Yesterday it was hijackers. Today it’s the speedrunners.

January 10, 2026

I launched a B2B app.

Within 24 hours, companies tried to hijack it.
Not users.
B2B companies with vague names, generic promises, and very specific intentions.

They signed up fast.
Too fast.

They didn’t explore.
They didn’t try to understand the product.

They went straight to one thing:
“Where do I connect Stripe?”

That was the first lesson.

Real users wander.
They click around.
They hesitate.
They get excited, then overwhelmed, then come back later.

Fraud doesn’t wander.
Fraud scans.

So I tightened the public surface.
Set guardrails.
Protected visibility.
Let people create, but not instantly broadcast chaos.

I thought that was it.

It wasn’t.

Phase 2: the speedrunners

This time it wasn’t 1 attempt.
It was 6.

Fake company names.
Fake business identities.
Very real Stripe accounts connected within minutes.

No website.
No social presence.
Instagram accounts created three days ago with two cat photos.
A “yoga experience” for 85 people that existed nowhere on earth.

And yet, payment-ready.

Again, same pattern.

Create account.
Ignore everything.
Hunt for Stripe.

Clarity became my best friend.
Watching sessions told the story better than logs ever could.

This isn’t how honest users behave.
This is how people look for valves.

So I closed them.

Hard.

No emails.
No back-and-forth.
No long explanations.

Just a clean in-app message:

“We detected suspicious activity.
Please contact the platform.”

I knew nobody would.
And if I was wrong, I’d apologize and explain.

But I wasn’t.

The uncomfortable truth

If you build something useful,
people will try to abuse it.

Not later.
Immediately.

If your onboarding is too soft,
you’re not being kind.

You’re being naïve.

Filtering early isn’t hostility.
It’s respect for your real users.

So now:

You want to activate a business?
Show me you exist.
No website, no socials, no footprint?
Fine. Then give me more context.
You’re connecting Stripe from one country
for a “local” business in a tiny village
on the other side of the world?
Cool. Explain.

Nobody is blocked by default.
But trust is earned progressively.

This app is built for people on the ground.
Not for opportunists speedrunning new products
to see what they can extract.