Card verification with a $1 hold
that blocks SaaS signup fraud

Card testing is a fraud technique where bad actors use automated scripts to test stolen card numbers against real payment processors — validating which cards are active before using them for larger fraudulent purchases elsewhere. SaaS free trials are a particularly attractive target because the charge amount is often low (or zero) and the signup process is typically frictionless. The cost to the founder isn't always the direct financial loss from the test charge; it's the downstream impact: chargebacks when stolen-card transactions are disputed, dispute fee accumulation, and Stripe rate threshold risk.

A $1 authorization hold at signup costs almost nothing to implement but creates a significant filter. Stolen cards often have limited authorization headroom, prepaid gift cards used for fraud decline on hold attempts, and disposable virtual card numbers used for one-time signups frequently fail verification. Legitimate customers with valid cards sail through — the hold is released immediately and most never see it on their statement. The filter catches the fraud category that causes the most damage while imposing zero friction on real signups.

Disposable email addresses work as a complementary signal. Legitimate customers use real email addresses — work emails, personal gmail accounts, hosted domain emails. Fraud actors overwhelmingly use disposable domains because they want no paper trail and no follow-up. Blocking signups from known disposable domains (there are thousands, maintained in regularly updated blocklists) catches a large percentage of bot signups, trial abusers, and fraud testers before they ever interact with your product or payment system.