How we prevent fake signups without blocking real people

On 31 October I read a founder's post about a rough night: someone made thousands of fake accounts and drained $4k of free AI credits, straight past email verification. By the end of that day, Sparetext had new guards against the same trick.

Our risk looks different from theirs, though, so our guards look a little different too.

Why fake accounts are a different problem here

On a product like theirs, every fake account costs real money: it spends free credits on a model somebody pays for. Sparetext runs no paid AI on our side, and every text goes out on the account owner's own SIM, on their own carrier plan. A thousand fake accounts can't run up a texting bill for us.

They'd need a phone, too. An account can't send a single text until it pairs a device of its own, usually a phone with a real SIM, and carriers notice a SIM that suddenly texts hundreds of strangers.

That's also why an email address isn't where we put our trust. Their attacker went straight past email verification, and no wonder: an inbox costs nothing to make. A phone with a SIM that sends real texts costs a lot more, so our referral rules count phones and texts, not inboxes.

So the risk isn't our bill. It's spam sent through Sparetext to real people who never asked for it, plus the emails and storage we do pay for. Anyone who gets an unwanted text can reply STOP, and that account can't text them again unless they reply START. The guards are there so it rarely comes to that.

What we already had

• Cloudflare Turnstile on sign-up, sign-in and password reset. Most people never see it: it asks for a click only when Cloudflare isn't sure about you.
• A cap on sign-ups from one IP address in an hour. It's generous on purpose, for a reason I'll get to.
• Referral bonuses only after real use. An invited friend earns you bonus texts once they've paired a phone that no other account had first and sent 20 texts to 5 different numbers on 2 different days, or once they pay. A fake account earns nobody anything.
• A daily limit on every new API key: 100 texts a day on Free and 1,000 on Pro, until you change it. A leaked key or a runaway script stops long before the month's texts are gone.
• One switch that stops all sending, for the day something goes very wrong.

What we added that day

A message when sign-ups jump

Every hour's new accounts are counted. When the count passes certain levels, I get a Telegram message saying how many accounts arrived since the top of the hour, with the commands to stop them right there in the message. I won't say where the levels are, for obvious reasons.

The same message points to who they are. /sources lists the new accounts by where they came from, and how many of them paired a phone or sent a text. A hundred accounts from one place with no phone between them is a very different hour from a hundred people who each paired one.

Three switches, from my phone

The Sparetext bot on Telegram now takes three switches from me:

• /pause signups stops new accounts. Everyone who already has one still signs in.
• /pause free stops Free accounts from sending. Pro accounts keep sending.
• /pause sending stops everything. That's the old kill switch, now one message away.

/resume undoes each one, and /pause on its own shows how they stand. Anyone who tries to sign up meanwhile is told that sign-ups are paused for a short while: sign in if you have an account, or try again in a few hours. I can flip any of them from my phone, wherever I am, without opening a laptop.

A smaller first day for new Free accounts

A new Free account can send 100 texts in its first 24 hours. So a throwaway account made to blast strangers gets a hundred texts on its first day, not the Free plan's whole 300 a month. Pro, with 5 phones and 10,000 texts a month, is never held back, and upgrading lifts the limit at once.

If you're a real person and you hit it, the error tells you exactly where you stand:

{
  "error": {
    "code": "new_account_limit",
    "message": "A new account can send 100 texts in its first day, which keeps throwaway accounts from spamming; this one has 0 left. The limit ends at 2026-11-01 09:30 UTC, or now with Pro."
  }
}

Like the daily limit on new keys, it isn't there to stop abuse forever. It keeps a burst small until I look.

The two guards we skipped on purpose

The founder's advice was good: rate limit by IP address and by device, flag sudden spikes in sign-ups, give new accounts smaller limits, and keep a kill switch for free usage. We took most of it. Two parts we didn't, and both on purpose.

A daily cap per IP address. Mobile carriers put many people behind one IP address (the trade calls it carrier-grade NAT). In Ethiopia, where I build Sparetext, a tight cap per address would turn away real people who happen to share an address with a stranger who signed up that morning. Our hourly cap on sign-ups is generous for the same reason.

A limit per device. One phone pairing many accounts costs us nothing, since its texts all go out on that one SIM. Where a phone could earn something, like a referral bonus, we already refuse a phone that another account had first.

If the alerts ever show abuse that these guards don't stop, those two are next. I'd just rather start with something I can watch than with a wall that also stops my neighbors.

If you run a free plan too

Here's the one thing I'd do tonight: count sign-ups per hour, and message yourself when the count jumps, with the command to pause sign-ups right there in the message. Ours is about ten lines on top of a Telegram bot we already had. It's the guard that tells you when the other guards aren't enough, and at 2am you'll be glad the off switch is a message, not a deploy.