The credit card problem is quite easy to solve: allow a few months of free "pro" functionality upon signup, and then allow users to upgrade. During that period of time, you can also track whether they actually used the service at all.
But then you'll have people creating new accounts every time the trial ends, instead of paying! The sweet spot is probably 24 hours. Too long for a fraudster to wait around, and too short for people to bother making an account every day for pro fuctionality.
These would be malicious users. Both words are significant here. People using the service just to check credit cards are malicious, but not users. Free users are users but not malicious.
I think for most services, the set of actual malicious users—people who do want to use the service for its intended purpose, but don't want to support it—is fairly small.