Trial abuse and multi-account resource risk

Free trials, new-user credits, model inference, storage, messaging, proxy access, and other costly resources can be claimed through several accounts. Email checks alone struggle with this pattern because addresses are easy to replace while the same access environment can continue to appear.

A new email does not imply a new device

Different email addresses can come from one device. Legitimate households, schools, and teams can also share a device. One email address may appear across several devices. Account fields and device context answer different questions.

EchoScan supplies device, browser-environment, network, automation, and continuity context for each protected action. Customers combine that result with registration time, entitlement claims, payment, referral relationships, request velocity, and verification state to build a stronger repeat-trial policy.

Connecting a trial workflow

1. Run Browser Verifier on the trial request or resource-claim page. After a successful Submit, receive the server-issued { imprint }.
2. Send the Imprint to the customer backend with the business request.
3. Query Report API v1 from the backend with a Secret API Key.
4. Read risk.status, device continuity, risk reasons, and available recent activity from the base Report shared by Lite and Pro. Use the separate History query, available in both Lite and Pro, for a specified time range.
5. Apply trial eligibility, limits, verification, and review policy on the customer backend.

The Secret API Key stays on the server. Browser code uses the public Environment ID, and EchoScan validates exact Allowed Origins.

Applying PASS, SUSPICIOUS, and DECEPTIVE

PASS means no risk requiring attention was found in the current visit. It does not prove identity or trial eligibility. The customer still applies its normal account, entitlement, and payment rules. A collection or Report query failure is not a PASS result.

SUSPICIOUS means the visit has risk that deserves attention without reaching DECEPTIVE. A repeat-trial flow can add email or phone verification, limit costly resources, delay fulfillment, or move the request to review.

DECEPTIVE means the visit carries clearer high-risk evidence. A customer can use stronger verification and restrictions, then decide whether to deny based on account and business evidence.

EchoScan does not declare that a person is abusing a trial and does not return the customer’s final action. The risk status describes the access environment. The customer defines business eligibility.

One repeated device is not proof

Shared computers, household devices, enterprise workstations, test devices, support sessions, and legitimate returns all create repeated-device records. seen_before: true or a higher access_count should prompt additional context checks before any denial decision.

A stronger policy considers:

• how often and when the device appeared;
• whether several accounts share device or network context;
• unusual changes in the network or browser environment;
• automation or high-risk network results;
• the customer’s entitlement, payment, referral, and verification records.

Choosing Lite or Pro

Lite and Pro use the same base Report structure, covering device continuity, current-visit risk and reasons, browser, operating system, network, and recent activity. Optional fields depend on available signals and data.

Lite and Pro both support History and optional Account Map, including new links and existing snapshot reads. Pro provides higher request allowances, rate limits, and Browser Environment capacity. History queries a specified time range; the continuity summary and recent activity in the base Report are available in both plans.

Continue with the developer integration flow and the Lite and Pro Report reference.

Decision questions

Should a repeated device be denied immediately?

No. A repeated device can reflect a shared computer, a legitimate return, a support workflow, or another normal situation. Use it as context and combine it with account, entitlement, payment, velocity, and verification signals.

Does EchoScan declare that a user is abusing a trial?

EchoScan reports device and access risk. The customer defines trial eligibility and makes the final allow, challenge, review, or deny decision using its own business data.

Is Lite enough for a repeat-trial workflow?

Lite and Pro use the same base Report structure, covering device continuity, current-visit risk and reasons, browser, operating system, network, and recent activity. Optional fields depend on available signals and data. Lite and Pro both support History and optional Account Map, including new links and existing snapshot reads. Pro provides higher request allowances, rate limits, and Browser Environment capacity. History queries a specified time range; the continuity summary and recent activity in the base Report are available in both plans.

Does PASS prove that a trial claim is eligible?

No. PASS means no risk requiring attention was found in the current visit. The customer still checks account, entitlement, payment, and verification rules. A collection or Report query failure is not PASS.