Bonus Abuse Detection in iGaming: Key Signals to Watch For

Last updated: September 2026

Bonus abuse detection is how an iGaming operator finds one person, or a small coordinated group, running several accounts to collect promotional value the operator's terms never meant them to have. Each account usually passes identity verification, because the identities are real. The evidence sits in the links between accounts and in how bonuses are claimed and cashed out, and the response is written policy applied the same way every time.

TL;DR

• Bonus abuse is a customer taking promotional value the terms exclude, most often by opening extra accounts to claim a welcome offer more than once.

• The main forms are multi-accounting, bonus hunting and collusion between accounts.

• It is first-party abuse: the account holder authorizes every deposit and bet, and each identity is usually genuine, so identity checks alone do not stop it.

• Detection reads the links between accounts (device, identity elements, payment instruments) and the bonus lifecycle (minimum deposit, qualifying play, fast withdrawal).

• Decide at four moments: sign-up, first deposit, bonus claim and withdrawal. Respond with eligibility rules, re-verification on a specific suspicion and withdrawal review, and record the reasoning.

The short answer: what bonus abuse detection looks for

Bonus abuse detection looks for the same person, or a coordinated group, behind several accounts that each claim an offer meant for one new customer. It checks the links between accounts, such as a shared device, overlapping identity details or one payment card, and the way bonuses are claimed and withdrawn. It does not rest on whether each identity is real.

The timing matters as much as the signals. A head of payments and KYC at an online sports betting operator described the goal as "identifying before you give welcome bonuses and promotions, who is riskier, who's a bonus abuser, who's a group who's doing fraud." Operators need that decision before the bonus is granted, and again before any winnings leave.

What counts as bonus abuse: multi-accounting, bonus hunting and collusion

Bonus abuse is any use of a promotion that the operator's published terms exclude. The terms draw the line, which is why regulators care how they are written. The UK Gambling Commission's social responsibility code provision 5.1.1 requires incentive terms that are "clear, transparent, and fair and readily accessible". In New Jersey, N.J.A.C. 13:69O-1.12 requires promotion terms to be filed with the Division of Gaming Enforcement at least five business days before launch and communicated "in a clear and conspicuous manner using plain language."

Multi-accounting. One person or household opens several accounts, and each account takes the welcome offer. In New Jersey this breaks a regulatory rule as well as the terms: N.J.A.C. 13:69O-1.3(c) says "A patron shall have only one Internet or mobile gaming account for each Internet gaming intermediary." The limit applies per operator, not statewide.

Bonus hunting. A player moves from offer to offer, and often from operator to operator, plays the minimum needed to release bonus funds, then withdraws. Each step can sit inside the rules, so bonus hunting is usually a question of what the terms allow and whether they are enforced.

Collusion. Two or more accounts play against or alongside each other to convert bonus funds into withdrawable cash. Peer-to-peer games, where one account can deliberately lose to another, are the clearest case.

Self-exclusion evasion. A self-excluded person who opens a new account to claim offers is a more serious problem than lost margin. New Jersey requires operators to verify that a patron is "not self-excluded, on the exclusion list, or otherwise prohibited from participation in gaming" before the account is created.

Operators treat bonus abuse as a pattern problem rather than a one-off event. A head of technical compliance at an online sports betting operator put it this way: "there are patterns that we need to recognize for odds abuse, and bonus abuse, and risk engines." The same abuse appears outside gaming too. A head of fraud risk at an online ticket marketplace said: "Outside of payment fraud, there's also abuse. So abuse can be, your promotional abuse or abuse of, refunds, that nature."

Bonus terms have also become more uniform. Since 19 January 2026, UKGC code 5.1.1 caps wagering requirements at 10 times and bars a single incentive from mixing gambling products, such as betting with casino. Tighter, standardized terms make bonus value easier to measure, and a clear written rule makes abuse easier to define.

Why bonus abuse is first-party abuse, not third-party fraud

Bonus abuse is first-party abuse because the account holder authorizes every deposit, bet and withdrawal. Nobody's account is taken over and nobody's card is stolen in the common case. The Federal Reserve's FraudClassifier model, a voluntary classification framework rather than a regulatory definition, sorts fraud first by whether an authorized or unauthorized party acted. Bonus abuse falls on the authorized side, closest to its category of an authorized party who acted fraudulently.

