In October 2026, the open-source AI coding tool OpenCode told some of its users that attackers may have accessed the OpenAI, Anthropic, and Google API keys they had stored with it.¹ Whoever holds those keys can run AI workloads billed to the owner until the owner revokes them.
Fraud like this hits AI companies harder than most software businesses. When a fake account signs up for a typical SaaS product, the extra cost is close to zero. But every request to an AI product runs on GPUs you pay for, the answer goes out within seconds, and a refund or chargeback can't bring that compute back. Stolen access is also easy to turn into cash: some underground resellers offer AI access at 70-90% off list price,² and other groups use the outputs to train competing models.
Token fraud is any way of consuming AI compute without paying for it. It shows up at four points in a user's lifecycle: when they sign up, when they pay, when they use your API, and when the payment settles.
Free trial and promo abuse: One person, thousands of accounts
AI companies hand out free tokens, trial credits, and referral bonuses per account, so fraudsters create as many accounts as they can and claim the offer on each one. Fraud teams call this multi-accounting. At one AI company, Stripe found a single user who had created more than 86,000 accounts without ever making a legitimate payment.³
Some of this comes from ordinary users signing up with a second email address. But the real loss is driven by organized rings that automate account creation. They use residential proxies (internet connections borrowed from real homes), disposable email addresses, virtual cards, CAPTCHA-solving services, and AI agents that fill out signup forms.
Rings put free credits to work in three ways: they use the compute themselves, resell the access, or run distillation attacks (sending a model huge volumes of prompts and training a competing model on its answers). Anthropic reported in February 2026 that three AI labs generated more than 16 million exchanges with Claude through about 24,000 fraudulent accounts, and that a new account took the place of each one it banned.⁴
Email confirmation, phone checks, and even ID verification struggle here, because fraudsters buy identities in bulk and each account looks clean on its own. What the accounts share is the setup behind them: the same physical devices, the same browser configurations, similar typing and navigation patterns, and overlapping networks. Those links expose the ring at signup, before it spends a single free token. In practice, that means you can:
- Recognize the same device across resets, new browser profiles, and reinstalls, and limit how many accounts on one device can claim credits.
- Group accounts that share devices, email patterns, phone numbers, or payment cards, and act on the whole group at once.
- Pay out referral bonuses only after the referred user pays or uses the product the way a normal user would.
Sardine's device intelligence and behavioral biometrics recognize repeat devices and scripted signups, and consortium data flags rings that have already hit other companies. For a deeper look, read how free trial abuse steals tokens, credits, and sometimes your model and our guide to stopping organized promo abuse.
Stolen card fraud: Compute bought with someone else's money
Some fraudsters skip the free tier and pay with stolen credit cards. They buy a subscription or a block of credits and use it or resell it, often to buyers in regions where your product isn't available. By the time the real cardholder spots the charge and disputes it, the reseller has already sold the access. Stripe found that AI startups faced 4.3 times the startup average for attempted transaction fraud in Q3 2025.⁵
Payment fraud on AI products is harder to catch than on physical goods, because no tangible goods are shipped. A retailer has hours or days between payment and delivery to review a risky order, but credits are usable the moment the payment clears. Stolen card details also tend to come with the cardholder's name and billing address, so the payment passes the basic checks your processor runs.
Payment fraud detection answers one question: does the person paying own the card? A single payment can't answer that, so a fraud model compares the card with everything else known about the buyer, checking whether:
- The name on the card matches the account.
- The email address has a history or was created this morning.
- The device's true location, behind any VPN, fits the card's country.
- The same device has tried other cards recently.
Any one of these can have an innocent explanation, so risk models weigh them together. Fraudsters also rotate stolen cards across many businesses, which makes the pattern hard for one company to see on its own.⁵ Data shared across companies helps here, because a shared network can flag a card or device that failed at another merchant last week before it reaches you.
