Product misuse

Rupt looks at fraud and abuse not as a collection of unrelated problems in the product, such as fake signups, bots and account sharing. What we've seen from working with dozens of companies and millions of users is that the core problem is a single one: product misuse.

We've rarely seen a product with only one type of abuse. Fake signups are often followed by bad behavior like spam, scraping or card testing¹. Even when the misuse is a single type, it is often a prelude to other types of misuse², or just the bad actors testing what they can get away with in the product.

In one case we tracked, the bad actors started testing the waters with a few fake signups and a few card tests, then really unleashed the attack with over 120,000 fake signups in three months. When the product plugged a hole, they moved on to another one¹.

So we define the problem as product misuse: anyone using your product for a purpose it was not built for. Nailing the definition is important because it allows us to build a solution that addresses the root causes of the problem, rather than playing whack-a-mole with the symptoms.

We distinguish between the motive and the reason behind product misuse. The motive is the short-term goal, and the reason is the underlying philosophical reasoning. We have our own thoughts and research on the philosophical part, but will save them for another report. For most products, understanding the motive is enough to formulate a good response.

We split motives into two main categories. The first motive is maximizing gains: ordinary people squeezing more out of a product than they paid for. Examples include opening multiple accounts to take advantage of free trials and sharing an account to avoid paying for one³. It doesn't hurt when it happens in small numbers, but when it eventually spreads, the leaked revenue³ and the bad data⁴ can massively hurt a product's economics.

The second motive is malicious: someone who knowingly seeks to hurt or steal from others. We caught a scammer who built a fresh identity every day for five months to phish the brokers on a marketplace⁵. Others use face-swapping software to pass job interviews and then hand the work to someone else^6,7.

Why people knowingly put so much energy and intelligence into hurting others is a fascinating question, and not one this paper tries to answer. We care about the motive for a practical reason: it tells you how to respond. If you want to read more, reach out to us and we can share a recommended reading list.

Scams and abuse used to be rare, expensive and easy to spot. They took real technical skill to set up. Even then, the tells were obvious: broken English, clumsy fake profiles, forms filled in at inhuman speed, and so on. Now one person with an AI coding assistant can build what used to take a team. AI makes ideas come easier, execution faster and iteration inevitable.

The FBI warns that generative AI "reduces the time and effort criminals must expend to deceive their targets" and can correct the errors that used to give fraud away¹². Microsoft reports that AI "has started to lower the technical bar", so that a fake storefront now takes minutes instead of days or weeks¹³. In one study, fully AI-written phishing emails were clicked 54% of the time, as often as emails written by human experts¹⁴. AI-driven bot attacks grew 12.5 times in 2025¹⁵.

Bots also stopped looking like bots. AI agents now drive real browsers, move the cursor like a person and pass the checks built to stop scripts. Cloudflare says there is "no meaningful difference" between an AI assistant booking concert tickets and the human who would have done it¹⁶. LexisNexis reports that bots now mimic human cursor movement well enough to fool behavioral detection¹⁷. Agents still fail most of the hardest interactive CAPTCHAs¹⁸, but the gap is closing¹⁹, and this is only the beginning of browser automation.

The ultimate balance of defense is this: don't hurt the good users, and keep the bad ones out. In technical terms, precision and recall. Remember, this is a human problem, not a technical one, so you will never solve 100% of it (no one can solve humans). If you push too hard, real customers will see friction. If you push too little, misuse occurs. Getting both right takes people, time and technology. Most companies can't hire, train or adapt fast enough.

The shortage is not new. In 2003 the US government's National Strategy to Secure Cyberspace already warned of "an inability to find sufficient numbers of adequately trained and/or appropriately certified personnel"²⁰. More than twenty years later, the Government Accountability Office still reports that "a shortage of skilled workers" makes the job hard²¹, and US employers posted 514,359 cybersecurity job listings in a single year²².

Teams also don't want to be doing this. People join a company to build the product and help its users do something useful, not to spend their weeks building protections around it. And once you start, it never ends. Attackers iterate, so defenses have to keep changing too. It is a continuous journey, not a once-and-done project.

Even beyond the shortage of talent, for companies lucky enough to find well-trained people, getting a plethora of commodity vendors just to get the basic protections is a huge endeavor, and it ends up having less impact and more cost²³.

A check in the authentication flow is just one layer, and it used to be enough. But now disposable emails, synthetic identities and more get past the auth gate and then wreak havoc^25,26. Deepfakes can be streamed straight into a camera check²⁷, and deepfakes make up one in five biometric fraud attempts²⁸. Fraudsters see those as single-time checks they can easily bypass. A US phone verification can be bought for $0.26, just to name one trick²⁹.

