The dashboard shows a signup spike — 4,000 new accounts over the weekend. Growth is thrilled; someone posts a rocket emoji. Two weeks later the infrastructure bill arrives, and it’s a rocket too: those accounts burned through your free tier’s LLM tokens, sent 300,000 emails through your reputation, and exactly eleven of them ever opened the app again. Nobody paged anyone. Nothing “broke.” This is the attack this part is about: the one that arrives through the front door, with a valid account, looking like your best week ever.
Parts 1 through 6 were about keeping attackers out — isolating tenants, verifying identities, signing webhooks, rehearsing for the breach. Abuse is the inversion: the attacker’s account is legitimate, their login succeeds, their requests are well-formed. The 2026 backdrop makes it stranger: automated traffic crossed 53% of all web traffic last year (bad bots alone are 40%), AI-enabled bot attacks grew twelve-fold in a year, and agentic-AI traffic grew by a factor of seventy-eight. Your funnel metrics are counting machines. The discipline of this part is deciding which ones are worth their keep.
Farming is a margin business
Start with the attacker’s spreadsheet, because it’s simpler than yours. A free account costs an email address (fractions of a cent, disposable domains by the thousand), a solved challenge (a cent or two at a CAPTCHA farm), and seconds of compute. What it yields is whatever your free tier gives away: LLM tokens, compute minutes, email sends, storage, API quota, referral credits. Farming is profitable while value extractable exceeds cost of creation — and every defense you deploy works by moving one side of that inequality:
This framing matters because it tells you what winning looks like. You will never stop every fake account — Arkose’s late-2025 telemetry has fake account creation at 46% of all fraudulent activity they observe, and Stripe blocked half a million fake signups on its own platform in just five months of 2025. Winning is making each fake account a bad investment: enough friction that creation isn’t free, and tight enough caps that a successful farm harvests pennies. The free tier is a marketing expense; abuse engineering is making sure it’s not also an arbitrage opportunity.
Know your four abusers
Abuse is not one attack, and the defenses don’t transfer. The taxonomy worth internalizing:
- The trial farmer — multi-accounts to aggregate free quota, resell it, or launder it into the paid product. Their signature is velocity (many signups per IP, ASN, or device) and sterility (accounts that never behave like a curious human).
- The credential stuffer — replays leaked username/password pairs against your login. Cloudflare’s network catches 6.9 billion suspicious login attempts per day; Microsoft reports 97% of identity attacks are still password spray or brute force, with 85% of targeted usernames already sitting in known breach dumps. Success rates are fractions of a percent — which, times a billion, is a business.
- The scraper — harvests your content, pricing, or your customers’ data through your own UI and API. AI training crawlers are the polite end of this spectrum; the impolite end is your competitor’s price-intelligence pipeline. 27% of bot attacks now target APIs, not pages.
- The promo and payout abuser — farms referral bonuses, discount codes, and anything else your growth team pays out. Their natural predator is Part 4’s billing pipeline, which is also where their cousins — the card testers — already live.
Friction is a budget
Every anti-abuse control costs conversion, so spend friction the way you spend money: deliberately, and where it hurts the attacker more than the user. The ladder, bottom to top:
The lower rungs are nearly free and stop only the laziest automation; the top rungs — card on file, phone verification, KYC — genuinely raise the attacker’s costs and genuinely bounce real users. The design rule: climb only as high as your cost of goods demands. A free tier serving static content can live at rung two. A free tier serving LLM tokens at real COGS cannot — which is why the industry converged on “card required, not charged” for exactly that class of product. The tooling has also matured past the blurry-text CAPTCHA: invisible challenges (Turnstile and friends), disposable-email screening, and risk-scored signups now come bundled — Cloudflare shipped exactly this combination as Account Abuse Protection in early 2026, pitched around the right slogan: the question is no longer “bot or not” but “trust or not.”
Detection beats prevention
Here is the counterintuitive heart of abuse engineering: you will not keep them out, so build to find them fast and expire them cheaply. The signals are cheap to collect and devastating in combination — signup velocity per IP and ASN, disposable or leaked credential quality at registration, device fingerprints, residential-proxy usage, account age versus action (a two-minute-old account exporting data is not a power user), and impossible travel. Feed them into a per-account risk score that routes to graduated actions:
Note the two details that separate practiced teams from scripts. Throttle beats ban: an instant ban is feedback — it tells the farm exactly which signal caught them, and the next wave arrives adjusted. A silently capped account teaches nothing and still costs the farm its setup time. And ban in waves: batch the evictions, vary the timing, and never explain. This is also where the series reconnects — the audit event stream from Part 3 is the substrate these signals are computed from, and Part 1’s tenant isolation caps the blast radius when an abuser does get deep. Abuse is steady-state, not an incident (Part 6); but keep a runbook for the day the farm finds your payout endpoint, because that’s the day it becomes one.
Your users’ passwords are your roadmap
The final piece is the one teams most want to disown: account takeover. When an attacker’s login succeeds with your customer’s reused password, the attacker did nothing to you — and the support tickets, the churn, and the headlines belong to you anyway. 80% of consumers say they’d stop using a service after an account takeover. So the identity work from Part 2 extends outward into defense of their credentials:
- Screen against leaked credentials at signup and login (k-anonymity APIs make this privacy-preserving); a match forces a reset, not a block page.
- Nudge MFA where it counts — it’s still over 99% effective against the bulk of these attacks, and less than 3% of identity attacks bother with the sophisticated stuff that bypasses it.
- Harden the recovery flow like it’s the login flow, because to the attacker it is: password-reset attack rates hit 6.6% last year, and reset flows are where enumeration, weak throttling, and channel takeover (SIM swap) actually live.
- Bind sessions and alert on drift — new device plus new geography plus a sensitive action is a step-up authentication prompt, not a silent allow.
None of this is glamorous, and all of it is the difference between “our users get hacked” and “accounts on our platform get hacked.” Only one of those sentences costs you the enterprise deal.
Where the series goes next
Current thinking for the next door: key management and encryption — envelope encryption, KMS economics, and what enterprise buyers actually mean when they write “BYOK” into the questionnaire. Secure SDLC and supply-chain hygiene — the pipeline that ships the code everything else protects — is the other strong candidate. As before: the order is decided when we get there.
Practice
- Audit last month’s signups: percentage on disposable domains, per-IP/ASN velocity distribution, and email-verification completion rate. The farm has a signature; find it before your COGS invoice does.
- Compute the maximum value one free account can extract (quota × unit cost). Then compute the minimum cost of creating one account. If value > cost, adjust one side — a cap, a card wall, a delayed feature — until the inequality flips.
- Attack your own recovery flow: try to enumerate accounts via the reset endpoint, count attempts before throttling, and check whether a known-leaked password survives your signup. Three findings, one afternoon, no budget required.