What is Account Farming? A Guide for SaaS & Gaming Platforms to Stop Abuse

Introduction

Account farming is the large-scale creation of fake or throwaway accounts on a platform. The accounts are not meant for real use. They are "farmed" to grab free trials, sign-up bonuses, or in-game rewards, or to be sold to other people in bulk.

For SaaS and gaming companies, the damage adds up quickly. Free tiers get drained, growth metrics fill with fake users, and real customers compete with bots for the same resources. This guide explains how account farming works, the signals that expose it, and how to build a layered defense that stops farmers at sign-up without punishing genuine users.

According to Imperva's 2026 Bad Bot Report, automated traffic made up more than 53% of all web traffic in 2025, while human activity fell to 47%.

Why SaaS and Gaming Platforms Attract Account Farmers

Account farmers go where a new account is cheap to create but valuable to own. SaaS and gaming platforms often fit that description perfectly.

In SaaS, the free trial or freemium plan is the main growth engine. Each new account may unlock credits, compute time, API calls, or premium features. A farmer who can create hundreds of accounts gets the paid product for free, while your infrastructure and support teams carry the cost.

Gaming platforms face a similar problem with a different reward. Accounts can collect in-game currency, items, or ranked progress through repetitive automated play. Those assets are then sold or transferred, often on third-party marketplaces. This disrupts the in-game economy and frustrates players who earn rewards fairly.

Both industries also depend on community. Farmed accounts can post spam, inflate ratings, manipulate leaderboards, or join referral schemes. Every fake account weakens the trust that keeps real users coming back.

The Hidden Costs of Farmed Accounts

The direct cost is easy to see: free resources used by people who will never pay. The indirect costs are often larger and harder to measure.

First, your data becomes unreliable. Sign-up numbers, activation rates, and conversion funnels all include fake users. Marketing teams may keep investing in channels that bring in bots rather than buyers, because the dashboard says they perform well.

Second, operations suffer. Support teams handle tickets from abusive accounts, and engineering teams spend time on emergency blocks instead of product work. Server and email-sending costs rise with every fake user.

Third, your reputation is at risk. In gaming, players leave when bots dominate. In SaaS, spam sent from farmed accounts can damage your sending domain and your brand. A platform known as "easy to abuse" also attracts more farmers over time.

Inside the Account Farmer's Toolkit

Modern account farming is an automated operation, not a person typing into a form. Knowing the tools helps you choose controls that actually raise the farmer's costs.

Most operations combine several building blocks:

• Automation scripts and headless browsers that fill in sign-up forms at high speed
• Proxy and VPN networks, including residential proxies, that spread traffic across many IP addresses
• Disposable email services that provide inboxes long enough to receive a verification link
• Temporary or virtual phone numbers used to pass SMS verification
• CAPTCHA-solving services that use software or low-cost human labor to clear challenges

Residential proxies deserve special attention. Imperva's 2025 Bad Bot Report found that 21% of bot attacks routed through internet service providers used residential proxies. That makes automated traffic look like it comes from ordinary home connections.

Red Flags That Expose a Farming Operation

Single signals rarely prove farming on their own. Patterns across many accounts are what give it away. Look for clusters, not just individual bad users.

Common signs include:

• Sign-up bursts right after a promotion, referral bonus, or new free-tier launch
• Shared infrastructure, such as many accounts from the same IP range, hosting provider, or device
• Patterned identities, like sequential usernames or emails that differ only by a number
• Disposable or brand-new email domains across a large share of new sign-ups
• Mismatched details, such as an IP location in one country and a phone number from another
• Identical behavior, like many accounts that log in at the same time and repeat the same actions

In games, watch for asset funneling. Many low-level "worker" accounts that quickly pass items or currency to one central account is a classic farming pattern. In SaaS, watch for accounts that use the full trial quota and never return.

Why Traditional Defenses Fall Short

Many platforms still rely on a few simple controls. Each one helps a little, but farmers have learned to work around all of them.

IP blocklists struggle against rotating proxy networks, and blocking whole ranges can lock out real users who share them. Rate limits per IP are easy to bypass when traffic is spread across thousands of addresses. Basic CAPTCHAs slow down simple bots but are routinely solved by paid services.

The deeper issue is that these controls each look at one data point. Farmers only need to beat one check at a time. A stronger approach scores the whole sign-up: the connection, the email, the phone number, the device, and the behavior together.

Building a Layered Defense Against Account Farming

A layered defense makes each fake account more expensive to create. When the cost of a farmed account rises above its value, farming stops being profitable.

