Fraud scoring for SaaS

What to score, and why these

Scoring everything is expensive and scoring the signup alone misses most of it. These are the events that carry the loss in SaaS.

The patterns you will see

SaaS is the vertical where we most often tell people they do not need us yet, and the reason is structural. Nothing gets withdrawn. Nobody cashes out.

The loss shows up in an infrastructure bill and in numbers that quietly stop meaning anything. That is a slower and more forgiving failure than money leaving a wallet.

It changes the honest advice. In rewards the money is gone the moment a payout clears, so detection pays for itself immediately. Here you usually have time to ask whether the problem is worth solving at all.

Work out the unit cost first#

One question decides everything: what does one abusive account actually cost you to serve?

For a project-management tool it might be pennies. The right response is to fix your reporting so the numbers are honest, and otherwise ignore it.

For anything running model inference, rendering, or heavy bandwidth, the same account can cost real money in an afternoon, and the case for acting is immediate.

This is not a rhetorical exercise. The answer moves the decision by a factor of a hundred, and it is the first thing we would ask before selling you anything.

Packaging usually beats detection#

If the same person keeps cycling trials, the most reliable fix is often not to catch them. It is to remove the reason.

A trial that hands over the entire product's value in fourteen days will get cycled. A real free tier that is generous on cheap things and firm on expensive ones turns that person from an adversary into a funnel entry. A usage cap on the costly endpoint makes the abuse limit itself, no matter how many identities they create.

Those are product changes. They cost no vendor spend and they hold permanently. Detection is the layer for what is left, and it works much better when what is left is small.

The signal that survives a change of identity#

Everything a trial cycler shows you is disposable. The email, the name, often the card. So detection built on identity is always one step behind.

The usage curve is not disposable. A real evaluator starts slowly, explores, brings in a colleague, and leaves gaps because they have another job. A cycler front-loads, goes straight to the expensive endpoint, and stops dead when they have what they came for.

Sending us a custom event when an account crosses a meaningful usage threshold is the single highest value integration in this vertical, and it is the one most teams skip, because it is not the signup.

Do not ban the second person from a company#

The worst false positive in SaaS has a specific shape. A second evaluator at a company that was already considering you, sharing an office network and maybe a laptop, refused because they look like a duplicate.

The abuse cost you some compute. The false positive cost you the deal.

So the right outcome here is almost always to withhold the trial rather than block the account, and to treat several signups from one company domain as a sales signal rather than an abuse signal. Ten free webmail addresses is a pattern. Ten addresses at one company is a team evaluating you.

The two calls that carry a SaaS funnel#

The trial start, and the point where a free account starts costing you real money:

const r = await kaidn.score({
  event: "trial_start",
  user_id: user.id,
  ip: req.ip,
  email: user.email,
  device_id: body.kaidn_device_id,
});

const repeat = r.reasons.includes("device_reuse") || r.reasons.includes("email_reuse");

// withhold the TRIAL, not the account
if (repeat || r.verdict !== "allow") return createAccountOnFreeTier(user, r.event_id);

return startTrial(user);

// the second call belongs where cost begins, not where the account begins
export async function onThresholdCrossed(user, usage) {
  const r = await kaidn.score({
    event: "usage_threshold",
    user_id: user.id,
    ip: usage.lastIp,
    email: user.email,
    device_id: usage.lastDeviceId,
  });

  if (r.verdict === "block") return requirePaymentMethod(user, r.reason_text);
  if (r.verdict === "review") return requireVerifiedEmail(user);
}

Do not let a shared office network convict anybody#

The most common false positive in B2B is two colleagues. The field that prevents it is already on the response:

// three accounts on one device across three networks is a shared laptop or a
// coworking space. Three on the SAME network is a stronger claim, not a weaker one,
// but in B2B it is also just an office.
const shared = r.device?.account_count ?? 0;
const sameNetwork = r.device?.account_count_same_network ?? 0;

const looksLikeAnOffice = sameNetwork > 1 && !r.reasons.includes("email_reuse");
if (looksLikeAnOffice) return allow();

email_reuse is what separates the two cases, because a colleague has their own mailbox and a farmer does not.

Where we sit#

We score signup, login, key creation and any custom event you send, using what the email resolves to, whether the device has been here before, IP and network reputation, and how fast things are repeating. Verdicts come back with the checks that fired and what each one counted for.

We are not billing software, we do not chase failed payments, and we produce no compliance evidence. If your problem is cancelled cards or SOC 2, those are different purchases entirely.