10 iGaming Fraud Signals Already Hiding in Your Data

In short: you may not need a new fraud platform to take the first step. Deposits, withdrawals, bets, sessions, IP addresses, devices and affiliate attribution already contain useful risk signals. This post presents ten explainable rules from a working iGaming data-pipeline demonstration: five candidate scoring signals and five contextual signals for investigation. They can help prioritize manual review — but no single signal, or simple score, proves fraud, money laundering or regulatory compliance.

Why iGaming fraud is now a data problem

Fraud in online gambling is not only increasing; it is becoming more complex. Sumsub's 2026 iGaming report puts the global fraud rate at 1.53% of verification attempts in Q1 2026, up 18% year on year and nearly 40% from 2024. It also reports a 4.5x increase in suspicious transaction volume between Q1 2025 and Q1 2026, while the average suspicious transaction value rose from $3,960 to $6,500. In Europe, 41% of detected verification fraud involved deepfakes — the highest regional concentration in the report (Sumsub).

The attacks are also becoming more coordinated. Sumsub's broader identity-fraud research found that multi-step attacks grew from 10% of identity fraud in 2024 to 28% in 2025 (Sumsub). In SEON's 2026 survey of 332 betting and gaming fraud and AML leaders, account takeover, promotion abuse and loyalty fraud together represented 68% of reported fraud losses, and 57% of respondents said fraud losses were growing faster than revenue (SEON).

Different regulators classify these risks differently, but they create a shared operational need: reliable identity and transaction data, ongoing monitoring appropriate to risk, documented procedures and records showing what the operator did. Fraud prevention, AML and safer-gambling controls are related, but they are not interchangeable. A credible data architecture should support all three without pretending that one risk score satisfies every obligation.

The idea: the signals are already in your data

Fraud, money laundering, account abuse and data-quality failures leave behavioural and financial patterns. A player deposits, places very little wagering and requests a withdrawal. One account is accessed from an unusual number of networks or devices. An affiliate reports a qualified first-time deposit that the transaction ledger cannot confirm.

Each pattern can be expressed as transparent SQL and tied back to the source records that produced the alert. That matters, because a review team needs to understand why an account was flagged, what evidence supports the alert and what happened next.

Most published material on iGaming fraud detection sits at two extremes — a vendor selling a platform, or a law firm explaining the rules. The useful middle is how the detection layer is actually built on the data you already own, so that a review team and an auditor can both follow it. That is what this post is about.

I built the catalogue below in a working iGaming data-pipeline demonstration. Each rule has an explicit criterion and a calculated exposure value. The dataset is synthetic and randomly generated, so the demonstration counts are not evidence of fraud found in a real operator. The useful part is the architecture and the review logic: a signal is a lead to investigate, not a verdict. The complete pipeline and SQL are open source: github.com/tiagopsilv/igaming-fraud-pipeline.

Five candidate scoring signals

These signals can contribute to a review score, but their weights and thresholds must be calibrated with real historical outcomes. In the demonstration, each signal receives one point for simplicity. That makes the score explainable, not statistically validated.

1. Affiliate reports a first-time deposit the ledger cannot confirm — the "ghost FTD." FTD means first-time deposit, and it often determines whether an affiliate earns a CPA commission. The signal fires when the affiliate feed marks a player as a qualified FTD but the operator's transaction and wagering data do not support that qualification. This may indicate affiliate fraud, an attribution defect or inconsistent business rules between systems. (Demonstration: 355 accounts.)

2. Deposit, minimal wagering, withdrawal — the low-play pattern. Funds enter the account, only a small proportion is wagered, and money is withdrawn. This is a recognised AML review pattern, because gambling accounts can be used to move or layer funds — but it is not proof of laundering. The operator should examine the player's history, payment methods, source-of-funds information, game activity and related accounts. The 20% wagering ratio used in the demonstration is a configurable assumption. (Demonstration: 105 accounts.)

3. Unusually high IP velocity. An account is accessed from more than ten distinct IP addresses within the observation period. Possible explanations include proxy or VPN use, automation, credential sharing, account takeover, travel, or ordinary mobile-network address rotation. The useful signal is not the raw lifetime count alone; production monitoring should also weigh the time window, ASN, geolocation, impossible travel and device continuity. (Demonstration: 42 accounts.)

4. Withdrawal recorded before the first recorded deposit — a ledger-sequence anomaly. This should trigger high-priority reconciliation, but the cause may be fraud, a bonus or manual adjustment, missing source data, duplicated events, timezone ordering or an integration defect. It is a strong control and data-quality signal, because the operator must be able to explain how value left the account. It should not be described as automatically fraudulent, or literally impossible, until all transaction types are included. (Demonstration: 372 accounts.)

5. Lifetime withdrawals exceed lifetime deposits. On its own, this can simply describe a winning player. It becomes more useful when combined with settled bet outcomes, bonuses, chargebacks, payment ownership, account links and promotional eligibility. Because the demonstration dataset does not contain complete winnings and bonus economics, this rule is best treated as an exposure or review signal — not as evidence of bonus abuse by itself. It is still worth surfacing, because bonus abuse is a real cost centre: industry estimates put it at up to 15% of gross gaming revenue (EveryMatrix). (Demonstration: 278 accounts.)

How to combine signals without overstating confidence

The practical benefit of a multi-signal score — a simple form of player risk scoring — is prioritisation. One alert may have an innocent explanation; several independent alerts on the same account make the case more relevant for manual review. Sumsub's 2026 report describes modern fraud detection the same way: it is now more about connecting weak signals than catching one obvious red flag (Sumsub).

