AI free-tier abuse and account farming
Free-tier abuse occurs when users obtain or consume allowances in ways that violate the offer's eligibility rules. Account farming is one possible mechanism: coordinated accounts repeatedly claim benefits intended for a different eligibility unit. A cluster of new accounts is a starting observation, not a verdict.
Define what the allowance actually permits
Write down the eligibility unit: person, organization, project, billing relationship, or another clearly defined entity. Record the offer version and effective dates. A detector cannot reliably enforce “one trial per organization” if entitlement records track only email addresses.
Separate abuse from a poorly scoped promotion. If the published offer permits several projects, multiple project claims may be intended behavior. Correct the entitlement design instead of silently inventing a new rule during investigation.
Build a claim-to-consumption timeline
| Record | Question it answers |
|---|---|
| Account creation and offer version | Which eligibility rule applied? |
| Allowance grant and redemption identifiers | Was a grant reused or issued more than intended? |
| Consumption and exhaustion times | Did accounts follow a coordinated sequence? |
| Reviewed linkage evidence | Why do investigators believe claims belong to the same eligibility unit? |
| Owner decision and appeal outcome | Was the suspected violation confirmed or corrected? |
Use only linkage data your organization is authorized to process. Pseudonymize identifiers in analyst exports and restrict the lookup mapping. An IP address is weak linkage: universities, companies, mobile carriers, and households can put unrelated users behind shared infrastructure.
Investigate coordination without counting it twice
Look for several independent observations, such as repeated grant sequences and aligned exhaustion timing, then test benign explanations. Several features derived from one shared IP are not independent pieces of evidence. Keep the linkage explanation visible so another reviewer can challenge it.
Synthetic example: 30 accounts sign up from one network during a workshop. They consume their allowances within an hour. That resembles coordination because it is coordinated, but it can still be authorized. A registered training event and independently eligible participants may explain the whole cluster.
Use controls with a measurable customer cost
Consider staged allowances, explicit entitlement checks, scoped consumption limits, and review for unusually linked claims. Trial each control against legitimate onboarding, including shared networks and accessibility constraints. Measure qualified users delayed or rejected alongside reviewed abuse and consumed allowances.
Provide a recovery path for legitimate customers. Keep the evidence and policy version behind a restriction; “our score was high” is not enough to resolve an appeal. Do not equate the face value of promotional credits with cash loss or upstream cost.
What a useful case contains
Include the disputed eligibility rule, affected grants, claim and usage timeline, independent linkage evidence, known counterexamples, and outcome. If eligibility cannot be established, label the case unresolved and identify the missing record.
For related controls, read LLM rate limits and budgets. For accounting, see spend anomaly analysis. The inference abuse overview distinguishes this problem from stolen-key usage.