What's the most annoying bot problem you've dealt with on signup or claim flows?

I'm the maker of Chirograph Verify, launching here on Tuesday, Oct 27.

It's an API that replaces CAPTCHA and SMS codes with passkey checks. The user approves on their own device (Face ID, Touch ID, a PIN, or a security key), and your backend redeems a single-use result. The browser never decides who's verified.

It doesn't prove identity or liveness, and one person can enroll several passkeys. It raises the cost of automated abuse. It doesn't eliminate it.

I'd like to learn from people who've dealt with this:

1. What kind of bot abuse have you seen (fake signups, trial abuse, credential stuffing, airdrop farming, spam)?

2. What did you try first, and what actually worked or didn't?

3. Would a passkey check fit your flow, or would requiring a passkey-capable device be a dealbreaker for your users?

Honest answers, including "this wouldn't work for us," are very welcome. Free tier and docs are at chirographverify.com.