A card check, only when an account looks risky

Every euromail account sends from the same servers. When one account sends spam, mailbox providers don't punish that account. They punish the servers, which means everyone's mail. Nearly all the abuse we've had to stop came from free signups that cost nothing to make: a fresh address, a domain bought the same morning, a burst of phishing, then on to the next one.

We could ask every new account for a card. That would stop most of it, and it would also turn away a lot of people who just want to try us. So we ask only when an account starts to look like that pattern.

When we ask#

There are three signals:

• A new account sending to a lot of people. In its first two weeks, an account can send to up to 100 people a day other than itself. Past that, we ask.
• A domain registered in the last 30 days. Spam runs on fresh domains, because old ones have a history. We look up when each sending domain was registered.
• Bounces and complaints. When an account's recent mail bounces or draws complaints at half the rate that would get it suspended, we ask before it goes further.

If none of these apply, you'll never see the check. A team that verifies its domain and sends its normal order confirmations and password resets goes straight through.

What the check is#

Open Billing in the dashboard and click Verify card. Stripe asks for a card, your bank may ask you to confirm in its app, and you're done. We don't charge it, now or later, and it doesn't start a subscription.

Until then, mail to your own address and to your verified domains keeps going out, so nothing you're testing stops working. We email you once when the check comes up, and the overview says which signal we saw.

What the API says#

A send to someone else from an account that needs the check is refused with its own error code. The message says why and links to the check:

HTTP/1.1 403 Forbidden

{
  "error": {
    "type": "card_verification_required",
    "code": "CARD_VERIFICATION_REQUIRED",
    "message": "Verify a card before sending to other recipients. We ask for it when we see a new account sending to more than 100 people in a day. It takes a minute and nothing is charged: https://app.euromail.dev/billing/verify-card. Until then you can send to your own address and your verified domains."
  }
}

Over SMTP it's a permanent error, so your mail server won't keep retrying.

Why a card and not a charge#

We thought about charging one euro, but it would prove less than it seems. People testing stolen cards look for exactly that kind of small charge, and a stolen card pays one euro as easily as a real one. What matters is the bank prompt. It asks the cardholder to confirm, and someone holding only a stolen card number can't.

Stripe also gives us a fingerprint of the card, which we keep (we never see the number). If we suspend an account for abuse, that card can't be used to verify a new one.

A verified card isn't a payment, and it doesn't raise your sending limits. It only tells us that a real person is behind the account. You can verify one at any time from the Billing page, even if we haven't asked, and paid plans already have one from checkout.

The quickstart covers the card check along with the rest of the setup.