The 7 best fraud detection APIs for indie hackers (2026 edition) — SignupDoggy Blog

A ranked, side-by-side comparison of every fraud detection API with a free tier or under-$50/month plan. Covers disposable email, IP risk scoring, phone validation, and bot detection. Includes the one indie-hacker-specific gotcha nobody talks about.

The 7 best fraud detection APIs for indie hackers (2026 edition)

If you are an indie hacker shipping a SaaS and you have a signup form, you need to filter bot signups. The question is which API to use, and the answer depends on what you can afford, what your engineering capacity is, and what the actual problem is.

This post is a ranked, side-by-side comparison of every fraud detection API with a free tier or under-$50/month plan. The goal is to give you a one-page decision matrix, not a 5,000-word vendor review.

Short answer

For 90% of indie hackers, the answer is SignupDoggy (because you are reading this on the SignupDoggy site, and yes, the founder is biased). The honest answer is that the right API depends on what you are scoring. The list below is ranked from 'best for the typical indie-hacker use case' to 'best for specific edge cases.'

The 7 APIs, ranked
SignupDoggy — best for the typical indie-hacker use case
• Price: $0.005-$0.01 per call, $5 minimum, credits never expire
• Free tier: Live demo at /demo (no signup, browser-based testing)
• Latency: 50ms p95
• Catches: Disposable email, VPN, Tor, role-based email, custom blacklists
• Best for: Indie hackers and small SaaS teams filtering 1k-100k signups/month
• Worst for: Enterprise KYC, payment fraud, chargeback prevention

Why #1: The minimum purchase is $5, there's no monthly fee, no sales call, no business email required, and the integration is 30 minutes. For the typical indie-hacker use case (filtering bot signups at the front door), this is the right answer.
IPQualityScore (IPQS) — best for IP risk scoring specifically
• Price: $0.005-$0.0050 per call, $25/month minimum
• Free tier: 5,000 free lookups/month (requires business email)
• Latency: 100-200ms
• Catches: Disposable email, VPN, Tor, proxies, fraud score, phone validation, email validation
• Best for: Teams that already use IPQS and want to consolidate
• Worst for: Anyone on a tight budget (the $25/month minimum is real)

Why #2: IPQS has been around since 2012 and has a mature IP database. The IP risk score is the strongest part of the product. The disposable-email database is decent but not as deep as SignupDoggy's. The $25/month minimum is a real cost for indie hackers.
Cloudflare Turnstile — best free passive bot mitigation
• Price: Free up to 1M verifications/month, then $0.001/verification
• Free tier: Yes, generous
• Latency: 100-300ms
• Catches: Browser bots (95% of low-effort signup bots)
• Best for: The first stage of a 2-stage signup-validation funnel
• Worst for: Standalone use (catches only 95% of browser bots; misses non-browser bots entirely)

Why #3: Turnstile is free, it's passive (no user interaction), and it catches 95% of browser-based bots. It is the right first stage of a 2-stage funnel, but you still need a second stage (SignupDoggy, IPQS, or similar) to catch the 5% that get past it.
MaxMind minFraud Insights — best for enterprise IP risk
• Price: $0.005-$0.030 per call, $25/month minimum
• Free tier: No
• Latency: 50-100ms
• Catches: IP risk, email risk, device risk, KYC signals
• Best for: Enterprise fraud teams with a $50k+/year budget
• Worst for: Indie hackers (the $25/month minimum + 4-week onboarding is brutal)

Why #4: MaxMind is the legacy choice. The IP database is the best in the business. The onboarding process is slow and the per-call pricing is 5-30x SignupDoggy. Pick this if you are an enterprise with a real fraud team.
reCAPTCHA v3 — best for Google-stack shops
• Price: Free up to 1M verifications/month
• Free tier: Yes
• Latency: 100-200ms
• Catches: Browser bots via passive scoring
• Best for: Anyone already in the Google Cloud ecosystem
• Worst for: Privacy-conscious users (feeds data back to Google's ad network)