Blocking too much costs money too. Declining good buyers loses revenue, especially when you expand abroad and local payment habits look unfamiliar to a fraud model. Digital gift card platform Prezzee, which sells instantly delivered value much like AI credits, saw approval rates rise by up to 70% in its newer markets after tuning its fraud decisions by region with Sardine. For payments that fall in between, a step-up check such as 3-D Secure, where the card's bank asks the buyer to confirm the purchase, lets a real cardholder through without blocking the sale.
Sardine's payment fraud detection scores card, U.S. bank transfer (ACH), and digital wallet payments in milliseconds, using device, behavior, identity, and network signals, and can approve, step up, or decline each one.
API key theft: When the attacker never logs in
An API key works for anyone who holds it. When one leaks, the attacker calls your API directly and your user pays for the usage. Then the real account holder disputes the charges, you absorb the refund, as well as the impact on your brand’s trust.
Most keys leak outside your own systems: in code pushed to GitHub, in mobile apps with keys built in, in container images anyone can download, and in third-party tools that store keys for their users, as OpenCode did.
Attackers hunt for them at scale: Anthropic's September 2026 threat report describes one group that downloaded 1.8 million Android apps and scanned them for embedded AI keys. It also lists what a stolen key gives an attacker: credentials to resell, compute someone else pays for, and cover, because the activity shows up under the legitimate owner's name.⁶
AI gateways, coding tools, and other products that route requests to model providers face this problem twice, since both their users' keys and the provider keys they hold for those users can leak.
How API key theft differs from account takeover
Account takeover (ATO) means an attacker logs into a user's account with stolen credentials. Fraud teams catch it by checking whether the person logging in matches the account's history: the same device, location, and behavior.
But a stolen API key skips the login entirely. Most API traffic comes from scripts and servers, so there's no browser to fingerprint and no typing or mouse movement to analyze. The two can also connect, since an attacker who gets into an account can create fresh API keys from inside it.
One idea from ATO detection still applies: consistency. Every key builds a history: the IP addresses that call it, how often, which models, at what hours, and how many tokens. A key that suddenly runs from a new country at triple its usual volume stands out against that history, even with no device to check. Per-key spending caps and IP allowlists also limit how much a stolen key can cost you before anyone notices.²
Sardine CEO Soups Ranjan outlined a practical response after the OpenCode breach:⁷
- Encrypt stored keys with a key management service, and never keep them in plain text.
- Record the IP addresses and devices you trust for each key.
- When a call with the key comes from an IP you've never seen, revoke it and email the user to log back in. The login gives you a browser you can fingerprint.
- If you recognize the device, it's a false alarm, often a trip or a new laptop, so let the user create a new key. If you don't, ask for more proof, such as a $0 card authorization or a selfie check.
Sardine's account takeover protection ties users to their devices and behavior across login and session, and bot detection throttles automated API abuse.
Chargebacks: The bill arrives after the compute is gone
Even good screening misses some fraud. When it does, the cardholder can ask their bank to reverse the charge weeks or months later, long after your GPUs have done the work. That reversal, a chargeback, costs you three ways: you lose the payment, pay a dispute fee, and have already paid for the compute. If chargebacks pile up, your processor can raise your fees, hold back part of your revenue as a reserve, or close your merchant account.
Growth adds exposure, because selling in more countries, accepting large enterprise top-ups by bank transfer, and adding Apple Pay and Google Pay each bring new fraud patterns and new fraud compliance programs.
You can decide how much of this risk to carry yourself. One option is to sell through a merchant of record (MoR), a company that acts as the legal seller on your behalf and handles payments, fraud, compliance, and disputes. Sardine Payments is an MoR with fraud protection built in, and Sardine indemnifies the fraud losses, meaning it covers them. It supports ACH for high-value payments, cards, and Apple Pay and Google Pay in hundreds of countries.
Why token fraud needs one view across signup, payment, and usage
These use cases are not separate patterns altogether. We’ve seen the same rings move back and forth between different attack MOs and targets as they constantly migrate to exploit new vulnerabilities. Stripe's data points the same way: as card fraud at AI startups fell, multi-account abuse rose.⁵ Fraud that adapts automatically to your defenses makes that switch even faster.
