What I mean is, the email used to sign up changes each time, but the same card is used to claim the free trial. Does this depend on the individual website, or do most sites follow the same rule?
It’s the card, not the email. Your processor built a fixed ID from the card number itself — new email, new account, same ID.
EMAIL ✗ ignored · CARD ✓ · DEVICE ✓ · WIRE ✓ · ADDRESS ✓ · TYPING ✓ — 11 of 12 signals survive an email change.
Below: checkers you can open now, controls you already have, and stuff you can run. Not homework.
🔍 Open these tabs — see exactly what a signup form reads off you
Run these on the machine you actually sign up from. Takes 4 minutes total.
| Open this | What you’ll see |
|---|---|
| FingerprintJS demo | Your visitor ID. Reload in incognito — same ID. That’s the point |
| EFF Cover Your Tracks | How rare your browser is, measured against millions. “1 in 250,000” = you’re trackable |
| BrowserLeaks canvas | The raw canvas hash your GPU + fonts produce |
| tls.peet.ws | Your TLS handshake, sent before any header you control. Most people have never seen this |
| Scrapfly JA3 tool | Second opinion on the same handshake |
| Supercookie demo | Favicon-cache tracking. Survives incognito, cache clear and VPN. Try to beat it |
| BotD live demo | Whether you look automated |
| Fingerprint Pro demos | Working demos of promo-abuse prevention and paywall metering — the exact thing you asked about, running live |
Do it twice: once normally, once in a fresh private window with a VPN. Compare the IDs. That comparison answers your question better than any article.
🎛️ Controls you already have but were never told about
| Want to | Do this |
|---|---|
| See which merchants got your new card number | Your bank app lists them — how VAU surfaces it |
| Stop your bank auto-sending new cards to merchants | Opt out of Account Updater — opt-out path + the contract clause that enrolled you · clause text |
| Demand your own risk file | Subject access request. What they legally must return — includes risk scores and the signals behind them |
| Fight a “the system decided” refusal | SCHUFA ruling — building the score IS the decision. Case summary · IAPP read |
| Check if fingerprinting you is even legal where you are | EDPB Guidelines 2/2023 — pixels, URL tracking and IP-only tracking all in scope. GDPR vs LGPD vs PIPL |
| Cancel without getting charged | Cancel 48h early, and cancel where you subscribed — App Store signup cancels in Apple settings, not in the app. Screenshot the confirmation |
| Know what a failed charge does | Stripe names “end of trial payment failure” as a watched abuse pattern → their own doc. Chargebacks feed cross-acquirer blacklists |
🧰 Run it yourself — clients, APIs and engines you can install today
Read your own device IDs
| Tool | What it does |
|---|---|
| devicecheck (pip) | Query and write Apple’s 2 per-device bits from Python |
| media_drm_id | Pull your Android hardware DRM ID — survives factory reset |
| widevine_id | Same ID, Flutter package |
| Raw MediaDrm call (gist) | Three lines of Kotlin + the L1/L3 security-level read |
Run the fingerprinting stack yourself
| Tool | What it does |
|---|---|
| FingerprintJS | The open-source library behind most of the web. Also ships an iOS device-ID lib |
| BotD | MIT-licensed automation detection, 100% client-side |
| JA4+ | Generate TLS/HTTP/TCP fingerprints. Implementations in Go, Rust, HAProxy, Suricata |
| fingerproxy | Reverse proxy that computes JA3/JA4/HTTP2 and forwards them as headers |
| finch | Same, plus per-request block/reroute/tarpit rules in HCL |
| OpenWPM | Point it at any site and log every fingerprinting call it makes. Princeton/Mozilla |
| Tracker Radar Collector | DuckDuckGo’s crawler behind their open tracker dataset |
Carrier APIs — the network answers for your number
| Tool | What it does |
|---|---|
| CAMARA (GitHub) | Open specs + test suites for every carrier API |
| API portfolio | SIM Swap, Device Swap, Number Recycling, KYC Match |
| Tenure API | How long a number has been yours — answered by the operator |
| Telefónica sandbox | Chain SIM Swap + Number Verify + Location + KYC in one call |
| Vodafone sandbox | Free dev access; KYC-Match now uses fuzzy logic |
Risk engines you can self-host
| Tool | What it does |
|---|---|
| radar | Real-time anti-fraud rule engine, Java. Built against promo-abuse crews, open-sourced |
| risk_engine | Decision engine on top of rule + flow engines |
| DGFraud | Runnable graph-based fraud detectors, not a reading list |
| dedupe | Active-learning record matching, field by field |
| JedAI | Full entity-resolution pipeline as separate stages |
| libpostal | Normalise addresses so “30 W 26th St” = “30 West Twenty-sixth Street” |
| lieu | Dedupe places/addresses at scale on top of libpostal |
| Datasketch / MinHash-LSH walkthrough | Near-duplicate matching across 5M records |
| SimHash implementation | 64-bit fingerprints + fast Hamming lookup |
📦 Grab-and-use data — blocklists, graphs and labelled datasets
Live blocklists (raw endpoints, drop straight into code)