That placement explains why identity checks do not stop it. A know-your-customer check confirms that an identity exists and matches its records. It says who the customer is, not why they opened the account. A bonus abuser's accounts often use real identities: their own, a relative's, or one borrowed for the purpose.

Friction also works differently. A director of risk and compliance at an AI lending marketplace described the split in a lending context. Third-party fraudsters "tend to fall out" when a lender steps up checks, but first-party actors behave differently: "they'll take a lot of friction, right? Because they just want the money and they're going to pass identity verification." The same logic holds for a bonus abuser, who will complete every verification step to reach the offer.

Oscilar's own first-party fraud page lists abusing refunds or promotions among the common types of first-party fraud. For the wider set of first-party fraud signals and decision strategies, including lending and dispute patterns, see our separate guide. How friendly fraud differs from other first-party fraud is a separate question, and it turns on whether the customer is disputing a purchase they made. The same multi-account pattern also appears on the seller side of an online marketplace, where one person may run several seller accounts.

The signals that link accounts run by one person

The signals that expose bonus abuse describe relationships between accounts. Each account on its own looks like a plausible new customer. The Federal Reserve Bank of Boston makes the same point about detecting fabricated identities: look at "relationships bigger than just those few components." For bonus abuse, the relationships are shared devices, shared identity details, shared payment instruments and matching behaviour.

Each row is a link or a pattern; no row on its own proves abuse.

Device evidence carries particular weight, and one US regulator writes it into the rule. N.J.A.C. 13:69O-1.3 requires phone and device verification to fail "if the phone number or device has been associated with prior fraudulent activity." A fraud operations team member at a BNPL lender launching a deposit product asked for the same capability in plain terms: "Can you set up alerts to say that they're looking at like one device that's triggering on multiple different accounts at the same time?" Oscilar's device and behavioural signals page describes combining device, browser, network, session and behavioural signals, and notes that "Friction comes from the policy applied to the result."

The route an account came through is itself a signal. A head of payments and KYC at an online sports betting operator described one verification route, which confirms personal details without documents, as the route promotional abusers prefer, because it gives the operator less to link on. The same operator said its in-house device and behaviour system lacked the data to tell trusted players from untrusted ones. Without linkage signals, every new account gets the same treatment, which is either too loose for abusers or too much friction for genuine players.

No single signal proves intent. Families share devices and addresses, and a fast withdrawal can be an honest player cashing out a win. The strength of the case comes from several links pointing at the same group of accounts, read together.

When to decide: sign-up, first deposit, bonus claim and withdrawal

Bonus abuse detection works best as four decisions in sequence, each one adding a link the last one could not see. Operators that decide only at withdrawal find abuse after the value has gone. A head of payments and KYC at an online sports betting operator described that position: "We have probably a significant amount of promotional abuse that's identified at a later time. We're not proactive in identifying them beforehand."

1. Sign-up. Identity and age verification come before play or any bonus use. UKGC licence condition 17.1.1 requires operators to verify a customer's identity "before that customer is permitted to gamble", and code 3.2.11 requires age verification before a customer can gamble with "any free bet or bonus." New Jersey requires multi-source authentication of KYC data "prior to the creation of an account." This is also the first chance to check the new account against existing ones for shared devices and identity details. In the US casino context more broadly, 31 CFR 1021.410(a) requires a casino to verify name and address "at the time the deposit is made, account opened, or credit extended."

2. First deposit. The payment instrument is a new link. A card or bank account already seen on another account is one of the strongest single connections an operator gets.

3. Bonus claim. Eligibility is a rule check against the terms: one offer per person, household, device or payment instrument, as the terms define it. The check reads everything learned at sign-up and first deposit.

4. Withdrawal. This is the last point to stop the value leaving. Play patterns since the claim, such as qualifying play only or play between linked accounts, are now visible.

Responses that hold up: eligibility rules, re-verification and withdrawal review

A response to bonus abuse holds up when it follows written policy, fits the evidence and leaves a record. Treating a flagged account as proven abuse, or asking for new documents at every withdrawal, creates complaints and regulatory exposure without improving detection.

• Write eligibility rules into the terms. Define who may claim each offer and what counts as one customer. Enforce the rule the same way for every account.

• Re-verify on a specific suspicion. New Jersey requires a licensee to "periodically reverify a patron's identification upon reasonable suspicion that the patron's identification has been compromised." UKGC licence condition 17.1.1 bars operators from asking at withdrawal for identity information that could reasonably have been requested earlier. Re-verification should follow a named trigger. It cannot make up for verification the operator skipped at sign-up.

