8 ms·

Of all the nasty things somebody can do with billing, I'm surprised the author leads with card-upfront trials. "Free trials should not require a credit card."

Of all the nasty things somebody can do with billing, I'm surprised the author leads with card-upfront trials. "Free trials should not require a credit card." This is opinion presented as fact. This is not a dark pattern. Totally unrestricted free trials are wonderful, you've invested a ton in your product and you want a prospective customer to experience everything. But there are legions of abusers and bad actors of all kinds. Having an opt-in to use/abuse your platform for 2 weeks is not always viable. Card up front is not a perfect filter, but it's helpful in turning this noise way down and letting you focus on helping actual prospective customers become successful with your product.

atgarone 5y ago
I'm sure that when you're analyzing SaaS transactions for a year (full time), you see a lot more data than we more-select-few-who-can-discern do.
- dinobones 5y ago
  You forget this is HN, where software engineers will go off on tangent talking about how "they could have designed the airplane rotor to not crash" or something equally ridiculous. Everyone here is an expert at everything, because they wrote a blog once, or since Paul Graham is perceived to be an expert on everything, they can be too.
  - indus 5y ago
    > since Paul Graham is perceived to be an expert on everything, they can be too. ROFL.
  - perl4ever 5y ago
    As you know, Bob, they let anybody on here regardless of occupation or knowledge of Phil Graham. So some random commenter could perfectly well be an aerospace engineer. Or someone that's never been employed in their whole life.
  - deleted 5y ago
    [deleted]
  - deleted 5y ago
    [deleted]
- encoderer 5y ago
  This is HN. It’s quite common that the people commenting have deep experience in the industry.
indus 5y ago
Dont you think users with malintent abuse the platform irrespective of whether a card is on file or not?
- kevincox 5y ago
  Credit cards act as a "cost" of sorts. Credit cards are a limited resource, it is not free to acquire more credit cards. By requiring a valid credit card you are basically relying upon the verification that credit card issuers do to prevent unlimited abuse.
  - inetknght 5y ago
    > Credit cards are a limited resource > it is not free to acquire more credit cards If a user is malicious then they quite probably have access to malicious cards too. Moreover, you're locking out users who don't want to give you their card just to try a service.
    - tshaddox 5y ago
      There are probably a lot more casual trolls than there are straight up criminals with stolen credit card numbers.
  - netizen-936824 5y ago
    Its not free to acquire credit cards? In what country? I constantly get free offers on the mails, plus there are services to generate temporary card numbers for throwaway
    - micromacrofoot 5y ago
      bad actors are usually looking for low friction, it’s like running away from a bear… you don’t need to be the fastest person, you just don’t want to be the slowest
    - function_seven 5y ago
      You're probably not going to go through the hassle of generating or applying for 1,000 credit cards in order to abuse some trial period on a SaaS service. Maybe you do it a few times. It's the automated bots that a CC prevents. Even with "free" credit cards or generated numbers, there's a lot of friction in going through that to abuse the service's trial period.
flerovium 5y ago
It's about effort. The seller is asking you to put in the effort to enter your payment info in order to use the "free" version of the product. It's an exchange. The seller benefits because there is less friction to paying later. The dark pattern is billing the card without consent from the user, or some weird implicit consent.
- SilasX 5y ago
  > The seller is asking you to put in the effort to enter your payment info in order to use the "free" version of the product. Yes, and they bear the cost of the users scared away by the extra step, so it’s sort of self limiting. > The dark pattern is billing the card without consent from the user, or some weird implicit consent. Yes, that’s valid to call out as a dark pattern, but the parent quoted the article as saying that requiring the credit card at all is a dark pattern or at least shouldn’t be done, so this isn’t a strawman.
  - flerovium 5y ago
    This is a perfectly valid thing to ask a user; it is part of a common dark pattern, but that does not mean it is itself bad; it is certainly sometimes necessary.
  - deleted 5y ago
    [deleted]
zinxq 5y ago
We have tried both trials with and without CC - the latter is obviously more effective. On the back-end however, this forced us to spend weeks developing an intelligent automated approval process to limit abuse (which is common). After that, monitoring systems alert humans to suspicious trial activity for further review. So it continues to be a lot of work. Financially, we love the idea of a true "free" trial. The abuse was the challenge but we're in a good place with it now. Customers/Potential-customers love it and so do we.
- jpomykala 5y ago
  I think we are on the same boat. How to do detect abusing the service?
  - bredren 5y ago
    Multiple consecutive signups from the same IP address is one way. But as GP said, this and other signals require coding abuse detection, and then you must find a way to enforce this. This is not the kind of activity you want to be involved in while validating a product concept and working toward pmf.
