Bonus abuse in iGaming: how it works and how operators detect it

Bonus abuse is when players exploit welcome offers, free spins or cashback in ways the terms do not allow, most often by opening many accounts to claim the same bonus again and again. Operators detect it by linking accounts through shared devices, payment methods, networks and behaviour, then reviewing linked groups before bonus winnings are withdrawn.

Updated 1 November 2026 · RiskCogs team

Promotions are how online casinos and sportsbooks win new players: a matched first deposit, free spins, a risk-free bet, cashback on losses. They cost money, and operators accept that cost because some of those players stay. Bonus abuse is when the promotion is taken by people who never intended to stay, in ways the terms forbid.

Not every bonus hunter is an abuser. Some players simply shop around for the best welcome offer and play within the rules. That is a commercial problem, solved with offer design. Abuse starts when the rules are broken: several accounts for one person, fake identities, collusion between accounts, or betting patterns designed to extract bonus value without real risk.

• Multi-accounting: the same person registers many accounts, often with slightly different names, emails and phone numbers, to claim a welcome offer repeatedly.
• Organised groups: teams that run dozens or hundreds of accounts with purchased or synthetic identities, sometimes with dedicated devices and SIM cards.
• Low-risk wagering: covering both sides of a bet across linked accounts, or using low-variance games, to clear wagering requirements with little real risk.
• Referral abuse: referring your own fake accounts to collect referral rewards.
• Cashback and loss-back abuse: coordinated losses on one account and wins on another, so the group profits from refunds.
• Chip dumping and collusion in peer-to-peer games, where linked accounts transfer value between each other.

Bonus abuse detection is mostly a linking problem. A single account rarely looks suspicious. The pattern appears only when you see that twenty new accounts share something they should not.

• Device: the same device identifier, or devices with the same unusual configuration, across accounts.
• Payment methods: the same card, card BIN range or wallet used to deposit into several accounts.
• Network: shared IP addresses or narrow IP ranges, data-center or proxy IPs, and the same Wi-Fi network.
• Identity details: similar names, emails following a pattern, phone numbers in sequence, shared addresses.
• Behaviour: accounts registered close together, depositing the minimum needed for the bonus, playing the same games in the same way, and requesting withdrawals at the same stage.

1. At registration: score the device and network, and look for links to existing accounts, without blocking real new players.
2. At first deposit: check the payment method against other accounts and for card testing signs.
3. At bonus claim: compare the player with others who claimed the same offer recently.
4. During play: watch for patterns that clear wagering with little risk or mirror other accounts.
5. Before withdrawal: review linked groups and bonus history before paying out bonus-related winnings.

Strict checks at registration are tempting, but they put friction on every new player, most of whom are legitimate. Families sharing a home network, students in shared housing and friends who signed up together can all look linked at first glance. Blocking them at sign-up costs real players and creates complaints.

A better pattern is to let players register and deposit with light checks, mark suspected links, and focus enforcement at the point of bonus claim and withdrawal. At that stage, you have more data, and the decision is clearer: whether to pay out bonus winnings to an account that is part of a linked group.

Clear communication helps. If a player's bonus is withheld under the terms, explain which rule applied. Regulators in many markets expect bonus terms to be fair and transparent, so the terms themselves need to be written with enforcement in mind.

• Define one bonus per person, household, device and payment method, in plain words.
• Say clearly that linked accounts may be reviewed and bonuses withheld when the terms are broken.
• Set wagering rules that make low-risk strategies unattractive, such as limits on which games or bets count.
• Avoid vague clauses that let you refuse any payout; they create disputes and may not satisfy regulators.
• Keep a record of which version of the terms each player accepted.

1. List every account in the group and the links between them: device, card, network, address, identity details.
2. Check how strong each link is. A shared card or device is stronger evidence than a shared IP in a large city.
3. Look at the timeline: when each account registered, deposited, claimed bonuses and asked to withdraw.
4. Compare play patterns: same games, same bet sizes, opposite bets on the same events.
5. Check payment history for chargebacks, failed deposits and cards used on other accounts.
6. Decide per account under the terms, record the reasons, and tell the player which rule applied.

To decide how much effort to spend, measure the cost. Start with bonus cost per new player who stays beyond the first month, compared with players who leave right after withdrawing. Add bonus winnings paid to accounts later found to be linked, chargebacks on deposits from those accounts, and the review time spent on them.

Then look at the other side: how many genuine players were held up by checks, how long reviews took and how many complaints followed. Bonus abuse controls that cost more in lost players than they save in bonuses are not worth keeping as they are. As with payment fraud, the aim is the lowest total cost, not zero abuse.

Track these numbers per promotion. Some offers attract far more abuse than others, and changing the offer can be cheaper than adding more checks.

Bonus abuse often travels with payment fraud. Organised groups need many payment methods to fund many accounts, and some of those are stolen cards. Deposits with stolen cards lead to chargebacks weeks later, after the bonus has been cleared and withdrawn. The operator loses the bonus, the deposit, the chargeback fee and sometimes standing with its payment providers.

This is why payment risk checks at deposit belong in the same picture as bonus abuse detection. A card used on several accounts, a burst of small deposits on new cards, or a device linked to earlier chargebacks are signals for both problems.

RiskCogs scores deposits and other payment events through POST /v1/risk-score, using device, network, card and history signals, and returns readable reason codes. Links such as one device behind many accounts or one card across several players show up in those reasons, so your team can review linked groups before payouts.

Default bands are allow under 40, review 40 to 69 and block from 70. Start in shadow mode on the free plan to see which deposits and accounts would have been flagged, then enforce where the numbers support it.

• UK Gambling Commission, guidance on fair and open terms and practices for gambling promotions.
• Directive (EU) 2015/849 (Fourth Anti-Money Laundering Directive), gambling services as obliged entities.

• iGaming fraud prevention guide
• RiskCogs for iGaming
• Device fingerprinting
• Card testing attacks
• Pricing
• Talk to the RiskCogs team