Bonus Abuse in Online Gambling: Schemes, Detection and Fair Enforcement
The schemes behind bonus abuse, the data that reveals them, the market rules that limit bonuses, and how to enforce terms without treating ordinary play as abuse.
On this page
- What counts as bonus abuse?
- How do operators detect bonus abuse?
- What do market rules say about bonuses?
- How should operators enforce bonus terms fairly?
- Which metrics show bonus abuse?
- How should support handle a bonus abuse decision?
- How do bonus rules interact with safer gambling?
- Which abuse patterns do operators see?
- What makes bonus terms fair?
- How should a bonus abuse investigation run?
- Why does bonus abuse matter beyond cost?
- Where in the bonus flow does abuse happen, step by step?
- Which regulators set bonus rules that affect abuse controls?
- What does a fair and effective abuse programme look like?
- Worked example 2: a household wrongly flagged
- What should players know about bonus terms?
- How should bonus abuse be measured over time?
- Worked example: a welcome offer farm
- What mistakes do operators commonly make?
- Checklist
- Frequently asked questions
- Sources
- More guides
Bonus abuse is using promotions in ways the terms do not allow, most often by opening several accounts to claim a welcome offer repeatedly or by betting patterns that lock in the bonus with little risk. Operators detect it by linking accounts through payment, device, identity and behaviour signals. Enforcement has to be fair: terms must be clear, deposits should not be confiscated, and since 19 January 2026 Great Britain caps wagering requirements at 10 times the bonus.
Key takeaways
- Multi-accounting for welcome offers is the most common scheme; strong KYC removes much of it.
- Great Britain caps wagering at 10x and bans mixed-product bonuses from 19 January 2026 [1].
- Sweden allows bonuses only at a player’s first opportunity to play [2]; Brazil prohibits bonuses and advances for licensed bets [3].
- Not every sharp player is an abuser: play within the terms is legitimate.
- Confiscating deposits is rarely fair; MGA rules bar restricting deposited funds unless AML requires it [4].
What counts as bonus abuse?
| Scheme | How it works |
|---|---|
| Multi-accounting | One person or group opens several accounts to claim the same offer |
| Syndicates and account farming | Groups use bought or borrowed identities |
| Low-risk wagering | Betting both sides or low-variance play to clear wagering where terms forbid it |
| Irregular stakes | Large stakes after a bonus is credited, contrary to terms |
| Cashback and refund abuse | Using cashback or free bet refunds to guarantee profit |
| Bonus arbitrage | Combining offers across operators to lock in profit |
How do operators detect bonus abuse?
Detection links accounts that should be independent and spots play that matches known schemes. The strongest signals are payment instruments shared across accounts, device and network data, shared identity attributes, and synchronised behaviour. See multi-accounting detection and device fingerprinting. Support data helps too: igamingsupportai.com explains using support ticket data to reduce bonus abuse.
What do market rules say about bonuses?
| Market | Rule | Source |
|---|---|---|
| Great Britain | Wagering capped at 10x the bonus; mixed-product bonuses banned (from 19 January 2026) | [1] |
| Sweden | Bonus only at the first opportunity to play (Gambling Act 14:9, amended from 1 January 2026) | [2] |
| Brazil | Law 14.790 prohibits granting advances, bonuses or prior advantages for bets | [3] |
| Ontario | Inducements may not be advertised publicly; only on the operator’s site or by direct marketing with consent (Standard 2.05) | [5] |
| Malta | Terms must be fair and clear; deposited funds not restricted unless AML requires | [4] |
| Netherlands | Cabinet announced plans in June 2026 to ban bonuses such as free bets for new players | [6] |
See bonus and promotion compliance by market for the full picture.
How should operators enforce bonus terms fairly?
- Write specific termsMaximum stakes, excluded games and irregular play defined, not “at our discretion”.
- Show key terms where the offer appearsNot only on a long terms page.
- Review play as it happensFairer than reviewing only after a win.
- Return depositsVoid bonus winnings only where a specific term was breached.
- Explain the decisionName the term, the evidence category and the complaint route.
Which metrics show bonus abuse?
| Metric | Signal |
|---|---|
| Bonus cost as share of revenue by cohort | Cohorts with very high bonus cost may contain abuse |
| Accounts per payment instrument | More than one suggests multi-accounting |
| Time from registration to bonus claim | Very fast claims in bursts suggest farming |
| Wagering completion pattern | Low-variance completion followed by immediate withdrawal |
| Bonus-related complaints | Rising disputes may mean unclear terms, not abuse |
How should support handle a bonus abuse decision?
Players who lose bonus winnings often contact support angry. Agents should explain the specific term and the evidence category (for example “more than one account linked by the same card”), confirm that deposits have been returned, and give the complaints and ADR route. Agents should not argue the case or reveal detection methods. See how to automate bonus requests for automating bonus conversations.
How do bonus rules interact with safer gambling?
The Gambling Commission’s customer interaction guidance lists requests for bonuses after losses among the customer-led indicators of harm, and expects action such as stopping marketing and new bonus take-up where indicators are strong [7]. Bonus eligibility should check RG status, not only abuse risk; see markers of harm.
