We have tried both trials with and without CC - the latter is obviously more effective.

On the back-end however, this forced us to spend weeks developing an intelligent automated approval process to limit abuse (which is common).

After that, monitoring systems alert humans to suspicious trial activity for further review. So it continues to be a lot of work.

Financially, we love the idea of a true "free" trial. The abuse was the challenge but we're in a good place with it now. Customers/Potential-customers love it and so do we.

I think we are on the same boat. How to do detect abusing the service?

Multiple consecutive signups from the same IP address is one way.

But as GP said, this and other signals require coding abuse detection, and then you must find a way to enforce this.

This is not the kind of activity you want to be involved in while validating a product concept and working toward pmf.

In NZ some ISPs use cg-nat meaning that you will have many people under one public IPv4 address. Going by this logic you could ban a whole ISP in one go.

Also mobile networks have typically one public IP address.

At this point, it's a long evolved set of heuristics based on any available data. Some quick rules around IP, Country, and email provider gets you a fair bit of the way there. But like any heuristic system that evolves, tweaking can get you to something that's "good enough".

The next step would be an AI system (like the very impressive Stripe Radar (which admittedly is in a different context)) but we're not ready for that, nor would it bring us significant value over our current system. And again - we pipe things to human for things in the grey area.

Is the abuse typically just people re-signing up continually every two weeks? Or are there other super common abuses? This isn't my field and I have always detested the commonly required CC inputs for free trials, so interested to know more about the motivation from software builders.

> We have tried both trials with and without CC - the latter is obviously more effective.

More effective in initial trial signups or more effective in eventual paying clients?

It's about effort. The seller is asking you to put in the effort to enter your payment info in order to use the "free" version of the product. It's an exchange. The seller benefits because there is less friction to paying later.

The dark pattern is billing the card without consent from the user, or some weird implicit consent.

> The seller is asking you to put in the effort to enter your payment info in order to use the "free" version of the product.

Yes, and they bear the cost of the users scared away by the extra step, so it’s sort of self limiting.

> The dark pattern is billing the card without consent from the user, or some weird implicit consent.

Yes, that’s valid to call out as a dark pattern, but the parent quoted the article as saying that requiring the credit card at all is a dark pattern or at least shouldn’t be done, so this isn’t a strawman.

This is a perfectly valid thing to ask a user; it is part of a common dark pattern, but that does not mean it is itself bad; it is certainly sometimes necessary.

This is used as a dark pattern. Entering a credit card to try out a service without being able to see how you would cancel is asking a lot of faith in a service you are trying out. Asking for a credit card on signup means I've already decided you are worth it. I hope you spent a lot on marketing to prepare me.

Free trials can be limited in terms of services. Many times free trials are not necessary. If someone is willing to enter a credit they will pay a small amount.

I might be conservative here, but I will never trial a service that requests highly sensitive information and then makes me trust they won't sell that information to some third actor. Credit card first just screams "SCAMMER SITE" to me.

These days, I have a virtual credit card that allows me to change the CVC on demand, for just these kinds of services, and with that I void the use of this card for dark pattern payments immediately. If I think your service is worthy, I might give you good data.

I'm sure that when you're analyzing SaaS transactions for a year (full time), you see a lot more data than we more-select-few-who-can-discern do.

You forget this is HN, where software engineers will go off on tangent talking about how "they could have designed the airplane rotor to not crash" or something equally ridiculous. Everyone here is an expert at everything, because they wrote a blog once, or since Paul Graham is perceived to be an expert on everything, they can be too.

As you know, Bob, they let anybody on here regardless of occupation or knowledge of Phil Graham. So some random commenter could perfectly well be an aerospace engineer. Or someone that's never been employed in their whole life.

> since Paul Graham is perceived to be an expert on everything, they can be too.

ROFL.

This is HN. It’s quite common that the people commenting have deep experience in the industry.

Credit card for trial is a dark pattern from the end user's perspective for sure.

Cos, that is one more place where the end user have to risk his/her/their PII. This is especially important considering the end user is trying the product out. The person has no idea whether they will invest in it or not. Yet, the person have to worry about their information leaked when he/she/they see this company on the news for a data breach.