Point-in-time checks can also be passed by a real person on purpose. Account farms pay people to sign up and verify, then sell the accounts. Researchers bought a verified US business bank account for about $350, for a company that did not exist³⁰. Once the account is theirs, the real activity begins.

Behind the point-in-time checks, most companies build a patchwork. Two or three vendors and some in-house code used to be enough. Now security teams run an average of 83 tools from 29 vendors, and more than half say the fragmentation limits their ability to respond³¹. Among fraud leaders, 80% say getting a unified view of their data is a challenge, and 85% plan to add yet another vendor³².

Adding another vendor means another integration, another translation layer, another separate call, another contract to manage. What you end up with is less a full view of the user, account, action and behavior, and more a Frankenstein's monster of data that nobody evaluates as a whole.

Letting misuse run unchecked can kill a company. If all your data is bad data, if all your leads are fake, if all your job applicants are AI agents, people leave, and that's it. Gartner projects that by 2028, one in four job candidate profiles worldwide could be fake³³. And 41% of IT, security, risk and fraud leaders say their company has already hired and onboarded a fraudulent candidate³⁴.

This cost will show up. It's hard to track, but it does. It shows up in support tickets, in data quality, in churn, in the people you hire to review cases, and in the engineering and product time spent building defenses instead of the product. Every $1 of fraud costs US financial institutions $5.75³⁵.

But you can't spend all your revenue on it either. The defenses themselves are expensive. Building fraud prevention in-house costs roughly $743,000 in year one at a million evaluations a month, and assembling point vendors about $332,000²³. At that price, many companies decide to live with the abuse.

Any real answer has to make the math work on both sides: less abuse, and a defense that costs less than the problem it solves.

The answer is not another gate. It is a system that watches behavior continuously, from signup through every action that matters, and makes the math work in favor of the product and its good users again. Identities are cheap to make and easy to throw away²⁹. But behavior is always the definitive indicator.

Research backs continuity. Browser fingerprints change often, yet can still be linked over time³⁷, and 91% of their attributes stay identical over nearly six months³⁸. Grouping accounts that act alike surfaced more than two million malicious accounts in one month at Facebook and Instagram³⁹. Even forged devices give themselves away as a group: in one ring, a key browser field was empty on every attack device and on 0.3% of real users¹.

Building a unified trust system is the first step. The second step is building an appropriate, progressive response. If you add friction to every single user, you are certain to lose good customers⁴⁰. So Rupt seeks to apply friction for a very specific purpose, at a very specific moment, in a very specific way⁴¹. The goal is to stop the misuse while leaving the good users alone, and to do it in a way that is invisible to the good users.

And it has to be priced so it doesn't break the customer's own economics. Protection that costs more than the abuse is not protection anyone will keep.

Rupt is our answer. We make AI work for you instead of against you. We are your eyes and ears in the market and on the fraud streets: watching, observing and building up knowledge across many customers and many behaviors, then turning it into a framework that keeps updating and protects your product without getting in your good users' way. The least friction possible, and the most abuse prevention possible.

What we sell is peace of mind: some of the best people in the market working as hard as they can to give you the highest level of protection and coverage. Getting the same coverage yourself would take years and far more money. Our own comparison puts year one with Rupt at 85% less than building in-house and 66% less than assembling point vendors, with integration in about four weeks²³.

We also treat user experience as a first-class concern for our customers and their end users. Good UX is surprisingly hard to find in fraud tools. A fraud leader told us recently that they were switching vendors because their current one added too much friction and a poor experience for their end users⁴².

It shows in the results. One marketplace started enforcing on 1 to 2% of traffic and tightened as each step proved safe, and its users came to see verification as a feature⁴³. Shared accounts that were challenged stayed longer than unshared ones⁴⁴. Friction with good UX feels different to the end user. It feels much more like a service than a barrier.

Measurement can be a slippery slope. In the interest of keeping the report short, we won't go into excessive detail here. But the measurement should at least cover three things: a before-and-after snapshot, how much risk you mitigated, and how good users were affected.

Rupt will specifically track the entire risk journey for a given user, give specific metrics for each step and tie the results together automatically for known misuses. For example, if account sharing is the misuse being handled, we will directly track how many sharers converted and created their own accounts. One customer uncovered $1M+ in ARR lost to account sharing, then saw more than $250,000 in new ARR in 2024 alone, directly attributable to the reduction in account sharing³⁶.

Friction is also measured. But remember, not all friction is bad. A challenge with good UX is often seen as a feature, and can even increase conversion⁴³. However, with progressive challenges, there are more difficult challenges to clear, and those should be measured. For most companies Rupt protects, the strongest challenges often only affect less than 5% of the traffic. This not only keeps good users happy but also keeps the cost of the solution down.