Email verification at signup is the check that the address a user typed is real, deliverable, and owned by the person signing up, and it sits at the center of a trade every product team has to make: verify too aggressively and real users abandon the signup, verify too loosely and fake accounts flood the system. The fake accounts are not harmless. Stripe reports that 62 percent of merchants saw more disputes in 2025 from fake accounts, and the signals are consistent: shared device fingerprints, IP and ASN clusters, plus-tagged and dotted email patterns, velocity bursts, and accounts that go straight to the highest-value action. The verification step has to catch those patterns without adding friction for a real user with a real address.
What fake signups cost, and why the email is the first filter
A fake account is rarely the end goal. It is the entry point: the account that claims a signup bonus, tests a stolen card, scrapes a catalog, or sends spam from the platform. The cost shows up downstream, in disputes, chargebacks, deliverability, and support tickets from real users who cannot get through because the system is full of fakes. TransUnion's H1 2026 data found more than 8 percent of account creation attempts flagged as suspected digital fraud in 2025, up 18 percent year over year, and Sumsub put multi-step identity fraud at 28 percent in 2025, up from 10 percent in 2024.
The email address is the first filter because it is the cheapest signal to check. A disposable domain, a plus-tagged address used to create multiple accounts, a Gmail dot trick that creates a new address from an old one, these are patterns a verification check can catch in milliseconds, before the account is created. The check is not a judgment about the user. It is a question about the address: is this a real mailbox, does it accept mail, and has it been used to create accounts before. A real user with a real address passes without noticing. A fake account with a disposable address fails before it costs anything.
And the email check protects deliverability, which is the asset most teams forget they are risking. A system that creates accounts for fake addresses will send confirmation emails, password resets, and notifications to addresses that do not exist, and the bounces and spam complaints that follow damage the sender's reputation. A sender with a damaged reputation finds its mail in the spam folder for real users too, and the damage is hard to undo. Email verification at signup is not just a fraud control. It is a deliverability control, and the two are the same problem.
The verification ladder, from cheapest to strongest
Start with syntax and deliverability. A real-time check that the address is well-formed, the domain exists, and the mailbox accepts mail will catch the typos, the fake domains, and the disposable addresses, and it will do it without the user noticing. The check should run as the user types, not after they submit, because a user who is told their address is invalid after submitting the form is a user who has already decided the form is broken. A check that runs inline, with a clear message, is a check that feels like help.
Then add a confirmation step, but make it the right one. A confirmation email with a link is the standard, and it works, but it costs conversion, because it requires the user to leave the product and open their inbox. The better pattern is to let the user in immediately, with limited access, and require confirmation before they can do anything valuable: claim a bonus, make a purchase, or invite a friend.
The strongest step is a risk-based check that combines the email with the device and the behavior: the device fingerprint, the IP address, the velocity of signups from that source, and whether the account goes straight to the highest-value action. A signup that arrives with a shared device fingerprint, from an IP cluster that has created fifty accounts today, using a plus-tagged address, is not a user. It is a script, and the system should challenge it or block it, not create the account and hope. The risk score is the verification, and the email is one input to it.
Where to draw the line
Draw the line by measuring both sides: the fraud rate, the share of accounts that are fake, and the conversion rate, the share of real users who complete the signup. A step that cuts fake accounts in half and costs 2 percent of real users is a good trade. One that cuts fakes by 10 percent and costs 15 percent of real users is a bad one. Measure both weekly.
And the verification should be invisible to the real user. A real user with a real address, on a real device, with a normal signup pattern, should never see a challenge, never wait for a confirmation email to use the product, and never be asked to prove they are human. The verification exists for the fake accounts, and the fake accounts are the minority. A signup flow that treats every user as a suspect is a signup flow that loses real users to protect itself from fake ones, and the trade is not worth it.
Frequently asked questions
Should I verify email addresses at signup?
Yes, but make it invisible to real users. A real-time check for syntax, domain, and deliverability catches typos, fake domains, and disposable addresses without the user noticing. Let the user into the product immediately, and require confirmation before they can claim a bonus or make a purchase.
What are the signs of a fake signup?
Shared device fingerprints, IP and ASN clusters, plus-tagged and dotted email patterns, velocity bursts, and accounts that go straight to the highest-value action. TransUnion found more than 8 percent of account creation attempts flagged as suspected digital fraud in 2025, up 18 percent year over year.
Does email verification hurt conversion?
It can, if it is done badly. A confirmation email that gates the product costs users. The better pattern is to let the user in with limited access and require confirmation before they can do anything valuable. Measure both the fraud rate and the conversion rate weekly to find the right balance.
What is the Gmail dot trick?
A technique where a fake account creator uses dots in a Gmail address to create what looks like a new address from an old one, for example using j.ohn@gmail.com when john@gmail.com already exists. Gmail ignores dots, so the mail goes to the same inbox, but the system sees a different address. A verification check that normalizes Gmail addresses catches it.