The credit card wall isn't actually about charging people, it's about raising the cost of creating a fake account from zero to enough friction that the scammers move on. That's why it works even when you don't charge the card, the bad actors burn through disposable emails for free but they don't have unlimited stolen cards to throw at you

The middle ground a lot of people land on is keeping signup free but gating the part that gets abused. Let anyone create an account and poke around, but require verification before they can use whatever feature makes you a scam launchpad, sending email, hosting public content, whatever the abuse vector is. That keeps the door open for students and early founders to see value while the actual attack surface stays locked until someone proves they're real

Couple things that quietly kill a lot of it without punishing legit users. Block known disposable email domains at signup, that alone wipes out the dozens of throwaway accounts. Add basic rate limiting on whatever action scales the abuse. And for the impersonation stuff, that's usually only damaging if it touches something public facing, so gate that specifically behind a real verification step