Fraud scoring for SaaS

What to score, and why these

Scoring everything is expensive and scoring the signup alone misses most of it. These are the events that carry the loss in SaaS.

The patterns you will see

SaaS is the vertical where we most often tell people they do not need us yet, and the reason is structural: nothing gets withdrawn. Nobody cashes out. The loss shows up in an infrastructure bill and in metrics that quietly stop meaning anything, which is a slower and more forgiving failure than money leaving a wallet.

That changes the honest advice. In rewards the money is gone the moment a payout clears, so detection pays for itself immediately. Here you usually have time to ask whether the problem is worth solving at all.

Work out the unit cost first#

The question that determines everything: what does one abusive account actually cost you to serve?

For a project-management tool it may be pennies, and the correct response is to fix your reporting so the metrics are honest and otherwise ignore it. For anything running model inference, rendering or heavy egress, the same account can cost real money in an afternoon, and the case for acting is immediate.

This is not a rhetorical exercise. The answer moves the decision by two orders of magnitude, and it is the first thing we would ask before selling you anything.

Packaging usually beats detection#

If the same person keeps cycling trials, the most reliable fix is often not to catch them but to remove the reason.

A trial that hands over the entire product's value in fourteen days will be cycled. A genuine free tier that is generous on cheap resources and firm on expensive ones converts that person from an adversary into a funnel entry. A usage ceiling on the costly endpoint makes the abuse self-limiting regardless of how many identities they create.

Those are product changes, they cost no vendor spend, and they hold permanently. Detection is the layer for the residue, and it works much better when the residue is small.

The signal that survives identity rotation#

Everything a trial cycler presents is disposable: the email, the name, often the card. So detection built on identity is always one step behind.

The usage curve is not disposable. A genuine evaluator starts slowly, explores, brings in a colleague and leaves gaps because they have another job. A cycler front-loads, goes straight to the expensive endpoint, and stops dead when the value is extracted.

Sending us a custom event when an account crosses a meaningful usage threshold is the single highest value integration in this vertical, and it is the one most teams skip because it is not the signup.

Do not ban the second person from a company#

The worst false positive in SaaS has a specific shape: a second evaluator at a company that was already considering you, sharing an office network and possibly a device, refused because they look like a duplicate.

The fraud cost you some compute. The false positive cost you the deal.

So the right outcome here is almost always to withhold the trial rather than block the account, and to treat multiple signups from one corporate domain as a sales signal rather than an abuse signal. Ten free-mail addresses is a pattern. Ten addresses at one company is a team evaluating you.

The two calls that carry a SaaS funnel#

Trial start, and the threshold where a free account starts costing you real money:

const r = await kaidn.score({
  event: "trial_start",
  user_id: user.id,
  ip: req.ip,
  email: user.email,
  device_id: body.kaidn_device_id,
});

const repeat = r.reasons.includes("device_reuse") || r.reasons.includes("email_reuse");

// withhold the TRIAL, not the account
if (repeat || r.verdict !== "allow") return createAccountOnFreeTier(user, r.event_id);

return startTrial(user);

// the second call belongs where cost begins, not where the account begins
export async function onThresholdCrossed(user, usage) {
  const r = await kaidn.score({
    event: "usage_threshold",
    user_id: user.id,
    ip: usage.lastIp,
    email: user.email,
    device_id: usage.lastDeviceId,
  });

  if (r.verdict === "block") return requirePaymentMethod(user, r.reason_text);
  if (r.verdict === "review") return requireVerifiedEmail(user);
}

Do not let a shared office network convict anybody#

The most common false positive in B2B is two colleagues, and the field that prevents it is already on the response:

// three accounts on one device across three networks is a shared laptop or a
// coworking space. Three on the SAME network is a stronger claim, not a weaker one,
// but in B2B it is also just an office.
const shared = r.device?.account_count ?? 0;
const sameNetwork = r.device?.account_count_same_network ?? 0;

const looksLikeAnOffice = sameNetwork > 1 && !r.reasons.includes("email_reuse");
if (looksLikeAnOffice) return allow();

email_reuse is the discriminator here, because a colleague has their own mailbox and a farmer does not.

Where we sit#

We score signup, login, key creation and any custom event you send, with email identity resolution, device continuity, IP and ASN reputation and velocity. Verdicts return the checks that fired and their weights.

We are not billing software, we do not do dunning, and we produce no compliance evidence. If your problem is involuntary churn or SOC 2, those are different purchases entirely.