SaaS Trial Signups: How to Verify Emails and Phone Numbers Before Onboarding and Sales Follow-Up

What goes wrong with trial signups

A SaaS signup form is short on purpose, which means it's easy to fill with junk:

• Typos. The user really wanted the product and typed @gmial.com. They never get the verification email, assume your product is broken, and leave.
• Disposable addresses. Someone wants a second trial, or just doesn't want to hear from you. Ten-minute inboxes and plus-addressing tricks cover both; see plus addressing and trial abuse.
• Bots. Automated signups create accounts, trigger welcome emails to addresses that don't exist, and inflate your funnel.
• Placeholder phone numbers. If the form demands a phone, people type 1234567890.

The cost isn't just a few wasted accounts. Your welcome, verification and password-reset emails usually come from the same domain as product notifications. Bounces from junk signups count against that domain's reputation, and that is the domain you can least afford to have filtered.

At signup: what to check, what to do

Call the API from your server when the form is submitted (not from the browser, where the key would be exposed). Each email comes back valid, invalid, risky or unknown, with reasons. A reasonable policy:

Result	Action at signup
Valid	Accept
Invalid (no such mailbox, dead domain)	Reject with a clear message: "We couldn't find that mailbox. Check the spelling?"
Disposable	Reject, or accept with limits, depending on how much abuse you see
Risky: catch-all	Accept and record the likelihood grade
Risky: role address (info@, sales@)	Accept; flag for sales
Unknown / timeout	Accept, re-check later

Two rules matter most:

1. Never reject risky addresses at signup. A catch-all domain accepts mail for every address, so no checker can confirm the person. SimpleVerifier reports catch-alls as risky, never guessed valid, with a higher, medium or lower likelihood grade (how catch-all grading works). Plenty of real companies run catch-all servers.
2. Fail open on timeouts. If the check doesn't return in time, let the user in. A slow mail server isn't the user's fault.

Implementation guides: verify emails on signup in Next.js, verify emails in Supabase Auth, block disposable emails on signup. For bots, pair the check with the cheap form defences in stop fake signups.

Phone numbers on the trial form

If you ask for a phone, decide why. For a sales callback, you need a number that can connect. For SMS-based login or two-factor, you need a mobile that can receive texts.

At signup:

• Validate the format against the country's numbering plan and store it in E.164 (+14155552671). A country selector next to the field avoids most errors.
• Flag placeholders. 555-555-5555, repeated digits, straight runs like 1234567890 and reserved fictional ranges (555-01XX in North America, Ofcom's drama ranges in the UK). The free fake phone number checker shows what gets flagged; build the same rules into your form or run your list through it.
• Make it optional if you can. A required phone field doesn't produce more real numbers. It produces more fake ones.

If the number is for SMS, a live carrier lookup tells you whether a US or Canadian number is a mobile, a landline or VoIP. See check if a number is VoIP.

Clean the trial list you already have

Before you import old trials into HubSpot, a lifecycle email tool or a sales sequence:

1. Export trial users to CSV with email, phone, signup date and plan.
2. Upload to the verify page. Emails get the live mailbox check; phone columns get format checks in the same pass.
3. Remove invalid and disposable rows from marketing and sales sends. Keep them in your product database if you need the history.
4. Send risky rows in small batches, and watch bounces.
5. Dedupe on lower-cased email and on E.164 phone. The duplicate contact finder helps when people signed up twice.

If your trial list includes people from the EU, UK or Canada, check consent before marketing sends. The GDPR email consent checker and the CASL consent checker are free. If you're moving the product email to a new dedicated IP at the same time, the IP warmup schedule calculator plans the ramp. Verify the list first so warmup traffic doesn't bounce.

Scoring, not just filtering

Verification results make a good input to lead scoring:

• Business-domain email, valid → likely a real buyer; route to sales.
• Free webmail, valid → real person, maybe not a company account. See Gmail signups on a B2B product.
• Catch-all, higher likelihood → probably real; treat as valid for onboarding, cautious for cold sales email.
• Invalid phone, valid email → reach out by email only.

Re-checking risky and unknown signups

The signups you let in as risky or unknown deserve a second look a few days later. Unknown results are often a mail server that was slow or rate-limiting at signup time, and a re-check usually gives a clear answer. For catch-alls, behaviour is the best evidence: a user who clicked the verification link or logged in a second time has a working inbox, whatever the domain does. Feed that back into your CRM so sales sees "confirmed by activity" rather than "risky".

For AI-assisted workflows

SimpleVerifier also runs an MCP server, so an AI assistant can verify an address or a small list in conversation, which is handy for a sales rep checking a signup before a call. Production signup checks should still go through the REST API from your backend.

What it costs

• Free: 100 checks with a Google sign-in, no card. Enough to test your integration.
• Starter, $9 a month: 2,500 email checks a month.
• Pro, $39 a month: Unlimited email verification* in uploads, phone format checks, the email finder, the API and the MCP server.
• Pro + Phone, $49.99 a month: adds 5,000 live carrier lookups a month.

*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off. API calls and phone lookups are not part of Unlimited.

See pricing and the API docs.

More reading: honeypot fields for signup bots, newsletter spam signups, phone number validation API.