Also, another problem is the overhead for the company on managing this data. The security, PR situation if this gets leaked. It's expensive and unnecessary. This is a risky business unless you are a data hoarder who sells them at which point that is again bad for the end user.

what if the card transaction was handled by a well known processor? The SaaS business doesn't actually have to store the card details themselves - and this can be made clear.

Interesting question. My question again would be why?. You just transferred the responsibility from you (the SaaS company) to a well known processor. This doesn't make a data breach or data sharing avoidable/impossible.

Also, anything related to finance is always hot. And this comes back to the same thing I made in the above comment, why should an end user who is just trying it out risk all of this? It's like telling a stranger a secret of yours. You wouldn't just share a secret with a stranger just because they say "trust me", would you?

It is the company who needs the users attention, not the other way around. The users shouldn't be punished for the same.

> This doesn't make a data breach or data sharing avoidable/impossible.

this risk will always be present. Choosing a well known processor will reduce it quite a bit imho.

If you're asking why a user would take on this risk, i would say that they are getting a "free" trial in return. By having to take on this risk, the user is more conscious of using the product, and cut out the people who would just kick the tyres.

I would have to respectfully disagree though. Cos like I said, the reason why free trial is there in the first place is to entice users. There are so many products without free trials.

Again, the burden should not be in the shoulders of the end user. There is no reason for the company to ask for credit card other than data sharing, other dark patterns and spam. Like many have mentioned, spam can be dealt with better by other means. These are companies who have tried it out. I don't know what else more to say. :)

A credit card for user validation is not necessarily a dark pattern. However, it has been abused by too many services to trick people into paying. Either by forgetting to cancel, or by having an automatic fee based on usage.

From one individual user’s perspective - card upfront trials mean that there’s a good chance either (a) I don’t want the product but will be unable to cancel the account due to dark ux/cx or (b) I’ll forget about the trial period and begin being billed then go through hell to get out of it.

I much much much prefer a no ties trial, even if you restrict functionality, volume or some other thing which makes it not useable for regular workloads. It’s a trial, I only need to get a feel for if I think this will work for me, then buy or move on.

> I’ll forget about the trial period and begin being billed then go through hell to get out of it

OK, this is probably a stupid question...but when signing up for a trial of product/service X, why not put a "decide on X" item on your calendar for sometime near the end of the trial?

You’re right - that’s a no brainer everyone should be doing, but we don’t.

I provide a free trial for my product even without asking for an email address, customers can just download and test it.

From what I can tell, this works pretty well, a good amount of the ones who test the product and up purchasing (after 7 days you are prompted to purchase to continue using it).

Dont you think users with malintent abuse the platform irrespective of whether a card is on file or not?

Malintent exists on a spectrum and in my experience operating SaaS, a credit card is indeed a good filter for users who have no intention of ever paying you.

Credit cards act as a "cost" of sorts. Credit cards are a limited resource, it is not free to acquire more credit cards. By requiring a valid credit card you are basically relying upon the verification that credit card issuers do to prevent unlimited abuse.

> Credit cards are a limited resource

> it is not free to acquire more credit cards

If a user is malicious then they quite probably have access to malicious cards too.

Moreover, you're locking out users who don't want to give you their card just to try a service.

There are probably a lot more casual trolls than there are straight up criminals with stolen credit card numbers.

Virtual cards solve this. Create a card with $1 limit. Problem solved.

In one country but this isn't an option globally

Its not free to acquire credit cards? In what country?

I constantly get free offers on the mails, plus there are services to generate temporary card numbers for throwaway

bad actors are usually looking for low friction, it’s like running away from a bear… you don’t need to be the fastest person, you just don’t want to be the slowest

You're probably not going to go through the hassle of generating or applying for 1,000 credit cards in order to abuse some trial period on a SaaS service. Maybe you do it a few times.

It's the automated bots that a CC prevents. Even with "free" credit cards or generated numbers, there's a lot of friction in going through that to abuse the service's trial period.

in my experience it’s an order of magnitude less frequent when a credit card is required

If getting the card upfront is about filtering free trial users, that doesn't support the usual behaviour of charging the user immediately after the trial ends. You can use a credit card as a filter without doing that.