises, and they are usually a preview of worse behavior to come. What is wanted is a system that judges the quality and plausibility of a signup rather than its punctuation, so trial conversion describes actual prospects.
Fake Signups Have Real Costs
Junk accounts are not merely untidy. They degrade your operations, your outreach, and your grasp of what is actually going on in your product.
Polluted database
Fake accounts settle in among the real ones, and querying, segmenting, and maintaining the table all become harder. Every downstream system that touches it inherits the noise, from analytics to billing to your support tooling.Wasted outreach
Marketing mail to fictional addresses bounces, which your sender reputation takes personally. Onboarding sequences, drip campaigns, and re-engagement all spend themselves on accounts that were never there.Misleading metrics
Signups look splendid while trial conversion looks dreadful, and decisions made on those numbers go quietly wrong. You will believe you have an activation problem when what you have is a signup-quality problem.How to Detect Fake Signups
Format checks won't catch a fake signup. The data is well-formed and the person behind it is fictional, so the work is to judge quality: whether the identity could belong to a real person, whether a human or a bot submitted it, whether the visitor explored anything before converting, and whether the same device is producing a stream of similar accounts. Score those together, keep the evidence visible so you can confirm it isn't a false positive, and you can act before the junk reaches onboarding.
Dregs evaluates each signup at the moment of submission along those lines, with custom rules and lists implemented as a pipeline of AI-assisted analyzers. Every score opens into its observations, so you can see exactly why a signup was marked down.
Authenticity Score
The principal signal, and the one that does most of the work. The Authenticity score asks whether the submitted data could plausibly belong to a real person. Keyboard-mashed names ("asdf"), disposable domains, a name bearing no relation whatever to the address attached to it, character sequences no parent ever bestowed, and data that is syntactically valid while remaining semantically vacant: all of it drives the score down.
Human Junk vs. Bot Junk
Not all rubbish is equal. The human who mashes the keyboard to get past your form is a mere nuisance. The bot assembling hundreds of accounts for later use is a different proposition entirely, and the distinction matters when you decide what to do about it. The Humanity score tells you which of the two you're dealing with, so you can respond proportionally: a little friction for the idle human, a hard block for the industrious machine.
Signup Flow Analysis
Real users potter about before committing. They read the pricing page, poke at the features, perhaps consult the docs. The junk signup does none of this: it arrives at the form, completes it with unseemly haste, and either departs at once or gets straight down to business. The Behavior score measures that difference in engagement.
Serial Junk Detection
When the same person (or the same script) is turning out junk accounts one after another, the device tends to give the game away. The Uniqueness score notices the repetition across different names, addresses, and sessions. One junk signup is a data quality problem. Five from the same device is a habit — and habits can be acted upon.
Example: Catching a Junk Signup
How it goes in practice:
Nobody reviewed anything... the junk signup was caught and handled almost instantly on submission.
Quarantining Fake Signups
Detection is half the business. What follows depends on your product and on how much you mind the occasional false positive. Dregs supplies the scores, along with custom rules and lists (badge rules and datasets, in Dregs terms), so you can automate whichever response fits.
Rejection
Accept the signup on the surface and provision nothing behind it. No onboarding email, no trial resources, no clutter. The visitor sees a confirmation page, discovers that nothing beyond it works, and drifts off to bother somebody else.
Verification
Ask for something further (a phone number, a genuine confirmation, a payment method) when Authenticity comes in low. Legitimate users manage it without difficulty. The junk signer, confronted with actual effort, abandons the enterprise.
Escalation
Send low scorers to a review queue rather than refusing them outright. Only flagged accounts arrive there, so it's far less manual review than combing through signups by hand, and it errs on the side of caution where false positives are expensive.
Cleanup
Let everything through and sweep periodically, purging the accounts that scored badly and then did nothing whatever with themselves. A lighter touch that keeps the database respectable without anyone standing at the door.
The best moment to deal with a fake signup is before it reaches your onboarding flow. Dregs webhooks deliver scores to your application almost as soon as the signup lands, so you can reject, quarantine, or flag it without spending a single onboarding email or support cycle on a fiction.
Fake signups are frequently the overture to something worse. If the junk is arriving by bot, see bot detection. If it is humans working their way through disposable addresses, see free trial abuse. And if the names are gibberish but the addresses belong to real people who never visited, your form is being used to flood somebody else's inbox — see registration bombing.
Frequently Asked Questions
Q: How do you detect fake signups?
A: You detect fake signups by scoring whether the submitted identity could belong to a real person, not whether the form is well-formed. Useful signals include keyboard-mashed or generated names, disposable email domains, a name that doesn't agree with the address, a form completed with no prior exploration, and the same device producing several accounts. Email verification, CAPTCHAs, and field validation miss this because they check format, not substance. Dregs scores authenticity, humanity, behavior, and uniqueness at submission, and every score opens into its observations so you can see exactly why before you act.
Q: How can SaaS companies prevent fake trial signups?
A: Detect them first, then respond in a way that matches how expensive a false positive would be: provision nothing behind a junk account, step up verification, send only flagged signups to a review queue, or sweep later. The useful moment is before onboarding, so no trial resources, drip campaign, or conversion math is spent on a fiction. Dregs delivers scores by webhook almost as soon as the signup lands, so your application can quarantine the junk with less manual review.
Q: What tools detect fake signups in SaaS?
A: Look for a tool that judges signup quality rather than format: identity plausibility, human versus bot, signup-flow engagement, and serial accounts from one device. A CAPTCHA, email confirmation, or form-validation product is not a fake-signup detector. Dregs is built for this pattern, with four scores, visible observations, custom rules and lists, and a webhook into your application. Compare candidates by running a junk signup (nonsensical name, disposable inbox, no exploration) and a thin but real one, and seeing which tool shows the evidence behind the score.
Q: Will detecting fake signups create false positives?
A: It can, especially for privacy-conscious people who withhold real data. That's why the response matters as much as the detection: keep the observations visible so you can check the evidence, and use graduated actions rather than a hard block on a single low score. Dregs scores four dimensions instead of one and opens every score into its observations, so you can confirm a flag isn't a false positive before you act.
Stop fake signups from polluting your data.
Dregs weighs every signup for authenticity, humanity, and behavior from the moment the form is submitted. Install the tracking script and the junk is flagged before it ever reaches your onboarding flow.
Schedule a Demo