• Review the withdrawal when linked accounts are found. Hold for review, void bonus winnings as the terms allow, and close linked accounts where the terms provide for it.

• Keep people in the loop. A head of technical compliance at an online sports betting operator said "we do have a hybrid approach on a lot of these things, right? A lot of it has to be manual." The same operator wanted its own team to own the rules: "building the threshold detections and the rules and stuff our team can actually do a lot of that work."

• Record the reasoning. Store the evidence and its source, the policy applied, the reason codes behind any automated decision, the analyst's rationale and the action taken. The reason for a hold should reach the analyst who reviews it.

• Know when it becomes a reporting question. Where cash-out through promotions looks like a way to move money, a US casino's suspicious activity reporting duty may apply. 31 CFR 1021.320 covers a transaction that "involves or aggregates at least $5,000 in funds or other assets" where the casino knows or suspects it has no apparent lawful purpose. Most bonus abuse costs margin and involves no laundering.

Mistakes that weaken the response

• Acting on one signal, such as a shared address, without other links.

• Applying eligibility rules differently from one account to the next.

• Holding verification back until withdrawal when it could have been done at sign-up.

• Voiding winnings or closing accounts on grounds the published terms do not state.

• Leaving no record of why a decision was made, so it cannot be explained to the customer or a regulator.

How Oscilar approaches bonus and promotion abuse

Oscilar's account opening fraud capabilities include identifying users attempting to exploit sign-up bonuses and promotional offers through multiple fake accounts, spotting patterns that indicate large-scale attempts to open multiple fraudulent accounts, using device fingerprints and advanced behavioral profiles, and analyzing cross-account linkages to uncover fraud rings. Onboarding, fraud and payments decisions read one customer risk profile, so a link found at sign-up is visible at the bonus claim and at withdrawal. Risk teams build and change eligibility, step-up and hold rules themselves through no-code and low-code tools, and backtest them before they go live.

Oscilar provides a full audit trail per decision with stored reasoning, and human-in-the-loop by design. Models are watched through auto model monitoring for data, feature and concept drift, with outcome KPIs by segment. The platform is specified for decisions in under 100 milliseconds. See how this applies to first-party fraud.

Frequently asked questions

Is bonus abuse illegal, or only a breach of the operator's terms?

Bonus abuse is usually a breach of the operator's terms, which the operator enforces by voiding bonus winnings and closing accounts. It can also breach a gaming rule: in New Jersey, N.J.A.C. 13:69O-1.3(c) allows a patron only one account per operator. Abuse that relies on other people's identities or stolen payment instruments moves into fraud that may be criminal.

How is bonus abuse different from friendly fraud?

Friendly fraud is a customer disputing a purchase they made or authorized. Bonus abuse is a customer taking promotional value the terms exclude, usually through extra accounts, and it involves no dispute. Both are first-party: the person acting is the account holder.

Why do bonus abusers pass identity checks?

Bonus abusers pass identity checks because each account usually uses a real identity: the abuser's own, a relative's, or one borrowed or bought for the purpose. Identity verification confirms that each person exists; it does not show that several accounts share one device, one card or one household. The links between accounts are what expose the abuse.

Can an operator hold a withdrawal while it checks for linked accounts?

Operators commonly reserve the right to review withdrawals in their terms, and they must follow their regulator's rules when they do. For UK-licensed operators, licence condition 17.1.1 bars asking at withdrawal for identity information that could reasonably have been requested earlier. A hold is easiest to defend when it follows a specific finding, such as a payment card shared with another account.

What do gaming regulators require of bonus terms?

The UK Gambling Commission requires incentive terms that are clear, transparent, fair and readily accessible, and since 19 January 2026 it caps wagering requirements at 10 times and bars incentives that mix gambling products. New Jersey requires promotion terms to be filed with the Division of Gaming Enforcement at least five business days before launch and stated in plain language. In both places, the published terms are the rule an operator enforces against abuse.

Bonus abuse is a first-party problem: real customers, real identities and authorized play, arranged across accounts to collect value the terms exclude. Detection that reads the links between accounts at sign-up, first deposit, bonus claim and withdrawal, and a response that follows written policy and records its reasoning, stops more of it before the money leaves. To see how Oscilar supports that decision at onboarding, visit our account opening fraud solution.