iGaming Fraud Trends

Shufti Prevents potential bonus abuse of $30 Million

Shufti’s H1 2026 iGaming fraud data shows 13.77% of cases were associated with potential Bonus Abuse, out of the full population of cases assessed in the period.

Every account in the flagged population not only represents KYC Compliance risk but also the bonus abuse losses. It also wastes acquisition spend on marketing as promotional bonus goes to a duplicate or coordinated sign-up rather than a genuinely new player. The same pattern increases manual review volume as flagged accounts accumulate if left uncontrolled and eventually increases the operational constraints for the iGaming businesses.

Identity fraud for the sake of committing Bonus Abuse is typically identified through the repeated or coordinated use of multiple sign-ups or player accounts to access promotional incentives intended for eligible players. Multi-accounting, duplicate identities, shared devices and related network patterns are common indicators of this activity. This differs from advantage play, in which a single genuine customer makes optimal use of legitimate promotional terms without deception or duplication.

Fraud in iGaming Operates Through Connected Networks

Corroborated signals, not isolated anomalies, are what surface the scale of the risk sitting at the point of registration, at bonus release and at the jurisdiction border.

Significance of Identity Network Intelligence to Prevent iGaming Fraud

In iGaming, identity verification is not only required to meet regulatory obligations but also to prevent significant financial losses caused by bonus abuse, multi-accounting and jurisdiction hopping. Traditional KYC checks answer whether a single player’s document, selfie or device appears genuine at the point of registration. They do not reveal whether the same identity has been used across multiple accounts, whether several players are connected through shared devices or documents, or whether a new registration is linked to previous fraudulent activity.

Identity Network Intelligence addresses this gap by identifying relationships between identities, biometric evidence, documents, devices, network signals, geographic information, verification history and previous fraud associations. This enables iGaming operators to detect coordinated fraud patterns behind activities such as bonus abuse, multi-player accounts and attempts to bypass jurisdiction controls. Decisions stay based on multiple contextual signals rather than isolated similarities. iGaming operators can prevent fraud losses, without creating unnecessary friction for legitimate players, by assessing each registration against the wider network of activity.

Detecting Fraud While Preventing Loss of Legitimate Users

Shufti does not treat an individual anomaly as conclusive evidence of fraud. The fraud detection methodology evaluates potentially concerning signals alongside contextual evidence: identity and document consistency, device and session behaviour, geographic and network intelligence, verification history, relationships between accounts, and patterns observed across repeated attempts. A single signal considered in isolation is rarely sufficient to distinguish a legitimate customer from an elevated-risk one.

Behavioural biometrics is one the signals which can help distinguish a genuine user from fraudulent one. For example, a genuine user may pause, correct a mistake or vary their typing speed, while automated submissions often follow a faster and more consistent pattern.

The methodology therefore distinguishes isolated anomalies that can occur during legitimate customer journeys from combinations of signals that, taken together, indicate elevated risk. Positioned correctly, this is both a fraud-prevention benefit and a conversion benefit. iGaming operators that only ever act on corroborated risk protect revenue from coordinated abuse. They also avoid unnecessary friction, and unnecessary lost conversions, for the genuine players the business depends on.

How to Detect Identity Fraud to Prevent Bonus Abuse in iGaming

Identity fraud, an identity that is stolen, synthetic, or manipulated, sits upstream of most connected fraud in iGaming. It creates the accounts that Bonus Abuse, multi-accounting and jurisdiction circumvention later depend on. It takes two connected forms, a synthetic identity built from a mixture of genuine and fabricated information, and a genuine identity presented through a fake, altered, or manipulated document. Both share the same underlying question: does the presented identity correspond to a real individual, and has that identity, or elements of it, appeared previously in the network.

28.79%

of cases in Shufti’s H1 2026 iGaming fraud data were linked to identities with a prior history of fraud.

This is not a duplicate-player metric. It measures how much activity touched an identity that had already been associated with fraud elsewhere in the network. That is a different question from whether that identity was operating multiple accounts, and a different risk dimension from the duplicate-identity and shared-device figures covered later in this report.

Where Identity Network Intelligence Protects the Player Journey

Identity Network Intelligence applies across four points in the player journey, rather than at registration alone.

A Second Account Can Multiply the Risk Attached to One Identity

According to Shufti H1 2026 iGaming identity fraud report 38.07% of fraud is associated with shared devices connectivity, out of the population of cases eligible for device fingerprinting. Players, or coordinated groups, often use multiple accounts to repeatedly access promotional incentives, circumvent player-level restrictions, evade account limits, or obscure the relationships between accounts.

A connected cluster of accounts multiplies every cost attached to the identity behind it: promotional exposure across each linked account, and additional manual review once the cluster is flagged. Where a self-excluded individual is part of the cluster, it also carries a self-exclusion failure with direct licence exposure attached.

Shufti’s H1 2026 iGaming fraud data shows 2.85% of cases reflected a duplicate-identity rate, out of the population of cases eligible for biometric proof-of-life matching. Where device intelligence identifies connections between accounts, identity deduplication identifies repeated use of the same identity. The two signals provide complementary views of connected-account activity, strongest when read together.

Identity deduplication and 1:N biometric matching provide the relevant detection signals, checking each new registration against the full existing player population rather than a single stored reference.

Identity Fraud Rate for Jurisdiction Circumvention in iGaming

22.73% of VPN and proxy-originated cases across Shufti’s H1 2026 iGaming fraud data were associated with Jurisdiction Circumvention. VPN and proxy infrastructure allows a player to obscure their true location and circumvent jurisdictional restrictions, distinct from geographic mismatch, which functions only as a supporting detection signal. Location eligibility is assessed separately from identity verification. Eligibility to play a regulated iGaming product depends on identity, age, physical location, jurisdiction and product all aligning at once. A player can be genuinely who they say they are, pass every identity check, and still be ineligible if their true location falls outside the licensed market.

Jurisdiction circumvention exposes iGaming operators to the same regulatory consequence regardless of a player’s intent: a licence condition breach or a market-eligibility review. It also dilutes promotional and acquisition spend directed at players they were never permitted to serve in the first place.

Jurisdiction Hopping Used for Bonus Abuse

A player may use a VPN to reach a jurisdiction-specific promotional offer or a bonus unavailable in their home market. Each of the seven US states with a live, regulated online casino market requires operators to confirm that a player is physically within state lines for every session, not only at registration. That reflects the view that jurisdiction eligibility can change within a single player’s activity.

Jurisdiction Hopping Used for Circumvention of Age Verification

The same VPNs, proxies and location-spoofing tools used to bypass geofenced iGaming products can also be used alongside other techniques to evade age-related access controls. Age verification and jurisdiction circumvention are closely related compliance challenges rather than separate risks. This is particularly significant in the United States, where regulated online casinos must verify both a player’s age and their physical location before wagering is permitted.

In the UK, gambling-trade reporting has linked the rollout of Online Safety Act age-assurance duties to a rise in VPN use aimed at bypassing age checks. The same technical methods can be repurposed across different regulatory regimes.

How Shufti is Helping iGaming Prevent Fraud Through Identity Network Intelligence