Fake Signups
A visitor arrives at your signup form, considers at some length what to put in the name field, and settles on "asdf jkl;". A second, feeling that this lacks polish, runs a name generator and pairs the result with an inbox that will cease to exist before lunch. Neither of these blots has the slightest intention of returning. Your user table takes them both in anyway, no questions asked — and your metrics count them as growth.
Dregs sizes up every new arrival on the spot: genuine prospects pass without friction, and the junk never makes it past the door.
The Junk Signup Problem
Every product with a signup form attracts a certain class of visitor, and not the class you advertised for. Some are bots, collecting accounts to spam, scrape, or stockpile credentials against a rainy day. Rather more are human: the tire-kicker who cannot be troubled to invent a surname, the cautious soul who declines to hand real data to strangers, and the merely curious, who'd like to see what's behind the login wall and has no plans whatever beyond that.
The result, in every case, is the same. Your user table acquires accounts with no discernible person behind them. Names along the lines of "test test" and "aaa bbb". Addresses at disposable providers that will bounce inside the hour. The occasional profanity, submitted with feeling. Data that satisfies your form validation while meaning nothing whatsoever.
The usual defenses are not equal to it.
| The Traditional Defense | Why It Often Fails |
|---|---|
| Email verification | Disposable providers hand out verified inboxes that live exactly long enough to click the confirmation link, then vanish without leaving a forwarding address. The address was real; the person never was. |
| CAPTCHAs | A human typing rubbish into your form sails through every puzzle without breaking a sweat, and the automated operations route their traffic through solving farms that charge pennies per thousand. |
| Form validation | Validation checks the shape of the data, never its substance. "John Doe" at a throwaway domain is a perfectly well-formed signup, and still rubbish. |
| Double opt-in | Plenty of junk signups confirm the address, never return, and leave a "verified" account squatting in your database in perpetuity, now wearing a badge that says it belongs there. |
| Manual cleanup | Someone has to notice the junk before anyone can remove it, and by then it has already had its way with your metrics, your deliverability, and your conversion math. |
Fake signups are difficult to turn away at the door because they arrive in so many guises, and they are usually a preview of worse behavior to come. What is wanted is a system that judges the quality and plausibility of a signup rather than its punctuation.
Fake Signups Have Real Costs
Junk accounts are not merely untidy. They degrade your operations, your outreach, and your grasp of what is actually going on in your product.
Polluted database
Fake accounts settle in among the real ones, and querying, segmenting, and maintaining the table all become harder. Every downstream system that touches it inherits the noise, from analytics to billing to your support tooling.Wasted outreach
Marketing mail to fictional addresses bounces, which your sender reputation takes personally. Onboarding sequences, drip campaigns, and re-engagement all spend themselves on accounts that were never there.Misleading metrics
Signups look splendid while conversion looks dreadful, and decisions made on those numbers go quietly wrong. You will believe you have a conversion problem when what you have is a quality problem.How Dregs Detects Fake Signups
A fake signup is, at bottom, a data quality problem: structurally impeccable and entirely fictional. Dregs evaluates each one at the moment of submission, scoring it on plausibility rather than on format. Every score opens into its observations, so you can see exactly why a signup was marked down and confirm it isn't a false positive before you act.
Authenticity Score
The principal signal, and the one that does most of the work. The Authenticity score asks whether the submitted data could plausibly belong to a real person. Keyboard-mashed names ("asdf"), disposable domains, a name bearing no relation whatever to the address attached to it, character sequences no parent ever bestowed, and data that is syntactically valid while remaining semantically vacant: all of it drives the score down.
Human Junk vs. Bot Junk
Not all rubbish is equal. The human who mashes the keyboard to get past your form is a mere nuisance. The bot assembling hundreds of accounts for later use is a different proposition entirely, and the distinction matters when you decide what to do about it. The Humanity score tells you which of the two you're dealing with, so you can respond proportionally: a little friction for the idle human, a hard block for the industrious machine.
Signup Flow Analysis
Real users potter about before committing. They read the pricing page, poke at the features, perhaps consult the docs. The junk signup does none of this: it arrives at the form, completes it with unseemly haste, and either departs at once or gets straight down to business. The Behavior score measures that difference in engagement.
Serial Junk Detection
When the same person (or the same script) is turning out junk accounts one after another, the device tends to give the game away. The Uniqueness score notices the repetition across different names, addresses, and sessions. One junk signup is a data quality problem. Five from the same device is a habit — and habits can be acted upon.
Example: Catching a Junk Signup
How it goes in practice:
Nobody reviewed anything... the junk signup was caught and handled almost instantly on submission.
Quarantining Fake Signups
Detection is half the business. What follows depends on your product and on how much you mind the occasional false positive. Dregs supplies the scores, along with custom rules and lists (badge rules and datasets, in Dregs terms), so you can automate whichever response fits.
Rejection
Accept the signup on the surface and provision nothing behind it. No onboarding email, no trial resources, no clutter. The visitor sees a confirmation page, discovers that nothing beyond it works, and drifts off to bother somebody else.
Verification
Ask for something further (a phone number, a genuine confirmation, a payment method) when Authenticity comes in low. Legitimate users manage it without difficulty. The junk signer, confronted with actual effort, abandons the enterprise.
Escalation
Send low scorers to a review queue rather than refusing them outright. Only flagged accounts arrive there, so it's far less manual review than combing through signups by hand, and it errs on the side of caution where false positives are expensive.
Cleanup
Let everything through and sweep periodically, purging the accounts that scored badly and then did nothing whatever with themselves. A lighter touch that keeps the database respectable without anyone standing at the door.
The best moment to deal with a fake signup is before it reaches your onboarding flow. Dregs webhooks deliver scores to your application almost as soon as the signup lands, so you can reject, quarantine, or flag it without spending a single onboarding email or support cycle on a fiction.
Fake signups are frequently the overture to something worse. If the junk is arriving by bot, see bot detection. If it is humans working their way through disposable addresses, see free trial abuse. And if the names are gibberish but the addresses belong to real people who never visited, your form is being used to flood somebody else's inbox — see registration bombing.
Stop fake signups from polluting your data.
Dregs weighs every signup for authenticity, humanity, and behavior from the moment the form is submitted. Install the tracking script and the junk is flagged before it ever reaches your onboarding flow.
Schedule a Demo