    - mahalol 5y ago
      In NZ some ISPs use cg-nat meaning that you will have many people under one public IPv4 address. Going by this logic you could ban a whole ISP in one go.
      - selcuka 5y ago
        Also mobile networks have typically one public IP address.
  - zinxq 5y ago
    At this point, it's a long evolved set of heuristics based on any available data. Some quick rules around IP, Country, and email provider gets you a fair bit of the way there. But like any heuristic system that evolves, tweaking can get you to something that's "good enough". The next step would be an AI system (like the very impressive Stripe Radar (which admittedly is in a different context)) but we're not ready for that, nor would it bring us significant value over our current system. And again - we pipe things to human for things in the grey area.
ipaddr 5y ago
This is used as a dark pattern. Entering a credit card to try out a service without being able to see how you would cancel is asking a lot of faith in a service you are trying out. Asking for a credit card on signup means I've already decided you are worth it. I hope you spent a lot on marketing to prepare me. Free trials can be limited in terms of services. Many times free trials are not necessary. If someone is willing to enter a credit they will pay a small amount.
dec0dedab0de 5y ago
A credit card for user validation is not necessarily a dark pattern. However, it has been abused by too many services to trick people into paying. Either by forgetting to cancel, or by having an automatic fee based on usage.
ssss11 5y ago
From one individual user’s perspective - card upfront trials mean that there’s a good chance either (a) I don’t want the product but will be unable to cancel the account due to dark ux/cx or (b) I’ll forget about the trial period and begin being billed then go through hell to get out of it. I much much much prefer a no ties trial, even if you restrict functionality, volume or some other thing which makes it not useable for regular workloads. It’s a trial, I only need to get a feel for if I think this will work for me, then buy or move on.
- tzs 5y ago
  > I’ll forget about the trial period and begin being billed then go through hell to get out of it OK, this is probably a stupid question...but when signing up for a trial of product/service X, why not put a "decide on X" item on your calendar for sometime near the end of the trial?
  - ssss11 5y ago
    You’re right - that’s a no brainer everyone should be doing, but we don’t.
DocTomoe 5y ago
I might be conservative here, but I will never trial a service that requests highly sensitive information and then makes me trust they won't sell that information to some third actor. Credit card first just screams "SCAMMER SITE" to me. These days, I have a virtual credit card that allows me to change the CVC on demand, for just these kinds of services, and with that I void the use of this card for dark pattern payments immediately. If I think your service is worthy, I might give you good data.
Gentil 5y ago
Credit card for trial is a dark pattern from the end user's perspective for sure. Cos, that is one more place where the end user have to risk his/her/their PII. This is especially important considering the end user is trying the product out. The person has no idea whether they will invest in it or not. Yet, the person have to worry about their information leaked when he/she/they see this company on the news for a data breach. Also, another problem is the overhead for the company on managing this data. The security, PR situation if this gets leaked. It's expensive and unnecessary. This is a risky business unless you are a data hoarder who sells them at which point that is again bad for the end user.
- chii 5y ago
  what if the card transaction was handled by a well known processor? The SaaS business doesn't actually have to store the card details themselves - and this can be made clear.
  - Gentil 5y ago
    Interesting question. My question again would be why?. You just transferred the responsibility from you (the SaaS company) to a well known processor. This doesn't make a data breach or data sharing avoidable/impossible. Also, anything related to finance is always hot. And this comes back to the same thing I made in the above comment, why should an end user who is just trying it out risk all of this? It's like telling a stranger a secret of yours. You wouldn't just share a secret with a stranger just because they say "trust me", would you? It is the company who needs the users attention, not the other way around. The users shouldn't be punished for the same.
    - chii 5y ago
      > This doesn't make a data breach or data sharing avoidable/impossible. this risk will always be present. Choosing a well known processor will reduce it quite a bit imho. If you're asking why a user would take on this risk, i would say that they are getting a "free" trial in return. By having to take on this risk, the user is more conscious of using the product, and cut out the people who would just kick the tyres.
XCSme 5y ago
I provide a free trial for my product even without asking for an email address, customers can just download and test it. From what I can tell, this works pretty well, a good amount of the ones who test the product and up purchasing (after 7 days you are prompted to purchase to continue using it).
ghusbands 5y ago
If getting the card upfront is about filtering free trial users, that doesn't support the usual behaviour of charging the user immediately after the trial ends. You can use a credit card as a filter without doing that.

