yute/blog/Signup fraud signals
Signup fraud: the signals worth checking before onboarding
Fraud is cheapest to stop before the account exists. At signup there is no chargeback to reverse, no support ticket to answer, no free tier already consumed and no poisoned data in your warehouse. Every signal you can check later is also available at signup: the difference is what acting on it costs.
This is a practical list of signup-time signals, what each one actually tells you, and how to combine them without punishing legitimate users.
1. Email legitimacy
Start with the address itself. Three things matter:
- Disposable or not. Throwaway providers sell mailboxes that work today and die on Friday. They are a strong signal when combined with other anomalies.
- Free versus corporate. A consumer provider is not fraud by itself, but "I work at Acme" with a personal address deserves a second look.
- Deliverability. Syntax and MX are not enough. A real SMTP handshake tells you whether the mailbox exists and whether the domain accepts everything (catch-all) or rejects unknown recipients.
Validating before the account is created also protects your own sender reputation: bounces from your welcome email push the domain toward the spam folder for legitimate recipients too.
2. Domain age and mail infrastructure
When a user claims to represent a company, the company domain becomes evidence. Two checks cover most of it:
- Registration age. A "logistics company" whose domain was registered twelve days ago is not necessarily fraud, but it is not an established business either.
- MX records. Real companies receive email. Domains without working mail servers are a common mask for temporary fronts.
3. Identity mismatch
Does maria.silva@acmecorp.com look like the Maria Silva who exists on the professional web? Does the claimed role match the domain's business? Mismatch is not proof, but it is one of the highest-signal checks available without asking the user for documents.
4. Web presence
Real people leave trails: professional profiles, personal sites, press mentions, public repositories. A live search across those sources returns either a coherent presence, a thin one, or none at all. Fabricated identities tend to produce the third outcome.
5. Breach exposure
Credential stuffing works because people reuse passwords. An email with recent exposure in public breaches is an account-takeover and fake-signup magnet; a brand-new inbox with no history behaves very differently. The signal is the contrast, not the raw count: treat exposure as one input among several. See yute breach.
Combining signals, not scoring in isolation
A single signal rarely justifies blocking a signup. What works is a small decision tree with three outcomes:
- Pass. Corporate domain, valid mailbox, consistent identity, coherent web presence.
- Flag for review. One or two anomalies, no clear evidence of intent: for example a new domain with a valid mailbox and a real person behind it.
- Block. Multiple independent anomalies, or one that is decisive for your business, such as a domain created this week with no mail servers.
How it fits next to background checks
| Background check | Signup checks | |
|---|---|---|
| When it runs | Before hire, after consent | At account creation |
| Speed | Hours to days | Under a second |
| Consent | Required in many jurisdictions | Not required for public signals |
| Pricing | Per report | Per lookup, free misses |
| Output | Records of past behaviour | Signals about the identity now |
Implementation
One call on the data you already collect returns the signals with their sources:
See yute fraud for the full signal list and yute KYB for the company-level equivalent.
Frequently asked questions
Why catch fraud at signup?
It is the cheapest moment. Before an account exists there is no chargeback, support cost, poisoned data or free tier abuse.
What is a disposable email signal?
A mailbox that exists briefly and is discarded. Combine it with domain age, identity match and web presence rather than using it alone.
Is a single signal enough to block a signup?
Rarely. The useful output is a set of signals with sources, so you can decide when to pass, flag or block.
How fast do these checks run?
A single lookup on the email, name and domain collected at signup can return structured signals with sources in under a second.