Which abuse patterns do operators see?
| Pattern | What happens | Typical signal |
|---|---|---|
| Bonus hunting | Players open accounts to claim welcome offers, then leave | Short lifetime, bonus-only activity |
| Multi-accounting | One person runs several accounts | Shared devices, payment instruments, addresses |
| Low-risk wagering | Betting both sides or very low-variance games to clear wagering | Opposing bets, excluded game play |
| Matched betting | Using bookmaker offers with exchange lay bets to lock in profit | Offer-only activity, exchange-like patterns |
| Collusion | Players work together in peer-to-peer games | Repeated play between the same accounts |
| Syndicates | Organised groups using many identities | Clusters of new accounts with linked data |
What makes bonus terms fair?
In 2017 to 2019 the Competition and Markets Authority and the Gambling Commission ran a joint programme on online gambling terms [8]. Operators committed to be clearer about promotional terms, flag significant restrictions, let players withdraw their own money while taking part in a promotion, and not change promotions unfairly after a player opted in. Those principles remain a good test for any market.
| Fair | Unfair |
|---|---|
| Significant terms next to the offer | Key restrictions buried in general terms |
| Players can withdraw their own deposit | Deposit locked until wagering completes |
| Specific, defined abuse behaviours | Vague “irregular play” clauses applied at will |
| Deposits returned when bonus voided | Deposits confiscated |
How should a bonus abuse investigation run?
- AlertA rule or model flags linked accounts or unusual wagering.
- Gather evidenceDevice, payment, identity and gameplay links.
- Check termsMatch behaviour to a specific, published term.
- DecideVoid bonus winnings under the term; return deposits; close duplicates.
- Tell the playerExplain the term and the evidence category, and the complaint route.
- LearnUpdate rules and offer design.
Why does bonus abuse matter beyond cost?
Bonus abuse costs money, but its effects reach further. Abusers distort acquisition metrics, making some channels look better than they are. They create fraud and AML risk, because accounts opened with false or borrowed identities can be used to move money. And heavy-handed responses hurt genuine players, who may lose winnings under vague terms and complain.
The best defence is offer design. Offers that reward ongoing play rather than a one-off sign-up, caps on maximum conversion, and eligibility checks before the bonus is credited reduce abuse without punishing ordinary players. Detection then focuses on the remaining organised abuse. igamingsupportai.com describes using support ticket data to reduce bonus abuse.
Where in the bonus flow does abuse happen, step by step?
- OfferAbusers target offers with high value and low wagering. Control: offer design and value caps.
- RegistrationDuplicate or synthetic identities. Control: identity checks and device linking at sign-up.
- DepositShared or stolen payment instruments. Control: one-instrument-per-person rules and card checks.
- Bonus creditBonus claimed by ineligible accounts. Control: eligibility checks before credit.
- WageringLow-risk or excluded play to clear wagering. Control: game contribution rules and pattern detection.
- WithdrawalFast cash-out after wagering. Control: review for linked accounts before payout.
- After the decisionComplaints and disputes. Control: clear terms, explanation and complaint route.
Which regulators set bonus rules that affect abuse controls?
| Market | Regulator | What it covers for this topic | Official source |
|---|---|---|---|
| Great Britain | Gambling Commission (and CMA on fair terms) | 10x wagering cap and no mixed-product offers; fair terms principles [1] [8] | Promotions changes, CMA online gambling case |
| Ontario | AGCO | Inducements advertised only on the operator’s site or to consenting players [5] | Registrar’s Standards |
| Sweden | Spelinspektionen | Bonuses only on the first occasion of play [2] | Spelinspektionen, SFS 2025:767 |
| Brazil | SPA | No welcome bonuses for licensed operators [3] | Secretaria de PrĂªmios e Apostas |
| Netherlands | Kansspelautoriteit | Bonus restrictions, with further limits under discussion [6] | Kansspelautoriteit |
| Malta | MGA | Player Protection Directive rules on terms and player information [4] | Player Protection Directive |
| Pennsylvania | PGCB | Limits on calling bets “free” when conditions apply | Pennsylvania Gaming Control Board |
What does a fair and effective abuse programme look like?
| Area | What good looks like |
|---|---|
| Offer design | Offers that reward ongoing play, with sensible caps |
| Detection | Link scoring across identity, device, payment and behaviour |
| Terms | Specific, published abuse terms; deposits always returned |
| Decisions | Evidence recorded and reviewed by a second person for large cases |
| Player contact | Clear explanation and complaint route |
| Safer gambling | Bonus eligibility checks RG status as well as abuse risk [7] |
Worked example 2: a household wrongly flagged
-
Two accounts at the same address claim the same welcome offer within a week. Link scoring flags them.
-
Before any action, the analyst checks: different verified identities, different cards in their own names, different devices.
-
Play patterns are independent and normal. The analyst records the link as a household and takes no action.
-
Both players keep their bonuses. The rule is tuned so address alone carries a low weight.
Treating every shared address as abuse produces complaints and unfair outcomes. See multi-accounting detection.
