AI inference abuse is the use of your tokens by people you never sold them to, through stolen API keys, signup fraud or plans resold against your terms. AI inference abuse prevention acts before credits are issued, while an account uses your platform and when a relay lists your models for resale.
In payments, "token fraud" means abuse of the tokens that stand in for card numbers. On an AI platform the token is the unit of compute you sell, and the fraud is someone else consuming it. Okta Threat Intelligence studied the market for months and said "what we found breaks down into two distinct schemes: fake account sign-ups and AI account takeover." Both end in the same place, with your tokens sold on at a discount.
What is token fraud on an AI platform?
Token fraud is any route by which your compute reaches a person who did not buy it from you on your terms. It covers theft, accounts opened to abuse free credits or stolen cards, and paid plans resold to strangers.
The trade has its own market. The joint advisory from CISA, the NSA and the FBI of 8 September 2026 describes "transfer stations" that resell frontier models at a fraction of the official price, and lists the routes they use: native APIs, cloud providers, third-party aggregators, third-party relays and vendor account pools. A relay is any site or endpoint that sells unauthorised access to someone else's models. Most resell cut-price subscription access as an API.
People often call the accounts behind this fake accounts. Many are paid for with stolen cards that belong to real people, so we call them fraudulently registered accounts.
Why does token fraud cost an AI platform more than other software?
Every abused request runs on GPUs you pay for, so the loss is real money from the first token. Unlike a pirated software licence, a resold token competes with your own product for the same customer.
Stripe wrote on 15 September 2026 that "AI startups offer compute that's valuable and easy to resell, making them a particularly attractive target for fraud attacks." Stripe sells a fraud product, so read that as a vendor's view. WorkOS, which sells sign-up protection, puts the economics in one line: "creating a fake account is cheap, GPU-backed inference is expensive".
The loss shows up as compute spend, payment disputes and lost revenue.
- Compute. Abused accounts consume the same GPUs as paying customers.
- Payments. Stolen cards come back as chargebacks after the tokens are spent. Our card testing guide covers what happens next.
- Revenue. A buyer who pays a relay has no reason to pay you.
What are the four access tiers?
We sort token fraud by where the access came from: stolen or leaked access, fraudulently registered accounts, resale in breach of terms, and access whose source is unknown. The tier decides who loses money, what your terms and the law say, and which control works.
| Tier | Where the access comes from | What you see on your platform | Read |
|---|---|---|---|
| Stolen or leaked access | API keys and session tokens taken from customers who exposed them in code, apps or chatbots | A paying customer's key suddenly used from new networks, at new hours, for new work | Stolen API keys |
| Fraudulently registered accounts | Accounts opened under false or stolen details, with stolen cards, or in bulk for free credits | Sign-ups in bursts, disposable email, cards that later fail or dispute, banned users returning | Free trial abuse, ban evasion, card testing and chargebacks |
| Resale in breach of terms | Real plans used by people they were not sold to, such as a personal subscription resold as an API | One account with the traffic of many customers | Token resale |
| Access of unknown source | Tokens sold by a relay when no evidence yet settles where they came from | Your models listed on a storefront you never authorised | API relays |
How do fake sign-ups turn into token resale?
Fake sign-ups are usually the supply side of a resale business. The operation running them gathers the accounts into a pool and sells their tokens through a storefront of its own.
Anthropic's September 2026 threat report describes proxy services opening thousands of new accounts with false identities, stolen cards and stolen API keys. It also says it can require identity checks when its systems see signals of potential abuse, such as unauthorised resale. Okta found the same chain at a relay it calls Poison Claude. The relay pooled accounts opened for cloud bonus credits, took payment in cryptocurrency and, through a configuration mistake, showed nearly 900 active users.
The chain has four links, and each one is a place to break it:
- Supply. Accounts opened with false details, stolen cards or free credits, plus leaked keys and shared plans.
- Pooling. Open-source gateways put many accounts and keys behind one endpoint. Anthropic says reseller networks rotate in new stolen keys and session tokens as old ones run out.
- Storefront. A relay sells the pooled tokens as a cheap API, often with its own support and payment options.
- Buyers. People outside the regions the labs serve, people chasing a lower price, and the companies collecting training data that the US advisory describes.
Fraud prevention for AI companies works on the first three links. A sign-up check cuts supply, usage monitoring breaks up the pool, and watching the relay market finds the storefront.
Which guide covers which problem?
Each guide covers one kind of token fraud from the platform's side. Start with the one that matches what you see in your logs.
**How to detect token resale and account sharing.** For accounts and API keys that serve many customers behind one login. It covers the usage signals, gateway headers, how to confirm resale and what to do once you find it.
**Free trial abuse.** For sign-ups that exist to claim free credits. It covers what the published figures measure, why a card at sign-up invites card testing, and the order the checks belong in.
