Payments, scams and platform abuse
Free credits cost you real compute. Do you know who is spending them?
On most AI products every free request is GPU time you pay for. One operator with many accounts, a resold key or a metering bug looks like healthy growth on the signup chart and shows up only as a gross margin that keeps slipping.
Built for Usage-priced AI and API platforms with free tiers or trial credits; Head of Growth, Head of Trust and Safety, CTO, VP Engineering
The problem in numbers
What the public record shows
Every figure links to the page it came from, with its date.
7.4%
of customer sign-ups at AI companies implicated in suspected multi-account abuse, based on a Stripe analysis
stripe.com, 2026-03-10
10x
more attempted abuse at AI startups with free trials, self-serve sign-ups and direct API access than at enterprise AI products, per Stripe
stripe.com, 2026-03-10
46,000
US dollars or more per day: what one leaked cloud key could cost its owner in AI model usage, in Sysdig's 2024 worst-case estimate
sysdig.com, 2024-05-06
600,000
US dollars: the approximate value of AI model credits attackers burned through with one stolen API key at METR, a research nonprofit, in March 2026
metr.org, 2026-08-31
What you get
The deliverables
You get a fixed-scope forensic audit of your signup, payment and usage logs that sizes the loss and hands over blocking rules.
Accounts grouped by operator
Signups joined across device, network, normalized email and phone, and payment method, so a few hundred 'users' that are really a handful of people show up as such.
A loss figure finance can check
The compute cost sized separately for free-credit farming, multi-accounting, key resale and metering gaps, with the queries behind each number.
Blocking rules ready to ship
A short set of rules your engineers can put into production, each with the share of the loss it would have stopped and the number of real users it would have touched.
A written readout
A plain report for growth, finance and engineering, and a call to walk through it.
How it runs
Fixed scope; the length is agreed on a short call and set by the log period you share, start to finish
Fixed scope; the length is agreed on a short call and set by the log period you share
Scope and data
You share exports of signup, payment and usage logs for an agreed period. Nothing is installed in production.
Group and size
Accounts are grouped by the operator behind them and the loss is sized across the four leak types.
Rules and readout
Blocking rules are tested on the same data, then handed over with the report and a readout call.
Consent. Your written consent covers read-only access to the log exports you choose to share, under an agreed data-handling note. No live users are contacted or affected.
Method
How the answer is produced
Look at the person, not the account
Farming only becomes visible when accounts are grouped by the operator behind them, so the audit joins signup, payment and usage data at that level.
Your existing data only
It is forensic work on logs you already have, not a new product to integrate.
Every rule is measured both ways
Each proposed rule is measured on how much abuse it stops and how many genuine users it would have blocked.
Why Amir
Designed and led by someone who has built fraud models in production
The patents closest to this problem:
Amir is a named inventor on US 12,476,990 B2 (Method and system for early detection of malicious behavior based using self-supervised learning, filed at Skyhawk Security; granted).
Covers spotting malicious behavior in cloud activity early, without labeled examples. It is related to the audit's problem, because newly farmed accounts have no fraud history yet.
View on Google PatentsAmir is a named inventor on US 12,541,721 B2 (Method for extreme class imbalance within fraud detection, filed at NICE Actimize; granted).
Covers building a detector when the bad class is a tiny fraction of the data, which is the case for abusive operators among signups.
View on Google PatentsThese patents were filed at the companies named. They show the problems Amir has worked on; they are not Riskernel products.
Is this you
You probably need this if
- Compute cost on the free tier is rising faster than paid revenue.
- You give signup credit or a free trial and have never counted how many accounts share one device or network.
- You have seen sudden usage spikes from new accounts that burn their full credit through the API and then go quiet.
- A customer has reported a leaked or misused API key.
- Nobody has compared what your servers recorded as used with what billing charged for the same date.
Questions
Before you reach out
Do we need to install anything?
No. The audit works on exports of logs you already keep. Nothing changes in production unless your team ships the rules afterwards.
What data do you need?
Signup records, payment or card checks, and usage or billing logs for an agreed period. Scope is agreed on a short call.
Is this only about fraud?
No. Metering gaps, usage served but never billed, are usually bugs rather than attacks. The audit sizes them alongside the abuse.
Why does this matter when raising money?
Stripe's analysis puts 7.4% of sign-ups at AI companies in suspected multi-account abuse. A measured figure for your own product, with the rules that contain it, is a stronger answer to questions about user and revenue quality than an estimate.
Scope Signup and Credit Abuse Audit with Amir
Tell Amir what you run and what worries you. He replies with a short scope outline.