| File | Notes |
|---|---|
| disposable-email-domains | Screenshot-verified, since 2014. The accurate one |
| amieiro list | Rebuilt every 15 min. Allow and deny lists, TXT + JSON |
| Chrisdbhr blocklist | TXT / JSON / XML with raw HTTP endpoints |
| eramitgupta aggregate | 110k+ domains, merged from multiple upstreams daily |
| Python package | pip install and check |
| Django integration | Pluggable domain loaders |
| 18 lists tested head-to-head | Which to trust, and what none of them catch |
Playable graph + labelled fraud data
| Dataset | What you get |
|---|---|
| Uber/Lyft Neo4j file | Accounts ↔ phones ↔ IPs. Load it and watch the linkage happen |
| Amazon fraud benchmark | 9 datasets behind one API. The winning solution rebuilt a card fingerprint from anonymised columns |
| Feedzai BAF | 6 variants of real account-opening fraud data · download |
| IEEE-CIS | 590k card-not-present transactions; card1 acts as the card identity key |
| Fraud e-commerce set | Rare public data with explicit device_id and ip_address columns |
| Sparkov generator | Synthesise your own transaction graph |
| The “magic” notebook | Kaggle winner — the magic is entity resolution on anonymised columns |
| ULB credit card set | The imbalance baseline everyone benchmarks against |
| Sparkov-generated set | 1.85M transactions, 999 customers, 2 years |
Behaviour datasets
| Dataset | What you get |
|---|---|
| CMU keystroke benchmark | 51 people × 400 reps + the 8ms polling study |
| Balabit mouse dynamics | Real mouse traces, released for an open competition |
| GREYC keystroke set | Chosen logins, not a fixed string |
| Keystroke datagen | Roll your own timing dataset |
Curated indexes to raid
| Index | Contents |
|---|---|
| Awesome Entity Resolution | Every “are these two records one person” library that exists |
| Awesome graph fraud detection | Papers + code, refreshed per conference cycle |
| safe-graph paper list | Same field, different editorial taste |
| risk-hub (CN) | Chinese risk-control knowledge base — device fingerprinting, account security, payment security |
| algorithm-and-risk-management (CN) | Weighted-edge graph in code: shared IP = +1, shared email suffix = +2 |
| GitHub topic: fraud-detection | Live feed of new tooling |
| GitHub topic: ja4 | New protocol-fingerprint implementations |
| GitHub topic: disposable-email | New blocklist sources |
📊 Survival table — 12 signals vs 3 changes
| Signal | Plain meaning | New email | New card | Fresh browser |
|---|---|---|---|---|
| Card fingerprint | Fixed ID from card number |  |
 |
|
| PAR | One code across all card versions | |
|
|
| Account Updater | Network mails new card to merchant | |
|
|
| Billing address | Normalised, “St” = “Street” | |
|
|
| Cardholder name | Fuzzy-matched, typos included | |
 |
|
| Device fingerprint | Picture of your browser settings | |
|
|
| TLS fingerprint | Handshake sent before any header | |
|
|
| IP / ASN | Who owns your connection | |
|
|
| Cookies / storage | The obvious one | |
|
|
| Behaviour | Typing rhythm, mouse path, speed | |
|
|
| Phone number | Plus how old it is with the carrier | |
|
|
| Email age | Brand-new address is itself a flag | |
|
|
Matching is not exact — locality-sensitive hashing (matching things that are close, not identical) means a browser update doesn’t wipe your profile. Tuned threshold, never published.
Per-device flags that survive a factory reset:
| Platform | Storage | Apple’s own stated use case |
|---|---|---|
| DeviceCheck | 2 bits per device, per dev team | “a free trial has been used on this device” |
| Play Integrity recall | 3 values per device | “devices that already redeemed… a free trial” |
| bit0 | bit1 | State |
|---|---|---|
| 0 | 0 | Never trialled |
| 1 | 0 | Trial active |
| 1 | 1 | Trial used up |
| 0 | 1 | Banned device |
🎯 5 real situations this changes
1. Refused a trial for a service you’ve never touched.
Flatmate or family on the same wifi and billing address already used it. Same IP, same normalised address, same device cluster. Check that before arguing with support.
2. You’re building anything with signups — shop, app, newsletter, side project.
One field, four lines of code, stops most duplicate abuse. Vendors charge thousands a month for this. It’s already sitting in your Stripe object.
3. A subscription you cancelled keeps charging a card you replaced.
Account Updater. Your bank pushed the new number to the merchant. There’s an opt-out and your bank app usually lists who got it.
4. Secondhand phone, and offers silently don’t appear.
DeviceCheck bits and Play Integrity values follow the hardware, not the account. A previous owner’s flag blocks promos on apps you never installed.
5. Support says “the system decided” and won’t explain.
In the EU/UK that’s no longer valid. SCHUFA put the obligation on whoever builds the score. A DSAR forces the file and the reasoning open.
📚 The docs behind every claim above
Vendor documentation, specs and patents. Only open these if you want to verify something.
You changed the only field nobody was reading.
!