Fraud and bonus abuse

Multi-Accounting Detection in Online Gambling

How online gambling operators detect people holding more than one account, which signals are reliable, how to avoid false positives, and what the rules say.

4 min readPart of fraud and bonus abuse

On this page
  1. Why does multi-accounting matter?
  2. Which signals link accounts?
  3. How should operators score and act?
  4. How should a link score be built?
  5. What should happen to linked accounts?
  6. What do market rules say about multiple accounts?
  7. Worked example: a household false positive
  8. What mistakes do operators commonly make?
  9. Checklist
  10. Frequently asked questions
  11. Sources
  12. More guides

Multi-accounting means one person or group holding several accounts at the same operator, usually to claim offers repeatedly, to collude, or to get around limits or exclusions. Operators detect it by linking accounts that share identity attributes, payment instruments, devices, networks or synchronised behaviour, and score the strength of each link. Verified identity at registration is the best prevention, because one verified identity can only be used once.

Key takeaways

  • Payment instruments shared across accounts are among the strongest links.
  • Device and network signals help but produce false positives on shared households and public networks.
  • New Jersey rules allow one account per patron per operator [1].
  • Multi-accounting matters for responsible gambling too: duplicate accounts can bypass limits and self-exclusion.
  • Device fingerprinting may need consent under UK PECR, according to the ICO [2].
1account per patron per operator in New Jersey
5 signalsidentity, payment, device, network, behaviour

Why does multi-accounting matter?

  • Bonus abuse. Claiming welcome offers repeatedly; see bonus abuse.
  • Collusion. Accounts that play against each other in poker or exchanges.
  • Harm and exclusion evasion. A second account bypasses limits, cool-offs or self-exclusion.
  • AML. Linked accounts can move value; see AML red flags.
Account-linking signals
Signal Strength Caveat
Same verified identity Very strong Should be blocked at registration
Same payment card or bank account Strong Family members may share cards
Same device ID or fingerprint Medium to strong Shared household devices
Same IP or network Weak to medium Public Wi-Fi and mobile carriers
Same address or phone Medium Households, shared housing
Synchronised behaviour Medium Needs patterns across several sessions

How should operators score and act?

  1. Block exact duplicates at registrationSame verified identity cannot open a second account.
  2. Score linksCombine signals; one weak link is not enough.
  3. Review clustersAnalysts look at the full cluster, not one account.
  4. Act proportionatelyClose duplicates, void offers under terms, return deposits, and check RG status.
  5. Feed backConfirmed clusters improve the model.
Illustrative link weights
Signal Example weight Notes
Same verified identity Block Prevent at registration
Same payment instrument High Check household exceptions
Same device fingerprint Medium Shared devices common
Same address Medium Households and shared housing
Same IP Low Public networks and carriers
Synchronised behaviour Medium Needs several sessions

Weights are illustrative; calibrate on your own confirmed cases.

What should happen to linked accounts?

Actions on linked accounts
Finding Action
Same person, duplicate account Close duplicate; keep primary; void offers under terms; return deposits
Household, independent players No action; record the link
Self-excluded person on a new account Close; return deposits; safer gambling review
Group or syndicate Close cluster; review payments for fraud and AML

What do market rules say about multiple accounts?

Account rules by market
Market Rule Source
New Jersey One account per patron per internet gaming intermediary; non-transferable [1]
Germany Player account in the player’s name before play; LUGAS prevents parallel play across operators [3] [4]
Great Britain Verification before play; self-exclusion must be effective [5]
Brazil CPF-based registration with facial recognition [6]

Worked example: a household false positive

  1. Two accounts share a device and IP; rules raise a medium link.
  2. Different verified identities, different own-name cards, no synchronised bonus claims.
  3. Analyst marks the link as a household; no action; note added.
  4. One account self-excludes; the household link prompts a check that the other person is not using the excluded player’s funds.

What mistakes do operators commonly make?

Acting on IP alone

Too many false positives.

Ignoring RG angle

Duplicates can bypass exclusion.

Collecting device data without lawful basis

The ICO expects consent where required [2].

Checklist

  • Duplicate identity blocked at registration.
  • Link scoring across five signal types.
  • Cluster review procedure.
  • RG check on linked accounts.
  • Consent and privacy review for device data.
  • Link scoring calibrated on confirmed cases.
  • Action matrix for linked accounts.

Frequently asked questions

What is multi-accounting?

Holding more than one account at the same operator.

Is having two accounts illegal?

It usually breaches terms; in New Jersey, rules allow one account per patron per operator.

How do casinos detect multiple accounts?

By linking shared identity, payment, device, network and behaviour signals.

Can family members use the same device?

Yes, which is why device links alone are not enough to act.

What happens to linked accounts?

Duplicates are usually closed, offers voided under terms and deposits returned.

Does KYC prevent multi-accounting?

It prevents most of it, because a verified identity can only be used once.

Why does multi-accounting matter for safer gambling?

A second account can bypass limits and self-exclusion.

Is device fingerprinting legal?

It can be, but the ICO says consent may be needed under PECR.

What weight should an IP match have?

Low on its own, because many people share IPs.

What if a self-excluded player opens a new account?

Close it, return deposits and review safer gambling processes.

Sources

  1. N.J.A.C. 13:69O-1.3 (Justia)
  2. ICO: response to Google’s policy change on fingerprinting (December 2024)
  3. Geldwäschegesetz section 16
  4. SBC News: LUGAS and the GGL
  5. Gambling Commission: LCCP 3.5.5
  6. Shufti: Brazil bets KYC playbook

Bonus abuse

The common bonus abuse schemes, how to detect them and how to enforce terms fairly.

Device fingerprinting basics

What device fingerprinting is, what it catches, and the consent rules that apply.

Account takeover

How player accounts are taken over, the signals to watch, and recovery that does not help attackers.

Self-exclusion schemes

GAMSTOP, Spelpaus, OASIS, Cruks, BetGuard, Brazil’s platform and US state lists compared.

AML red flags for operators

The payment, gameplay and customer warning signs that should trigger review.

Further reading elsewhere