Claire’s post hit home. We’ve faced the same at Atlassian. Sharing some of the key actions we took below. With AI products, abuse isn't just annoying, it's expensive. Every LLM call costs real money and for small businesses this can be absolutely crippling. We got hit with stolen cards, fake trials and credit-burners. This is what helped (none of it is a silver bullet, it's a constant battle): 1. Make free trials cost something. Require a card and pre-auth it up front. Even then, we saw stolen cards and fraudsters paying just to get in the door. 2. Only let your real app talk to your backend. Verify requests actually come from your client, not just that they carry valid credentials. 3. Allow only the models you offer. Block everything else by default. Fraudsters want the latest and greatest. 4. Set hard limits per account and per org, with no overage until payment clears. It feels wrong and counterintuitive to start from "I literally don't trust you", but when needs must. 5. Bill sooner. If you charge in arrears or give a grace period on failed payments, abusers sign up with cards that won't clear, burn credits fast and vanish. 6. Use fraud tooling. Your payment provider's rules, like Stripe Radar, can flag and block suspicious accounts. 7. Watch costs daily and act fast. Suspend bad accounts and be ready to pause sign-ups. At one point we temporarily paused all new sign-ups and only sold to existing customers. 8. Restrict free trials to verified business domains. Block disposable and free email domains, and cap how many trials one domain can start. Biggest lesson: abusers adapt crazy fast. Close one door and they try another. It's a shitty game of whac-a-mole, so plan for ongoing defence, not one-off fixes.