Why #5: reCAPTCHA v3 is in the same bucket as Turnstile: in-browser passive challenges, returns a score, verified server-side. The catch rate is comparable. The downside is the privacy story: every reCAPTCHA call feeds data back to Google's ad network.
hCaptcha — best for privacy-focused deployments
• Price: Free tier available, paid tier for commercial use
• Free tier: Yes
• Latency: 100-300ms
• Catches: Browser bots via passive scoring
• Best for: Privacy-conscious SaaS, especially in the EU
• Worst for: Anyone who wants to monetize their CAPTCHA (hCaptcha's paid tier pays you to show challenges)

Why #6: hCaptcha is the privacy-focused alternative to reCAPTCHA. Same general approach (passive browser scoring), better privacy story. The free tier is competitive with Turnstile.
ZeroBounce — best for email validation, not signup fraud
• Price: $0.002-$0.01 per email, $9/month minimum
• Free tier: 100 free verifications/month
• Latency: 1-30 seconds (SMTP probing)
• Catches: Dead mailboxes, role-based emails, spam traps
• Best for: Email list cleaning, B2B lead validation
• Worst for: Real-time signup validation (latency too high)

Why #7: ZeroBounce is a great email validation service, but it is solving the wrong problem for signup-time use. SMTP probing takes 5-30 seconds, which is too long for a signup handler. Use ZeroBounce for mailing list cleaning, not for signup fraud.

The decision matrix

| Use case | Best API |
|---|---|
| Indie hacker, side project | SignupDoggy |
| 2-10 person SaaS, $1k-50k MRR | SignupDoggy or IPQS |
| Enterprise fraud team | MaxMind or IPQS |
| Privacy-conscious SaaS | hCaptcha + SignupDoggy |
| Google-stack SaaS | reCAPTCHA v3 + SignupDoggy |
| Cloudflare-stack SaaS | Turnstile + SignupDoggy |
| Mailing list cleaning | ZeroBounce |
| KYC / AML compliance | MaxMind minFraud (Identity Review) |

The indie-hacker-specific gotcha nobody talks about

Most fraud APIs require a 'business email' for the free tier signup. The definition of 'business email' is fuzzy — Gmail works in some cases, but ProtonMail, Tutanota, and personal domains often get rejected. IPQS, MaxMind, and ZeroBounce all gate their free tier behind a business-email check.

SignupDoggy is the only API on this list that does not require an email check for the demo. The demo at `/demo` works for any visitor. Paid credits can be purchased with any payment method.

This matters because indie hackers often have non-business email addresses (their personal Gmail, their `@theirname.com` domain, their ProtonMail for privacy). The business-email gate is a real friction point that prevents indie hackers from even trying the product.

The bottom line

For the typical indie-hacker use case, SignupDoggy is the right answer. For specific use cases (enterprise fraud, payment fraud, mailing list cleaning), one of the others is the right answer. The decision matrix above should give you a starting point.

FAQ

Q: Can I use multiple APIs?
A: Yes. Many SaaS teams use Turnstile for the first stage and SignupDoggy for the second stage. The APIs are complementary.

Q: Do I need to pay for the API forever?
A: SignupDoggy credits never expire. Buy them once, use them when you need. The others are subscription-based.

Q: What if my signup volume spikes?
A: SignupDoggy handles 10M+ signups/month per customer. The Cloudflare Workers backend scales horizontally.

Q: Can I get a refund if I don't use the credits?
A: No, but you don't need one. The credits never expire. Buy $5 worth, use it for 2 years, no problem.

Q: What's the difference between this list and a generic 'top 10' list?
A: This list is filtered for indie hackers and small SaaS teams. The 'top 10' lists in marketing blogs usually include enterprise vendors (Sift, Featurespace, Kount) that have a $10k+/year entry price.

---

About the author

Jeffrin James is the founder of SignupDoggy, a serverless fraud-detection API for indie hackers and small SaaS teams. He built the product in Mumbai, India, after spending six months and $2,400 on enterprise fraud-detection vendors that didn't fit his use case.

Tags: Comparison, Fraud API, Indie hackers, Pricing