Malintent exists on a spectrum and in my experience operating SaaS, a credit card is indeed a good filter for users who have no intention of ever paying you.

Credit cards act as a "cost" of sorts. Credit cards are a limited resource, it is not free to acquire more credit cards. By requiring a valid credit card you are basically relying upon the verification that credit card issuers do to prevent unlimited abuse.

> Credit cards are a limited resource

> it is not free to acquire more credit cards

If a user is malicious then they quite probably have access to malicious cards too.

Moreover, you're locking out users who don't want to give you their card just to try a service.

There are probably a lot more casual trolls than there are straight up criminals with stolen credit card numbers.

Virtual cards solve this. Create a card with $1 limit. Problem solved.

In one country but this isn't an option globally

Its not free to acquire credit cards? In what country?

I constantly get free offers on the mails, plus there are services to generate temporary card numbers for throwaway

bad actors are usually looking for low friction, it’s like running away from a bear… you don’t need to be the fastest person, you just don’t want to be the slowest

You're probably not going to go through the hassle of generating or applying for 1,000 credit cards in order to abuse some trial period on a SaaS service. Maybe you do it a few times.

It's the automated bots that a CC prevents. Even with "free" credit cards or generated numbers, there's a lot of friction in going through that to abuse the service's trial period.

in my experience it’s an order of magnitude less frequent when a credit card is required