Gmail dots, plus tags and numbered emails: the cheapest trick in free-tier abuse

One inbox, many addresses

Gmail treats dots in the part before the @ as invisible. ana.petrovic@gmail.com, anapetrovic@gmail.com and a.n.a.petrovic@gmail.com all deliver to the same inbox. Gmail also ignores everything after a plus sign, so anapetrovic+trial1@gmail.com and anapetrovic+trial2@gmail.com are the same inbox too.

Combine the two and a single inbox can produce hundreds of distinct-looking addresses. Each one passes basic email validation and each one can receive a verification link. For a product that grants free credits per address, that is hundreds of free allowances from one person.

Normalising addresses correctly

The fix starts with a canonical form of every address. For Gmail and Googlemail, remove dots and strip the plus tag, then compare. Many other providers support plus tags too, so stripping the tag is reasonable broadly, but removing dots is specific to Gmail and should not be applied to providers where dots matter.

Store both the original address and its canonical form. Use the original for communication and the canonical form for counting how many accounts belong to the same mailbox.

Numbered series

When plus tags and dots are caught, farmers move to numbered series: markoj01, markoj02, markoj03 at any provider. These are real separate inboxes, so normalisation does not help. What gives them away is the pattern: a shared stem followed by a counter, often registered within minutes of each other.

Short stems create false matches. Two unrelated people named Ana with numbers in their address are not a farm. Unfarm only links numbered addresses when the shared stem is at least seven characters long, and treats the link as a pattern rather than proof.

Disposable domains

Disposable email services hand out temporary inboxes that expire after minutes or hours. They are popular with farmers because each signup costs nothing. Unfarm checks addresses against a regularly synced list of tens of thousands of disposable domains.

A disposable address is a strong hint, but a few privacy-conscious users also use them. The safest response is usually to grant a reduced allowance or ask for a different email, not to silently block.

Why linking beats rejecting

It is tempting to reject any address with a plus sign. Do not. Plus tags are used by many honest people to filter mail, and rejecting them sends a clear message that you do not understand your users.

Instead, accept the address and link it to the existing mailbox. The first account gets the free allowance, later ones do not. The person can still use the product, and if they really need a second workspace, they can upgrade. That is fair to everyone and removes the profit from farming.

Finding past abuse

If you have been granting credits per address for a while, the abuse is already in your data. Export signup emails, normalise them, and group by canonical mailbox, numbered stem and disposable domain. Unfarm's Batch audit runs this grouping on up to ten thousand addresses at once and shows an estimated cost using your own price per free user.