Fake account detection that stops bots before the signup completes.
Trueguard detects fake accounts and bot registrations at signup by scoring automation behaviour, device fingerprints, network origin and email reputation together. Scripted signups, headless browsers and farmed registrations are blocked before they reach your database.
No credit card required - free tier availableSignup verification
Bot registration>70M Verifications
Signup events scored across customer products to date.
25% Of users
On some products, up to a quarter of registrations are fake or automated.
>90% Detection
Bot and fake registrations identified before the account is created.
Signs your signup form is being automated.
Fake registrations are rarely reported by anyone. They surface as noise in your numbers and work for your support team. If two or more of these look familiar, you need to stop fake accounts at the form.
See how detection worksSignup spikes with no activation
Hundreds of accounts appear in minutes and none of them log in a second time.
Your metrics no longer mean anything
Registration counts, funnel rates and cohort retention are all diluted by accounts that were never people.
Spam and abuse from inside the product
Fake accounts post content, send invitations or hit your API until someone shuts them down by hand.
Manual review is a standing task
Someone on the team spends hours a week deciding which accounts are real.
How it works
Fake account detection, from page load to rule action.
Modern signup bots run real browsers, solve CAPTCHAs and use residential proxies. Bot signup detection looks at how the session behaves, what device is behind it and where it came from, then hands your backend a score and a decision before the account exists.
Step 1
Bot and automation detection
Headless browser detection, automation frameworks, spoofed user agents and inhuman interaction timing produce a bot score of their own, separate from the risk score, so you can act on automation specifically.
See the bot score in the Event APIStep 2
Device, network and email signals
A durable device ID from browser, hardware and JA4/TLS characteristics, plus datacenter, VPN, Tor and residential-proxy detection, signup velocity per IP and disposable-email analysis - correlated into one score.
Try the VPN and proxy checkerStep 3
Your rules, your action
Design rules your way - block the registration, require verification, hold it for review, or let it through and flag it. Every decision returns in the API response, so nothing needs a dashboard visit.
Read the Event API referenceOne signal set, four problems it solves.
Fake account detection
The fake account detection API scores every registration against automation behaviour, device history, network origin and email reputation, and returns the verdict before the account row is written.
Fake signup detection and bot signups
Fake signup detection covers Headless Chrome, Puppeteer, Playwright and scripted form posts, identified by how the session behaves rather than by whether a CAPTCHA was solved - because the current generation solves them.
Fake registration prevention
Fake user signup detection stops registration farms that create accounts in bulk from rotating IPs and disposable inboxes. Signup velocity and device reuse expose the batch even when every account looks distinct.
Account farming and spam accounts
Spam account prevention starts at the door: accounts created to post spam, harvest data or abuse your API are flagged before creation, so moderation is not your first line of defence.
Seeing the same person return for another trial? See free trial abuse prevention, or disposable email detection for temporary-mail signups specifically.
What basic checks miss.
A CAPTCHA, an email check and rate limiting each stop one narrow behaviour. Current signup bots run real browsers, solve challenges and rotate addresses, so none of the three sees them.
| Registration pattern | Trueguard | CAPTCHA | Email validation | Rate limiting |
|---|---|---|---|---|
| Headless browser or automation framework | ||||
| CAPTCHA solved by a paid solving service | ||||
| Bulk registrations from rotating residential IPs | Partial | Partial | ||
| Disposable or aliased email address | ||||
| Datacenter or Tor origin | ||||
| Real browser driven by a script at human speed |
Check if your product is targeted by temporary emails.
Enter your domain to see how many of your emails landed in public disposable inboxes we monitor around the clock.
Example report
Live in an afternoon.
Install the JavaScript snippet to collect a verification ID on your signup page, then call one REST endpoint from your backend. You get the risk score, the matched signals and the rule action in the response.
POST /v2/event
{
"eventId": "0198b326-025b-7c30-8605-b99796c5e953",
"action": "block",
"scores": { "risk": 0.96, "bot": 0.97 },
"signals": {
"disposable_email": {},
"multiple_accounts_per_device": {}
},
"ip": {
"address": "1.2.3.4",
"privacy": { "vpn": false, "proxy": true, "datacenter": true, "tor": false }
},
"email": {
"email": "kj29fk@tempmail.dev",
"disposable": true
},
"fingerprint": {
"identifier": "7f56c04d-4652-471b-b5dd-426ad3bd9504",
"userAgent": "Mozilla/5.0 (X11; Linux x86_64) HeadlessChrome/139.0.0.0",
"incognito": true
}
}One snippet, one endpoint
No SDK sprawl and no changes to your auth flow. Drop the script in, call the API where you create the account.
Decide in your own code
Trueguard returns the risk score, the bot score and the matched signals. Whether that blocks, throttles or flags the registration stays your call.
No friction for real users
Detection is passive, so you can retire the CAPTCHA. Genuine signups see nothing - no puzzle, no extra step, no added latency they can notice.
The cost of leaving it alone.
10-60 hrs
per week
Support and moderation overhead
1-3 FTEs
ongoing
Engineering time on in-house bot heuristics
$5K-$75K
per month
Infrastructure overages from bot traffic
$25K-$200K
per year
Revenue decisions made on diluted metrics
Frequently asked questions.
Fake accounts, bot signups and what detection does to your registration flow.
Keep reading
Disposable email detection
Block temporary and alias inboxes at signup with a continuously updated domain registry.
Free trial abuse prevention
Detect the same person returning for another trial under a new email address.
What are JA4 and JA4T fingerprints?
How TLS-level fingerprints identify a device even behind a VPN or a fresh browser profile.
