Who this is for
Casino and sportsbook operators losing margin to the same few patterns: one person behind twenty accounts claiming twenty welcome bonuses, deposits that come back as chargebacks months later, and bettors who take a stale price before the market moves. Also for operators whose card acquirer has started asking about dispute ratios, which is often the first time the problem is visible.
The software is the part that sees. It links accounts by device, payment instrument and behaviour, scores each deposit and withdrawal, and profiles bettors against the closing price. It does not decide who is a fraudster; a risk analyst or a trader does, with the evidence the software assembles. The people who work the queue are a separate service under managed services.
What it catches and what a false positive costs
Every control here stops some good players too. Read the last column first: it is the price of a rule set too tight.
| Threat | Signals the module uses | Typical control | Cost of a false positive |
|---|---|---|---|
| Bonus abuse and multi-accounting | Shared device fingerprint, IP and connection, payment instrument, address, identical bet patterns across accounts | Bonus eligibility check at claim, linked-account review before payout | A real new player refused a welcome offer, usually silently |
| Chargebacks and friendly fraud | New card on a new account, deposit size against history, failed 3-D Secure, deposit followed by fast loss and dispute | Step-up authentication, deposit limits on new instruments, manual review of large first deposits | Friction at the first deposit, where a new player has the least reason to persist |
| Card testing and stolen cards | Many small attempts, many cards per account or device, BIN country against IP country | Velocity limits, blocking at the cashier before the acquirer sees the attempt | Low, if limits are set per instrument rather than per player |
| Account takeover | Login from a new device and country, password reset followed by a withdrawal method change | Re-authentication before withdrawal, cooling period on new payout details | A delayed withdrawal, which players remember |
| Withdrawal laundering | Deposit and withdrawal with little play, crypto deposits from flagged addresses | Enhanced due diligence before payout, withdrawal to the deposit method | A compliance review that holds a legitimate payout |
| Sharp and arbitrage betting | Persistent beating of the closing price, stakes landing on prices out of line with the market | Stake factoring, per-player limits, bet delay on in-play markets | Limiting a recreational winner, which a US regulator has questioned in public |
| Integrity and match-fixing | Unusual volume or price movement on a low-tier event, clustered accounts on one outcome | Suspension, alert to the integrity body or feed provider | A suspended market on a legitimate event |
Vendor data, drawn from its own customers rather than the market, gives a sense of the mix. Shufti's report for the first half of 2026 classes 13.77% of the cases it assessed as bonus abuse, and links its largest fraud network to 181 identities through shared devices, documents and other identity signals. A network that size defeats a one-account-per-player rule checked only at signup.
The ratios your acquirer watches
The card schemes measure your fraud, and their arithmetic sets how hard the deposit rules must bite. Our payment gateway tracks both ratios per merchant account; the anti-fraud module is what keeps them low.
- Visa VAMP. The excessive-merchant threshold fell from 2.2% to 1.5% on 1 April 2026 in the US, Canada, the EU and Asia-Pacific. The ratio is fraud reports plus disputes, counted together, over settled card-not-present transactions, so a fraud report that becomes a dispute counts twice. Merchants under 1,500 combined fraud and dispute events a month are not formally monitored, though acquirers may set tighter limits of their own.
- Mastercard ECM. At least 100 chargebacks in a calendar month and a ratio of 1.5% or more. The ratio divides this month's chargebacks by the previous month's sales transactions, and fines start in the second consecutive month.
The Mastercard denominator lags by a month. A brand whose volume fell this month is measured against last month's larger base and looks better than it is. A launch growing fast is measured against a smaller base and looks worse, so score new card deposits harder in the first months.
Sportsbook risk: liability and bet patterns
A sportsbook carries a second risk that is not fraud at all: customers who price better than the book. The sportsbook side of the module is the trader's tooling.
- Liability per market, event and correlated set. Exposure is summed across markets that settle together, such as a match result and a bet-builder leg on the same match, not market by market.
- Player profiling. Each account carries a stake factor applied to the market maximum. Persistent value against the closing price is the clearest signal; precise stakes and timing are supporting signals, not grounds on their own.
