someone made 60 accounts with dotted and plus-addressed gmail to farm my free trial

Normalise the address before you store it, and specifically for consumer Gmail: dots in the local part are ignored by Gmail, so all those dotted variants are the same mailbox, and everything after a plus is a tag on the same mailbox. Strip both, store the normalised form in a separate column with a unique index, keep the original for sending.

That single change kills the lazy version of this attack, which is the version you have. Someone who then goes and registers sixty real mailboxes on different domains is a different and much rarer problem.

One warning: the dots rule is a consumer Gmail behaviour. On a Google Workspace domain, dots are significant and two addresses differing by a dot can be two different people. Apply the rule to gmail.com and googlemail.com only, never as a general email rule.

Counting accounts is the wrong control. Meter the expensive thing.

An unlimited trial protected by identity checks is fragile because identity is cheap to fake. A trial with a hard unit cap is robust because the cap is what costs you money - twenty runs, or a hundred megabytes processed, or five reports, whatever your unit is. Sixty accounts against a twenty run cap costs you twenty runs sixty times only if the attacker actually bothers, and most do not because the payoff per account collapses.

Stack cheap signals underneath rather than one strict rule: normalised email, a counter per network block, and a device signal. None of them alone should block anything. Two or three together should slow the account down - queue their jobs behind everyone else's, cut their concurrency to one - rather than refuse them. A real customer who trips the rules experiences a slow tool and emails you. An abuser experiences a worthless tool and leaves.

The unasked question here is whether the card-free trial is earning its keep at all.

Putting a card on file removes almost all of this in one move, because the attacker needs a new card per account rather than a new mailbox. You will lose signups. The question is whether you lose customers, and those are different things - a lot of what a no-card trial buys you is a bigger number on your dashboard.

Before you build fingerprinting, go and look at your trial to paid rate. If 30 signups a month produce two customers, then the 28 were never revenue and defending them from abuse is defending a vanity metric.

If a card ever enters the picture, use the fingerprint your processor gives you on the payment method. It identifies the same card number across different customer records, which is exactly the signal you want for someone cycling accounts to re-run a trial - same card, four customers, four trials.

It is a much better signal than email or IP because a card is the one thing that is genuinely expensive to get more of. Just remember it is per card number, so a new virtual card from the same person is a new fingerprint.

Normalise gmail addresses, cap the unit that costs you money, degrade rather than block. Everything else is a weekend spent building a fraud team for a 40 problem.

Added a disposable domain blocklist and I want to be honest about how that went, because it gets recommended a lot.

It blocked plenty of throwaway addresses, and it also blocked two real customers using privacy relay addresses, both of whom emailed me confused rather than trying again. Those lists have false positives baked in because they cannot distinguish a burner from a person who cares about their inbox.

If you use one, do not block at signup. Flag the account, let them in, and apply the tighter usage cap. You keep the customer and the abuser still gets nothing worth having.