Another potential solution is to maintain your simple free usage flow for non-risky accounts, but require a credit card or human review for accounts which seem

Another potential solution is to maintain your simple free usage flow for non-risky accounts, but require a credit card or human review for accounts which seem risky. Determining risky accounts would have to be something you figure out by analyzing the known good/bad accounts, but depending on how easy they are to tell apart and what signals you have available it could be very powerful. I recall a conversation I once had with an early Google engineer who said they had abuse problems with the early adwords campaigns due to the ads going up in real time. Phishers would create adwords accounts with stolen credit cards to create phishing ads that would steal more credit cards (which they would use to make more adwords accounts, and so on). Human review and whack-a-mole was just too slow and didn't work. So what they did is they found a bunch of signals that correlated to the phishing accounts, if a new account triggered the signals, then the ads didn't go up in real time and were human reviewed first. So for the false positives it was a minor inconvenience, and when it worked properly it caught a bunch of the phishers before they caused damage. Even today with whatever amazing technology Google has, I believe they now human review all adwords ads... preventing abuse is hard.