- Stale price protection. Bet delay on in-play markets, automatic suspension on feed status, and alerts when accepted prices sit away from the rest of the market.
- Integrity hooks. Suspicious patterns passed to the feed provider's monitoring and to integrity bodies. The International Betting Integrity Association (IBIA) recorded 300 suspicious betting alerts in 2025 against 232 in 2024.
Limiting winning players is allowed and still contested. In Massachusetts, 205 CMR 247 lets operators set their own minimum and maximum wagers, and in March 2024 the Gaming Commission's commissioners still asked in public why winning bettors are limited and losing ones are not. Keep a written limiting policy, apply it the same way to everyone, and log each stake factor change with its reason. Who controls those settings under each sportsbook model is covered on sportsbook software.
Module or part of the platform
| Your situation | Buy | Why |
|---|---|---|
| New brand on our casino engine or a white label or turnkey casino | As part of the platform | Bonus eligibility, cashier and withdrawal rules share one player record; nothing to integrate |
| Live operator on a platform with basic rules only, losing margin to bonus abuse | The module on its own | Account linking across devices and payment instruments is the gap a basic rule set leaves |
| Casino and sportsbook on different platforms | The module on its own, fed by both | A multi-accounter moves between products; one linking graph has to see both |
| Sportsbook on a white label with managed trading | Neither | The licence holder's desk owns liability and profiling; you cannot override it |
| No one available to work alerts | The software with a staffed service | An alert queue nobody reads costs the subscription and stops nothing |
What integration with an existing stack requires
- A device and session script on registration, login, deposit, bonus claim and withdrawal pages, loaded early enough to see the session before the action.
- A synchronous decision call from the player account system, the cashier and the bonus engine at those moments, with a timeout and a default decision when the module does not answer in time.
- Payment data from the cashier: tokenised card fingerprint, BIN, method, outcome and every chargeback with its reason code. The module never needs the card number.
- Bet and settlement streams with prices at acceptance and the market price at the same moment, for profiling and stale-price detection.
- A case tool where an analyst sees linked accounts and evidence, and every decision is recorded.
- Licence rules as inputs. Tobique requires due diligence within 30 days of a first deposit or before €2,000 is wagered, whichever comes first, and always before a payout; it treats crypto deposits as high risk. Thresholds like these belong in configuration, per licence.
How it fails
- Rules tuned on a quiet month and left alone, so a seasonal fall in volume pushes the dispute ratio up with no change in fraud.
- Bonus abuse rules that check deposit bonuses but not cashback, free spins or gamification rewards.
- A fail-open timeout that approves every withdrawal when the module is slow, which is when an attack is running.
What to ask any vendor, including us
- Show two accounts being linked and the evidence behind the link. Which signals can we switch off for privacy reasons, and what does that cost in detection?
- What happens when the decision call times out at deposit, at bonus claim and at withdrawal? Are the three defaults different?
- Can we see our false-positive rate per rule, measured on players later cleared?
- Can every decision and its evidence be exported for a regulator, a payment provider or our own BI? Can the analyst explain each score?
Frequently asked
Is this a KYC provider?
No. KYC checks who a player is, once and at thresholds. Anti-fraud watches what accounts do afterwards, which is where bonus abuse and multi-accounting happen. The module consumes KYC results and triggers new checks; it does not replace the identity provider.
Can we block VPN traffic?
You can flag it and block it where the licence requires geo-restriction. Shufti's H1 2026 report attributes 22.73% of its cases to VPN and proxy traffic associated with getting round market restrictions. Blocking every VPN also blocks legitimate players who use one for privacy or work, so weigh it with the other signals.
Does the module handle AML monitoring?
It supplies the transaction monitoring signals and the case record. The AML programme, the MLRO and the decision to report belong to the licence holder, and most licences on this site require a named officer.
Do we need traders to use the sportsbook side?
Someone must own the limiting policy and act on liability alerts. On turnkey that can be one risk manager with managed trading behind them for the first period; on white label the licence holder's desk does it.