The presentation is about essentials in Fraud origin in i-gaming industry and its potential protection.

1. Fraud in Igaming 101
Martyn Sukys, 2018 January, Betsson Group, Malta

2. Last year, in the UK alone, almost 11bn GBP (13.5bn USD) was lost to fraud and cybercrime.

3. “20% of all online financial frauds can be attributed to igaming”
Mastercard (Europay)
But Why?

4. Most igaming operators are transitioning to premium models that enable customers to
save credit card numbers and other identity information to their accounts—creating
irresistible opportunities for cyberthieves.
“Gambling sites have been seeing dramatic and sustained spikes in bot attacks this year.
Bots make up as much as half of all daily traffic during key attack peaks.”
Quarterly cybercrime report from ThreatMetrix.

5. 94% of Companies Reported Fraud-Related Issues
82% of the survey’s respondents were dissatisfied with the
payment systems that are integrated into their casino gaming
platforms
CASEXE conducted a survey across over 50 successful online gambling businesses in Europe and the Commonwealth
independent states

6. Gambling Fraud. Multiple account fraud
Fraudsters create dozens or hundreds of accounts using fake credentials in order to tilt the balance in their favor
online. For instance, they could use it for:
● Bonus abuse: numerous fake accounts benefit from new signup bonuses, coupons and other attractive
offers. While these promos are an excellent way to attract new players, they can quickly make your platform
run at a loss if you hand out too many of them.
● Gnoming: using multiple accounts to help one player win. The other accounts are used to lose deliberately so
one can pocket all the wins and bonuses that go with it.
● Chip dumping: this is a practice found at the poker table. Like with gnoming, the idea is to make multiple
accounts join the same table in order to cheat the system and influence the results in favor or against one
particular player.
● Impersonation: playing on behalf of another individual. Can be without their consent or with consent. ,
Threat actors would also look for proxy servers using RDPs and SOCKS5 VPN, through which they’d be able to
conduct carding and impersonation. When the impersonation happens with consent, the experienced player
uses TeamViewer to play on behalf of a newbie - enjoying their privileges and scamming the gaming site in
return for profit percentages.

7. Gambling Fraud. Payment attacks
● Stolen credit cards (aka Carding): fraudsters can use stolen card information to top
up their account, that is using illegitimate money to pocket real wins.
● Chargebacks: this happens after the fraudsters have already topped their account.
They then request a chargeback from their banking or credit card provider, which
means getting refunded at the online gambling provider’s expense.
● Phone top up abuse: if your online casino offers phone top up, fraudsters now have
sophisticated ways of topping up their client. They call burner phone holders, and
trick them into topping up their balance, which actually goes to fund their gambling
accounts.

8. The dark web provides an incredible landscape where criminals help each other, and sell
information for unlawful purposes. If the company lets a fraudulent transaction through
easily, the ‘good news’ is quickly spread to other fraudsters. You can even buy detailed
guides on how to commit every type of fraud.
The good part - if fraud is detected and escalated, the news spread fast as well.
Fraudsters drop the idea of recurrent attack as a potential waste of time.
Image: Movie Unfriended: Dark Web

9. “Carding and Identity Theft (Impersonation) is the most emergent risk.”
IntSights

10. Where to look for fraud?
● Compromised Accounts
● Player Collusion
● Multi-Accounting/Account Sharing
● Bots
● Deposit Fraud
● Player Fraud (promo, deposit bonus, affiliate & rakeback abuse)
● Fraudulent Chip Dumping
● Responsible Gaming

11. How to protect?
● Build returning gamers gaming profiles
● Use monitoring platforms to know in advance whether data and credentials were
stolen or leaked, whether payment methods are stolen or fake, and when this
happened
● Train people to treat malicious emails. Fraudsters indeed target employees, usually
by using phishing methods.
● Implement users ID, Age verification, PEP check
● Implement Device fingerprinting tracking
● Perform IP analysis
● Perform Risk scoring

12. What’s on market?
● ID verification providers
● Politically exposed person list providers
● Anti Money Laundering regulators (AML)
● Sign up monitoring providers
● Log in monitoring providers
● Withdrawal and deposit monitoring providers
● Actual games and tables monitoring providers
Image: http://www.007.com/characters/the-bonds/

13. No site/tool/person is bullet proof, and game security
& fraud issues will always occur where there is
money involved, same as the real world