How being a cheaper alternative opens yourself to abuses – and how we improved our platform to protect ourselves

Being a cheaper alternative in a competitive space means you inevitably become a target of abuse for those who are using you because they have been rejected by the more reputable providers. Nevertheless, it does not mean that we have to be the “bottom-feeders”. We provide a decent and reliable platform for people and businesses who don’t want to pay thousands of dollars a month just to “park” their email lists – for an affordable price.

Sure, we don’t have lots of features, but we have enough. Half of our customers never had the time to design their “automated sequence” nor choosing their email templates from a huge library of “1000+ well-designed email templates” when all they want is their emails to have the same design as their own websites.

But at the end of the day, we still get abused.

Recently we received a series of sign-ups, all coming from the same country, they all signed up for a paid plan and gave us a nice uptick in our MRR! I was so excited that I reached out to every one of them to see what they were planning to use Segmail for.

Then things become weird.

Firstly, one of the earlier signups contacted me for a support issue, requesting me to remove “View in Browser” button in the email template:

I know, bad English should have been the 1st red flag…

Seemed like a reasonable request so I made this optional:

Click Remove this to hide the View in Browser link in the emails received.

It must have been only 3 days since that request was made and after delivering it, I tried to contact this customer again but got this:

The bounced email.

So I tried and tried for the next few weeks, but no response. During this time, we received a few more signups from very similar domains and I gathered that they could be part of the same group/organisation. And they were all paid subscribers – all signed up under the Basic plan.

I tried reaching out to all of them but their emails all bounced like the first one. I was a little worried at this point but didn’t really do a thing.

Then it came – the dreaded AWS email:

Hello, we are shutting you down.

I usually monitor our AWS reputation dashboard closely so I pay attention to the rise in Bounce and Complaint rates. In the past, whenever this happens, it was a gradual thing where we start accumulate them over time and it hits a certain threshold before Amazon sends us that email. This time it looks like a sudden surge.

So I went and check if anyone was sending a large campaign at this time. It turned out to be one of those paid unresponsive signups – here’s how the campaign statistics looked like:

What a phishing campaign looks like / might look like.

So I immediately stopped this campaign, blocked this user, and tried to salvage our situation with AWS.

We’ve had this sort of abuses in the past, but it wasn’t so bad because most of these scam artists would only sign up for our free plan, which only has 500 emails. This person signed up for our Basic plan which gave them 100,000 emails to spam with!

But the strangest thing was even though I stopped them, and tried to contact them to see if there was a misunderstanding, they still didn’t respond or my email couldn’t reach their domains. This is starting to look shady – it has the word illegal written all over it.

In the end, my suspicions were confirmed – Stripe raised an elevated risk evaluation on each and every one of those payments:

Any SaaS business’ worse nightmare – a charge back.

Eventually, one of the payments were Disputed – the credit card owner claims that the charge was fraudulent, meaning most likely their credit card details were stolen and used by another person. When I saw the bank’s statement of dispute, it just looked like a bunch of hackers getting bored and buying domains and a bunch of other Internet services, plus some pizzas while they were at it.

Anyway, I had to get back to running a business so I just refunded their money to avoid more disputes. In addition, I’ve implemented a review queue for any new Segmail users to put their campaigns on hold for my review:

This is what you will see if a new Segmail user starts a campaign.

I’ve put off doing this for a long time, but it has come to a point where it is necessary – now I can also understand why lots of competitors out there do this as well.

Everyone who signs up will be under the review status until it is updated to approved, which means your campaigns will no longer be required to be reviewed.

This is a huge improvement to our platform because of it helps to keep our sending capabilities with AWS valid to keep our services up. This will also help us sift out the potential criminals from abusing our platform.

If you have a legitimate business and would like to try us out, sign up for an account now and try a campaign with 500 emails for free. You can contact us after you sign up and log in to the platform if you have any questions or would like to chat.

Leave a comment

Your email address will not be published. Required fields are marked *