Photo: Rostislav Uzunov / Pexels
Stripe warns AI companies of token theft risks amid rising costs
Fraudsters are exploiting AI's unique cost structure to drain companies' budgets through fake accounts and stolen API credits, with some firms seeing fraud attempts spike over 600%.
Software used to follow a simple economic formula: spend a lot to build it, then spend almost nothing to serve each new customer. Generative AI flipped that script. Every prompt, every generated image, every agentic task costs real money to produce, and fraudsters have figured out how to make someone else pick up the tab.
Stripe is sounding the alarm on what it calls “token theft,” a fraud tactic targeting AI companies’ usage-based billing models. Criminals create fake accounts, burn through expensive API tokens or credits, and vanish before anyone can collect payment.
The numbers are staggering
AI subscription companies have experienced a 40% increase in attempted multi-account abuse over just six months. Some sectors within the AI industry have seen those attempts spike by more than 600%.
At the transaction level, AI companies face fraud rates 4.3 times higher than the average startup. Even after implementing countermeasures, that figure only drops to 2.6 times the norm.
Roughly 1 in 6 new customer signups in the AI sector is linked to token theft.
Stripe CEO Patrick Collison has described this trend as one of the most overlooked risks in the AI landscape. Automated agents, he notes, allow thieves to exhaust budgets at a pace that human fraud teams simply cannot match in real time.
The news moving money, markets, and the world—before your day starts.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
Why AI is uniquely vulnerable
Traditional software-as-a-service companies could afford to be generous with free trials. The marginal cost of one additional user rounds to zero. AI companies operate under fundamentally different economics. Every query to a large language model burns compute. Every image generation job consumes GPU cycles. Every agentic workflow chains together multiple expensive inference calls.
Stolen AI credits have real resale value on secondary markets, where buyers can access premium AI capabilities at a fraction of the retail price.
ElevenLabs, the AI voice generation company, has been on the front lines of this battle. The company reports blocking thousands of fraudulent accounts daily just to keep losses manageable.
Stripe’s response and the broader security landscape
Stripe updated its Radar fraud detection tool specifically to address the token theft problem. Radar blocked over 3.3 million high-risk registrations for just eight AI companies in a single month.
The approach targets the registration layer rather than the payment layer. Token theft requires catching bad actors before they ever reach the product, because by the time they’ve used the service, the damage is already done.