A tool that watches only signup, only payments, or only API usage sees a fragment of the attack, and of the data. Connecting them exposes it, because the device that farmed accounts last week can be the one reselling today, and the network calling a stolen key can trace back to the same group.
Every request your models answer costs you money, which makes fraud controls part of how you protect your margins. Treating signup, payment, usage, and settlement as one system lets you keep free credits, fast checkout, and open API access for real users while catching the fraudsters who abuse them.
Frequently asked questions
What is token fraud and why does it hit AI companies harder than other software businesses?
Token fraud is a way of consuming AI compute without paying for it. It shows up at signup through multi-account abuse, at payment through stolen cards, at the API layer through leaked keys, and at settlement through chargebacks. What makes it especially costly for AI companies is that every request runs on GPUs you pay for, the output goes out within seconds, and a refund or chargeback cannot bring that compute back. A fake account at a typical SaaS company costs close to nothing. A fake account farming AI credits costs real money on every request.
How do fraud rings abuse free trials and promo credits at AI companies?
Organized rings automate account creation using residential proxies, disposable email addresses, virtual cards, CAPTCHA-solving services, and AI agents that fill out signup forms. Each account claims the free credit offer, and the ring puts that compute to work by using it directly, reselling access at a discount, or running distillation attacks where they send a model huge volumes of prompts and train a competing model on its answers. Anthropic reported in February 2026 that three AI labs generated more than 16 million exchanges with Claude through roughly 24,000 fraudulent accounts, with a new account replacing each one that got banned. What exposes the ring is not any single account but what the accounts share. They share the same devices, browser configurations, typing patterns, and overlapping networks.
How does API key theft differ from account takeover and why is it harder to catch?
Account takeover means an attacker logs in with stolen credentials. Fraud teams catch it by checking whether the person logging in matches the account history across device, location, and behavior. A stolen API key skips the login entirely. Most API traffic comes from scripts and services. There is no browser to fingerprint and no typing or mouse movement to analyze. The attacker never has to authenticate the user. Anthropic’s September 2026 threat report describes one group that downloaded 1.8 million Android apps and scanned them for embedded AI keys, showing the scale at which attackers hunt for credentials. What still applies from account takeover detection is consistency. Every key builds a history of IP addresses, call frequency, models used, hours, and token volumes. A key that suddenly runs from a new country at triple its usual volume stands out against that history, even with no device to check.
Why does connecting signup, payment, and API usage data matter for catching token fraud?
The same rings move between attack types. Stripe’s data from 2026 shows that as card fraud at AI startups fell, multi-account abuse rose. That is exactly what you would expect from rings that shift tactics when one avenue gets closed. A tool that watches only signup, only payments, or only API usage sees a fragment of the attack and a fragment of the data. The device that farmed accounts last week can be the one reselling access today. The networks calling a stolen API key can trace back to the same group that hit your free trial last month. Connecting those signals is what exposes the ring instead of just catching one instance of it.
Sources
¹ Cybersecurity News. (2026, October 18). OpenCode security breach exposes third-party API keys of its console users. https://cybersecuritynews.com/opencode-security-breach/
² Kirk, J. (2026, September 9). Inside the underground market for AI access. Okta. https://www.okta.com/newsroom/articles/inside-the-underground-market-for-ai-access/
³ Stripe. (2026). How AI changes the fight against fraud [Conference session]. Stripe Sessions 2026. https://stripe.com/sessions/2026/how-ai-changes-the-fight-against-fraud
⁴ Anthropic. (2026, February 23). Detecting and preventing distillation attacks. https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks
⁵ Meltzer, J., & Bakouch, S. (2026, September 15). What Stripe data shows about fraud at AI startups. Stripe. https://stripe.com/blog/what-stripe-data-shows-about-fraud-at-ai-startups
⁶ Anthropic. (2026, September). Countering misuse of AI: September 2026. https://www.anthropic.com/threat-intelligence-report-september-2026
⁷ Ranjan, S. (2026, October). [LinkedIn post on AI token theft]. LinkedIn. https://www.linkedin.com/feed/update/urn:li:activity:7517339244093276161/