**Ban evasion.** For users you removed who come back on new accounts. It covers how a returning operation gives itself away and how to compare new sign-ups with the accounts you banned.
**Card testing and chargebacks.** For stolen cards run through your top-up or sign-up form. It covers how card testing looks on an AI platform and why the chargeback often lands after the tokens are spent.
**API relays.** For the storefronts that sell your tokens, which the market calls transfer stations. It covers how relays work, what they charge and where their tokens come from.
**Stolen API keys.** For keys your customers leak in code, apps and chatbots. It covers how a leaked key becomes a resold one and what you can do on the provider side.
**Stripe Radar for AI companies.** For teams that already use Stripe and want to know whether Radar is enough. It sets out which Radar plan scores trials and sign-ups, and what an approved account can still do with your API.
What have AI companies said about token fraud in public?
Several AI companies have described abuse of their own platforms on the record. Our cases collect what each said, with the evidence.
**Anthropic weekly limits.** In July 2025 Anthropic announced weekly limits for Claude Pro and Max and named account sharing and resale among the reasons. The case shows how resale by a few subscribers changed the plan for everyone.
**Codex subscription resale.** In August 2026 a member of OpenAI's Codex team said OpenAI does not support turning a ChatGPT plan into API traffic for others. Two months earlier its status page had recorded its fraud systems limiting real Codex accounts by mistake.
**Free tiers cut by abuse.** Six AI products, among them Cursor, ElevenLabs and Gemini CLI, cut or gated a free offer and gave abuse as the reason. The case records who paid for each change.
What to check on your platform
Run these checks against data most platforms already hold. Put the results in a review queue and tune thresholds against legitimate customer behaviour.
- Sign-ups by email domain. Count last month's sign-ups per domain and flag disposable domains and sudden bursts.
- Your heaviest accounts. For your top accounts by tokens, count parallel sessions and distinct networks per day.
- First payments that turn bad. Measure how many first top-ups later fail, refund or become chargebacks, and how many tokens those accounts used first.
- Returning users. Compare this week's new accounts with last quarter's bans on card, device and network details.
- Leaked keys. Check whether your key format is registered with GitHub secret scanning and who receives the alerts.
- Your name on storefronts. Search for your product and model names next to words such as "relay", "API" and "discount".
Where NoResponse fits
NoResponse works at each link of the chain, so one view covers sign-up, usage and the market.
| Product | Where it acts | What it covers |
|---|---|---|
| Identity Intelligence | At sign-up, login or purchase | Fraudulently registered accounts |
| Behavioural Intelligence (coming soon) | In your gateway, on every account | Resale in breach of terms, stolen or leaked access, banned users on new accounts |
| Relay Intelligence (coming soon) | In the relay market | Access of unknown source, and the accounts that feed it |
| Incident support | During an active attack | All four |
Identity Intelligence runs before a new account can spend anything. It looks up the contact details on each sign-up in 2,000+ sources of identity data from 150 countries and returns a risk score from 0 to 100 and a decision, or a pending answer that a signed webhook completes. Behavioural Intelligence, which is coming soon, will learn how each account uses your platform, then flag accounts that resell your tokens and recognise banned users who return. NoResponse does not make content-safety decisions.
Relay Intelligence, also coming soon, will show which relay and resale services sell your tokens and link each listing to the accounts and keys behind it. Incident support is hands-on help from our team while a serious attack is under way, available on request.
If you want to know which of the four tiers is costing you most, book a demo.
Everything in this series
Questions people ask
What is token fraud on an AI platform?
Token fraud is the use of an AI platform's tokens by people the platform never sold them to. It covers stolen API keys, accounts opened under false details or with stolen cards, and paid plans resold against their terms.
Are fake accounts on AI platforms the same as token resale?
No. Fake or fraudulently registered accounts are usually the supply, and resale is the business that sells their tokens on. Stopping the sign-ups cuts supply, while finding resold accounts and the relays that sell them stops the sale.
Is token fraud on AI platforms the same as payment token fraud?
No. Payment token fraud abuses the tokens that stand in for card numbers. On an AI platform the token is the unit of compute, and token fraud is someone consuming it without paying you on your terms.
How do AI companies prevent token fraud?
They check accounts at sign-up, watch usage for signs of sharing, resale and returning users, and track the relays that sell their tokens. Heavy checks such as identity verification work best on accounts that have already raised a signal.
Sources
- Inside the underground market for AI accessJeremy Kirk, Okta Threat Intelligence, 9 September 2026
- China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI CompaniesCISA, NSA and FBI, joint advisory AA26-251A, 8 September 2026
- What Stripe data shows about fraud at AI startupsStripe, 15 September 2026
- LLM token theft: how attackers drain your AI startup's bottom lineWorkOS, 12 June 2026
- Countering misuse of AI: September 2026Anthropic, September 2026, fetched 19 October 2026