atgarone 5y ago

I'm sure that when you're analyzing SaaS transactions for a year (full time), you see a lot more data than we more-select-few-who-can-discern do.

dinobones 5y ago
You forget this is HN, where software engineers will go off on tangent talking about how "they could have designed the airplane rotor to not crash" or something equally ridiculous. Everyone here is an expert at everything, because they wrote a blog once, or since Paul Graham is perceived to be an expert on everything, they can be too.
- indus 5y ago
  > since Paul Graham is perceived to be an expert on everything, they can be too. ROFL.
- perl4ever 5y ago
  As you know, Bob, they let anybody on here regardless of occupation or knowledge of Phil Graham. So some random commenter could perfectly well be an aerospace engineer. Or someone that's never been employed in their whole life.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
encoderer 5y ago
This is HN. It’s quite common that the people commenting have deep experience in the industry.

indus 5y ago

Dont you think users with malintent abuse the platform irrespective of whether a card is on file or not?

kevincox 5y ago
Credit cards act as a "cost" of sorts. Credit cards are a limited resource, it is not free to acquire more credit cards. By requiring a valid credit card you are basically relying upon the verification that credit card issuers do to prevent unlimited abuse.
- inetknght 5y ago
  > Credit cards are a limited resource > it is not free to acquire more credit cards If a user is malicious then they quite probably have access to malicious cards too. Moreover, you're locking out users who don't want to give you their card just to try a service.
  - tshaddox 5y ago
    There are probably a lot more casual trolls than there are straight up criminals with stolen credit card numbers.
- netizen-936824 5y ago
  Its not free to acquire credit cards? In what country? I constantly get free offers on the mails, plus there are services to generate temporary card numbers for throwaway
  - micromacrofoot 5y ago
    bad actors are usually looking for low friction, it’s like running away from a bear… you don’t need to be the fastest person, you just don’t want to be the slowest
  - function_seven 5y ago
    You're probably not going to go through the hassle of generating or applying for 1,000 credit cards in order to abuse some trial period on a SaaS service. Maybe you do it a few times. It's the automated bots that a CC prevents. Even with "free" credit cards or generated numbers, there's a lot of friction in going through that to abuse the service's trial period.

flerovium 5y ago

It's about effort. The seller is asking you to put in the effort to enter your payment info in order to use the "free" version of the product. It's an exchange. The seller benefits because there is less friction to paying later. The dark pattern is billing the card without consent from the user, or some weird implicit consent.

SilasX 5y ago
> The seller is asking you to put in the effort to enter your payment info in order to use the "free" version of the product. Yes, and they bear the cost of the users scared away by the extra step, so it’s sort of self limiting. > The dark pattern is billing the card without consent from the user, or some weird implicit consent. Yes, that’s valid to call out as a dark pattern, but the parent quoted the article as saying that requiring the credit card at all is a dark pattern or at least shouldn’t be done, so this isn’t a strawman.
- flerovium 5y ago
  This is a perfectly valid thing to ask a user; it is part of a common dark pattern, but that does not mean it is itself bad; it is certainly sometimes necessary.
- deleted 5y ago
  [deleted]

zinxq 5y ago

We have tried both trials with and without CC - the latter is obviously more effective. On the back-end however, this forced us to spend weeks developing an intelligent automated approval process to limit abuse (which is common). After that, monitoring systems alert humans to suspicious trial activity for further review. So it continues to be a lot of work. Financially, we love the idea of a true "free" trial. The abuse was the challenge but we're in a good place with it now. Customers/Potential-customers love it and so do we.