Layer 1: Check the connection

Start with the network. VPN & Proxy Detection flags VPNs, proxies, Tor, and hosting providers in real time. IP Location Intelligence adds country, city, and ISP context, so you can spot location mismatches.

Layer 2: Score the identity data

Next, check what the user gives you. Data Scoring & Validation scores email addresses and phone numbers for signals such as disposable inboxes, invalid numbers, and newly registered domains. You can try single checks with the free email checker and phone number validator tools.

Layer 3: Link devices and behavior

Finally, connect accounts to each other. Device fingerprinting helps reveal many accounts created from the same device, even when IPs and emails change. Behavioral signals, such as typing rhythm, form completion speed, and navigation patterns, help separate humans from scripts.

Step-by-Step: Score a Sign-Up in Real Time

The example below scores the sign-up IP and email address with the Greip API v2 before an account is created. It runs on your server, so the API key stays private.

// Node.js 18+ (built-in fetch). Keep GREIP_API_KEY in a server environment variable.
const GREIP = "https://v2.greipapi.com";
const headers = { Authorization: `Bearer ${process.env.GREIP_API_KEY}` };
async function greip(path) {
  const res = await fetch(`${GREIP}${path}`, { headers });
  const body = await res.json();
  if (!body.success) throw new Error(`Greip error ${body.code}: ${body.description}`);
  return body.data;
}
async function scoreSignup(ip, email) {
  const [ipRisk, emailRisk] = await Promise.all([
    greip(`/score/ip/${encodeURIComponent(ip)}`),
    greip(`/score/email/${encodeURIComponent(email)}`),
  ]);
  const recs = [ipRisk.recommendation, emailRisk.recommendation];
  if (recs.includes("reject")) return { action: "block", ipRisk, emailRisk };
  if (recs.includes("review")) return { action: "verify", ipRisk, emailRisk };
  return { action: "allow", ipRisk, emailRisk };
}

Both endpoints return a risk level and a recommendation of accept, review, or reject. In this sketch, any rejection blocks the sign-up, and any review adds a step such as phone verification.

You can also read specific signals. The IP response includes a security object with fields such as vpn<em>or</em>proxy.

The email response flags throwaway inboxes with is_disposable. See the IP Scoring and Email Scoring references for every field.

Using Risk Scores and Dynamic Friction

Not every risky sign-up should be blocked. A flexible policy protects revenue while keeping the door open for real users who happen to look unusual.

A simple three-tier model works well for most teams:

• Low risk: Let the user in with no extra steps.
• Medium risk: Ask for one more check, such as phone verification, or limit trial credits until the account shows normal behavior.
• High risk: Block the sign-up or hold it for review.

Protection should continue after sign-up, too. Watch for sudden quota usage, mass invites, quick asset transfers, and many accounts acting in sync. Feed confirmed abuse back into your rules so the system keeps improving.

What's Next for Account Farming

AI is changing both sides of this fight. Imperva's 2026 report describes AI agents as a new kind of internet participant that can retrieve data, execute workflows, and act on behalf of users. That makes simple "is this a bot" checks less useful on their own.

Farmers will also keep improving fake identities, with realistic names, profile photos, and consistent details across sites. The response is the same principle at a larger scale: combine many independent signals, and judge accounts by intent and behavior, not by one data point.

Teams that treat abuse prevention as an ongoing product function, with regular tuning and clear metrics, will keep farming costs high and their platforms healthy.

Frequently Asked Questions

What is account farming?

Account farming is the mass creation of fake or throwaway accounts to exploit free trials, bonuses, or in-game rewards, or to sell the accounts to others.

How do I detect account farming on my SaaS platform?

Look for sign-up bursts, shared IPs or devices, disposable email domains, patterned usernames, and accounts that use the full trial and leave. Score each sign-up with connection, email, phone, and device signals together.

Does a CAPTCHA stop account farming?

Not on its own. CAPTCHAs slow down simple bots, but farmers use solving services to get past them. Use CAPTCHAs as one layer inside a broader risk-scoring approach.

Should I block all VPN users at sign-up?

Usually not. Many real users rely on VPNs for privacy. A better approach is to treat a VPN as one risk signal and add friction only when it combines with other warning signs.

Conclusion

Account farming turns your growth incentives into a cost center. Free trials, rewards, and referral bonuses all become targets when creating an account is cheap and automated.

The fix is to make each fake account expensive. Check the connection, score the email and phone number, link devices and behavior, and use risk-based friction instead of one-size-fits-all rules. With these layers working together, you can protect your platform and keep the sign-up experience smooth for the users who matter.