Trial abuse and multi-account resource risk

Free trials, new-user credits, model inference, storage, messaging, proxy access, and other costly resources can be claimed through several accounts. Email checks alone struggle with this pattern because addresses are easy to replace while the same access environment can continue to appear.

A new email does not imply a new device

Different email addresses can come from one device. Legitimate households, schools, and teams can also share a device. One email address may appear across several devices. Account fields and device context answer different questions.

EchoScan supplies device, browser-environment, network, automation, and continuity context for each protected action. Customers combine that result with registration time, entitlement claims, payment, referral relationships, request velocity, and verification state to build a stronger repeat-trial policy.

Connecting a trial workflow

1. Run Browser Verifier on the trial request or resource-claim page and receive { imprint }.
2. Send the Imprint to the customer backend with the business request.
3. Query Report API v1 from the backend with a Secret API Key.
4. Read risk.status and use device continuity, Pro risk reasons, recent activity, and History according to the plan.
5. Apply trial eligibility, limits, verification, and review policy on the customer backend.

The Secret API Key stays on the server. Browser code uses the public Environment ID, and EchoScan validates exact Allowed Origins.

Applying PASS, SUSPICIOUS, and DECEPTIVE

PASS means the current visit produced no public commercial risk finding. The customer still applies its normal account, entitlement, and payment rules.

SUSPICIOUS means the visit has risk that deserves attention without reaching DECEPTIVE. A repeat-trial flow can add email or phone verification, limit costly resources, delay fulfillment, or move the request to review.

DECEPTIVE means the visit carries clearer high-risk evidence. A customer can use stronger verification and restrictions, then decide whether to deny based on account and business evidence.

EchoScan does not declare that a person is abusing a trial and does not return the customer’s final action. The risk status describes the access environment. The customer defines business eligibility.

One repeated device is not proof

Shared computers, household devices, enterprise workstations, test devices, support sessions, and legitimate returns all create repeated-device records. seen_before: true or a higher access_count should prompt additional context checks before any denial decision.

A stronger policy considers:

• how often and when the device appeared;
• whether several accounts share device or network context;
• unusual changes in the network or browser environment;
• automation or high-risk network results;
• the customer’s entitlement, payment, referral, and verification records.

Choosing Lite or Pro

Lite is a useful starting point for overall risk.status, seen-before state, access count, and core environment results. It can support simple verification and review routing.

Pro helps teams explain risk categories, inspect first and previous seen times, evaluate recent access density, review detailed network context, and investigate History. Lite and Pro share one Report Endpoint, so an upgrade keeps the integration path stable.

Continue with the developer integration flow and the Lite and Pro Report reference.

Decision questions

Should a repeated device be denied immediately?

No. A repeated device can reflect a shared computer, a legitimate return, a support workflow, or another normal situation. Use it as context and combine it with account, entitlement, payment, velocity, and verification signals.

Does EchoScan declare that a user is abusing a trial?

EchoScan reports device and access risk. The customer defines trial eligibility and makes the final allow, challenge, review, or deny decision using its own business data.

Is Lite enough for a repeat-trial workflow?

Lite provides the overall risk status, basic device continuity, browser, operating-system, and network context. Pro adds product risk reasons, first and previous seen times, network detail, recent activity, and History. The right depth depends on the policy and review process.