jpomykala 5y ago
I think we are on the same boat. How to do detect abusing the service?
- bredren 5y ago
  Multiple consecutive signups from the same IP address is one way. But as GP said, this and other signals require coding abuse detection, and then you must find a way to enforce this. This is not the kind of activity you want to be involved in while validating a product concept and working toward pmf.
  - mahalol 5y ago
    In NZ some ISPs use cg-nat meaning that you will have many people under one public IPv4 address. Going by this logic you could ban a whole ISP in one go.
    - selcuka 5y ago
      Also mobile networks have typically one public IP address.
- zinxq 5y ago
  At this point, it's a long evolved set of heuristics based on any available data. Some quick rules around IP, Country, and email provider gets you a fair bit of the way there. But like any heuristic system that evolves, tweaking can get you to something that's "good enough". The next step would be an AI system (like the very impressive Stripe Radar (which admittedly is in a different context)) but we're not ready for that, nor would it bring us significant value over our current system. And again - we pipe things to human for things in the grey area.

ipaddr 5y ago

This is used as a dark pattern. Entering a credit card to try out a service without being able to see how you would cancel is asking a lot of faith in a service you are trying out. Asking for a credit card on signup means I've already decided you are worth it. I hope you spent a lot on marketing to prepare me. Free trials can be limited in terms of services. Many times free trials are not necessary. If someone is willing to enter a credit they will pay a small amount.

dec0dedab0de 5y ago

A credit card for user validation is not necessarily a dark pattern. However, it has been abused by too many services to trick people into paying. Either by forgetting to cancel, or by having an automatic fee based on usage.

ssss11 5y ago

From one individual user’s perspective - card upfront trials mean that there’s a good chance either (a) I don’t want the product but will be unable to cancel the account due to dark ux/cx or (b) I’ll forget about the trial period and begin being billed then go through hell to get out of it. I much much much prefer a no ties trial, even if you restrict functionality, volume or some other thing which makes it not useable for regular workloads. It’s a trial, I only need to get a feel for if I think this will work for me, then buy or move on.

tzs 5y ago
> I’ll forget about the trial period and begin being billed then go through hell to get out of it OK, this is probably a stupid question...but when signing up for a trial of product/service X, why not put a "decide on X" item on your calendar for sometime near the end of the trial?
- ssss11 5y ago
  You’re right - that’s a no brainer everyone should be doing, but we don’t.

DocTomoe 5y ago

I might be conservative here, but I will never trial a service that requests highly sensitive information and then makes me trust they won't sell that information to some third actor. Credit card first just screams "SCAMMER SITE" to me. These days, I have a virtual credit card that allows me to change the CVC on demand, for just these kinds of services, and with that I void the use of this card for dark pattern payments immediately. If I think your service is worthy, I might give you good data.

Gentil 5y ago

Credit card for trial is a dark pattern from the end user's perspective for sure. Cos, that is one more place where the end user have to risk his/her/their PII. This is especially important considering the end user is trying the product out. The person has no idea whether they will invest in it or not. Yet, the person have to worry about their information leaked when he/she/they see this company on the news for a data breach. Also, another problem is the overhead for the company on managing this data. The security, PR situation if this gets leaked. It's expensive and unnecessary. This is a risky business unless you are a data hoarder who sells them at which point that is again bad for the end user.

chii 5y ago
what if the card transaction was handled by a well known processor? The SaaS business doesn't actually have to store the card details themselves - and this can be made clear.
- Gentil 5y ago
  Interesting question. My question again would be why?. You just transferred the responsibility from you (the SaaS company) to a well known processor. This doesn't make a data breach or data sharing avoidable/impossible. Also, anything related to finance is always hot. And this comes back to the same thing I made in the above comment, why should an end user who is just trying it out risk all of this? It's like telling a stranger a secret of yours. You wouldn't just share a secret with a stranger just because they say "trust me", would you? It is the company who needs the users attention, not the other way around. The users shouldn't be punished for the same.
  - chii 5y ago
    > This doesn't make a data breach or data sharing avoidable/impossible. this risk will always be present. Choosing a well known processor will reduce it quite a bit imho. If you're asking why a user would take on this risk, i would say that they are getting a "free" trial in return. By having to take on this risk, the user is more conscious of using the product, and cut out the people who would just kick the tyres.

XCSme 5y ago

I provide a free trial for my product even without asking for an email address, customers can just download and test it. From what I can tell, this works pretty well, a good amount of the ones who test the product and up purchasing (after 7 days you are prompted to purchase to continue using it).

ghusbands 5y ago

If getting the card upfront is about filtering free trial users, that doesn't support the usual behaviour of charging the user immediately after the trial ends. You can use a credit card as a filter without doing that.