Token theft surge affects AI startup trials and billing
Stripe reported a surge in organized token theft targeting AI startups, with fraudsters creating fake accounts to steal computing credits worth thousands of dollars per transaction. According to the payment company's CEO, the fraud now affects one in six new sign-ups and has doubled over six months, forcing some startups to eliminate free trials.
What happened
Stripe CEO Patrick Collison reported that token theft now affects one in every six new sign-ups at AI companies using the payment platform. Fraudsters create fake accounts to steal tokens used to buy computing power, either reselling them or using them for unauthorized purposes.
Token fraud has doubled over the past six months, with attackers using automated agents to consume tokens in minutes. Traditional fraud teams cannot react fast enough to prevent the attacks.
Reported impact
AI startups face massive computing bills they never authorized, as attackers burn inference costs at machine speed. Some companies have discontinued free trial offerings due to the cost of token theft.
For eight high-growth AI businesses using Stripe's updated Radar fraud detection tool, more than 3.3 million risky sign-ups were blocked in a single recent month.
Index analysis
The attack vector exploits the economics of AI services, where sign-ups include valuable compute tokens that differ from traditional software trials. Fraudsters leverage automated agents to consume these tokens faster than human fraud teams can respond.
Governance controls
Stripe expanded its Radar fraud detection system to scan sign-ups and usage in real time, assigning risk scores based on IP addresses, email domains, and device fingerprints. ElevenLabs and Lovable have deployed the updated tool.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.