What should players know about bonus terms?
Most disputes about voided bonuses come from terms players did not read or understand. Players can protect themselves by checking a few points before accepting an offer: the wagering requirement, which games count and at what rate, the expiry date, any maximum win or conversion cap, and whether the deposit can be withdrawn while the bonus is active.
Players should also know that opening a second account to claim the same offer again almost always breaks the terms, and that sharing payment methods or devices with other players can cause accounts to be linked. If an operator voids a bonus, the player should ask which term was applied and what evidence category was used, and use the complaints process and ADR if they disagree. In Great Britain, the CMA and the Gambling Commission set out expectations that players can withdraw their own money and that terms are clear [8].
How should bonus abuse be measured over time?
| Measure | Why it matters |
|---|---|
| Confirmed abuse cases per 1,000 bonus claims | Trend in abuse pressure |
| Share of flagged cases cleared as genuine | False positive rate; fairness of rules |
| Bonus cost recovered from voided winnings | Financial effect of enforcement |
| Complaints and ADR cases about voided bonuses | Whether decisions are fair and explained |
| Abuse rate by offer and affiliate | Which offers and sources attract abuse |
Worked example: a welcome offer farm
-
Twelve new accounts register within three hours; all claim the welcome bonus.
-
Rules link nine accounts by two debit cards and one device ID; the other three share an address.
-
All twelve place minimum-variance bets to clear wagering.
-
Withdrawals held; review confirms the cluster; bonus winnings voided under the one-account-per-person term; deposits returned.
-
Device and payment fingerprints added to the block list.
What mistakes do operators commonly make?
Hard to defend in ADR or before a regulator.
Rarely fair and restricted in Malta [4].
Players feel targeted after winning.
Checklist
- Market bonus rules mapped per licence.
- Wagering at or below caps.
- Terms specific and visible at the offer.
- Account linking signals live from registration.
- Deposits returned when bonus winnings are voided.
- Decisions explained with the term and complaint route.
- Bonus metrics by cohort reviewed monthly.
- Support script for bonus decisions.
- Bonus eligibility checks RG status.
- Abuse terms specific and published.
- Deposits returned when bonuses are voided.
Frequently asked questions
What is bonus abuse in online casinos?
Using promotions in ways the terms prohibit, such as claiming a welcome bonus on several accounts.
What is the maximum wagering requirement in the UK?
10 times the bonus from 19 January 2026.
Are bonuses allowed in Brazil?
Law 14.790 prohibits granting advances, bonuses or prior advantages for licensed bets.
How many bonuses can a Swedish operator give?
Only at the player’s first opportunity to play.
Can a casino keep my deposit for bonus abuse?
Confiscating deposits is rarely fair; voiding bonus winnings under a specific term is more defensible.
How do casinos detect bonus abuse?
By linking accounts through payment, device, identity and behaviour signals.
Is matched betting bonus abuse?
It depends on the terms; operators can restrict offers but must apply terms fairly.
What are mixed-product bonuses?
Offers requiring play across two or more product types, such as betting and slots, now banned in Great Britain.
Does asking for a bonus after losing count as a harm marker?
In UK guidance, requests for bonuses after losses are listed among customer-led indicators of harm.
How do operators prove multi-accounting?
By documenting the links: shared payment instruments, devices, identity attributes and behaviour.
Is matched betting illegal?
Not generally, but operators can restrict accounts or offers under their terms.
Can an operator keep my deposit if it voids my bonus?
Fair terms return the deposit; CMA commitments in the UK supported players withdrawing their own money.
Can two people in one household both claim a bonus?
Often yes, if they are separate verified customers using their own payment methods. Terms vary by operator.
What is link scoring?
Combining signals such as shared devices, payment instruments and identity data into a score showing how likely two accounts belong to the same person.
Sources
- Gambling Commission: gambling promotions to be safer and simpler
- SFS 2025:767 amending the Swedish Gambling Act
- BNLData: licensed operators cannot offer welcome bonuses (April 2024)
- MGA: Player Protection Directive
- AGCO: penalties to BetMGM and PointsBet over inducement advertising (May 2022)
- DutchNews: cabinet plans ban on online gambling ads and bonuses (June 2026)
- Gambling Commission: customer interaction guidance for remote licensees
- CMA: online gambling case (2017 to 2019)
More guides
Multi-accounting detection
How operators link duplicate accounts using identity, payment, device and behaviour signals.
Bonus and promotion compliance by market
Bonus and inducement rules in the UK, Ontario, Brazil, Netherlands, Sweden, Germany and US states.
Device fingerprinting basics
What device fingerprinting is, what it catches, and the consent rules that apply.
Player segmentation and value tiers
How operators segment players by value, behaviour and risk, and the guardrails that apply.
Account takeover
How player accounts are taken over, the signals to watch, and recovery that does not help attackers.
Further reading elsewhere
- Using support ticket data to reduce bonus abuse (igamingsupportai.com)
- Cutting bonus support tickets (igaming.cx)
- How to automate bonus requests (www.cevro.ai)