In the demonstration, accounts with two or more core signals form a priority-review cohort of 362 accounts, ranked by recorded withdrawals. This cutoff is a project rule, not a universal "high-confidence" threshold. With synthetic data and no confirmed fraud labels, it is not possible to calculate precision, recall, false-positive rate or the probability that a flagged account is fraudulent.

A production implementation should validate the score against reviewed cases, assign different weights where evidence supports them, measure alert outcomes and monitor drift. It should also add network — or fraud-ring — analysis across shared devices, payment methods, identities, IP ranges and affiliate relationships, because organised abuse (multi-accounting, bonus rings, collusion) usually appears across accounts rather than inside one account.

Five contextual signals for drill-down

These signals add useful context but are too dependent on timing, data quality or business context to stand alone:

6. Possible structuring. Repeated deposits with similar or round amounts, especially around an operator's internal review thresholds. Reporting obligations vary by jurisdiction, and suspicious or unusual activity may be reportable even when no fixed monetary threshold is crossed. (Demonstration: none.)
7. Affiliate-country conflict. The same player is attributed to more than one acquisition country in the affiliate data. This is primarily an attribution and data-quality signal unless it is corroborated by KYC, payment, IP or residency information. (Demonstration: 479.)
8. Multiple devices. Three or more distinct devices within a defined time window. This may indicate account takeover or sharing, but it may also reflect normal device replacement or cross-device play. (Demonstration: 413.)
9. Registration burst. The player registered during an abnormal volume spike. A spike can come from a legitimate campaign, so the investigation should look for shared devices, payment methods, contact details, affiliates or repeated identity attributes before calling it an account farm. (Demonstration: 287.)
10. Dormant-account reactivation. A long-idle account becomes active again. Risk rises when the reactivation also introduces a new device, a new location, a password reset, a payment-method change or a rapid withdrawal. (Demonstration: 114.)

Thresholds such as 20% wagering, ten IPs or three devices are tunable assumptions, not industry truths. They need an explicit time window, a documented rationale and regular calibration against the operator's own player base. Transparent rules are useful only when the team also records alert outcomes and learns from false positives.

How the data supports MGA, UKGC and Curaçao controls

The signals above can support regulated controls, but they should not be presented as a complete compliance framework.

Malta: separate player-protection and AML obligations

The MGA Player Protection Directive requires B2C licensees to use effective measures, analytical tools or behaviour-monitoring systems to identify gambling harm. It also requires the criteria to be documented and player interactions to be retained in a clear audit trail (MGA Player Protection Directive). Those are safer-gambling obligations, not fraud or AML rules.

For AML, Malta's FIAU and MGA guidance separately addresses customer due diligence and ongoing monitoring in the remote-gaming sector (MGA/FIAU). Patterns such as material or unusual deposits and withdrawals, or accounts with little or no gaming activity, may therefore be relevant inputs to the AML review process.

United Kingdom: AML monitoring is not the same as financial-vulnerability checks

The UK Gambling Commission's casino AML guidance requires ongoing monitoring of business relationships and scrutiny of transactions in line with the operator's knowledge of the customer and risk profile (UKGC AML guidance).

Separately, the UKGC's light-touch financial-vulnerability check is triggered when a remote customer's deposits minus withdrawals exceed £150 in a rolling 30-day period (the current threshold, in force since February 2025). Its purpose is to identify potential financial vulnerability and gambling harm; it is not a fraud or AML score (UKGC). The same transaction ledger can support both processes, but the decisions, evidence and actions must remain distinct.

Curaçao: AML/CFT supervision and unusual-transaction reporting

Curaçao's LOK took effect on 24 December 2024 and established the Curaçao Gaming Authority as the online-gaming regulator (CGA). The CGA is also the AML/CFT supervisor for the gaming sector. Under Curaçao's identification and unusual-transaction legislation, gaming providers must recognise and report unusual transactions to FIU Curaçao; the reporting framework includes the goAML portal (CGA AML, CGA regulatory scope).

Explainable transaction signals can organise evidence for compliance and investigation teams. They do not decide whether a report must be filed, replace the MLRO, or guarantee that an operator meets all licensing requirements.

Frequently asked questions

Do I need to buy a fraud platform to start?

Not necessarily. A first version can be built over the data the operator already collects. A production capability will usually need more than SQL rules: reliable ingestion, identity resolution, data-quality controls, alert history, case management, access controls, outcome labels and documented governance. A vendor may accelerate some of those capabilities, but buying one does not fix fragmented or unreliable source data.

Does one signal prove an account is fraudulent?

No. A signal is a reason to review the account and its related evidence. Even multiple signals do not create legal proof. They help the team decide what to investigate first and document why the review was opened.

Is a simple 0–5 score enough for production?

It is useful as an explainable prototype. Before production decisions, the operator should validate it against reviewed cases, measure false positives and missed cases, calibrate thresholds, define human-review and escalation procedures, and monitor performance over time.

Is this enough for MGA, UKGC or Curaçao compliance?

No. It can support monitoring and evidence, but compliance also depends on the applicable licence, products, jurisdiction, policies, customer due diligence, safer-gambling processes, reporting, record retention and governance. Regulatory or legal specialists should review the final controls.

If you operate a sportsbook or online casino, that first-pass data assessment is where I start: map the tables you already have, identify which signals are computable today, expose the missing fields, and quantify where manual review is being driven by fragmented data. The output is a practical implementation plan — not a promise that one dashboard or score will solve fraud and compliance.