Hacker News Reader

Comment by sync | Hacker News Reader

> Starting June 1st, when you sign up for a Heroku account you will immediately get 550 free dyno hours. In addition, we add another 450 dyno hours for a total of 1,000 free dyno hours if you verify your identity by providing us with a valid credit card.

Any thoughts on what Heroku gets out of identity verification / credit card info?

View on HN

Heroku's free offering is a massive target for abuse - spammers/scammers abusing it to host e.g. phishing sites, but also regular developers who don't want to pay for the service and so sign up for multiple accounts just so they can run more than their usual allotment of free dynos.

Having the credit card verified and on file also greatly reduces the barrier to starting to pay for something - in my experience it's pretty common with a Heroku free account to run into something where you're just over a limit, and you end up saying "fine, I'll start paying $7/month for this right now so I can move on with my life".

I think it's mainly to prevent spam/multiple account creation. Having different CCs is harder than just multiple emails. It also makes it easy to upsell you to paid plans.

> Having different CCs is harder than just multiple emails.

Don't many banks issue virtual debit cards at negligible or even at no cost?

They do but don't they have the same address & name ? At least it confirms identity.

I'm not sure a typical bank card detail form include an address. Usually it's card number, expiry date, CVV/CSC and (optional, as some cards don't have it!) cardholder's name. Not sure about Heroku and too lazy to remember a password and log in there to check right now.

Heroku may have address fields for invoices and stuff, but I really doubt they can validate it (except for country/state) with bank, as addresses are real mess. At the very least, not automatically. So, this probably won't work for abuse prevention.

Even with virtual debit cards, this kind of data is still extremely useful from a fraud prevention point of view. Maybe you can spot a pattern that signups on one particular brand of virtual debit card from one particular IP range are most likely to be abusive. With fraud prevention, anything additional that can be used as a signal is useful.

It gets to know that you're not a scammer and using free hours for bad.

Preventing abuse is a big problem for every PaaS with a free plan.

It's probably a step toward making all free accounts require identity verification.

All the SMTP addons require credit card info, obviously to prevent spam abuse.

Reply on news.ycombinator.com