Fraud investigation evidence and privacy controls
When fraud or a security incident is suspected, the evidence an operator can produce decides what happens next: whether a player keeps their account, whether a regulator is satisfied, whether a prosecution succeeds. Good evidence starts long before the incident, with logging, time synchronization and access-controlled storage.
What to log before you need it
| Event | Useful fields |
|---|---|
| Login and logout | Time, result, device, network, MFA used |
| Account recovery and changes | What changed, from and to, channel, agent if manual |
| Deposits and withdrawals | Amount, method, destination, status changes |
| Bonus claims | Promotion, eligibility checks, outcome |
| Admin actions | Who, what, why, approval |
Synchronize clocks across systems so events can be sequenced, and protect logs from alteration. OWASP Top 10:2025 lists "Security Logging & Alerting Failures" as A09, and Ontario's AGCO standard 5.10 requires security events to be logged, monitored and promptly analyzed.
Chain of custody
- Record who collected each item, when, from which system and how.
- Store copies in an access-controlled location with access logged.
- Use hashes or read-only exports so you can show evidence has not changed.
- Keep analysis notes separate from original evidence.
Privacy limits
Investigations do not suspend data protection law. Collect what the investigation needs, limit who can see it, and keep it no longer than necessary for the investigation, any dispute and legal duties. Where the incident is a personal data breach, the evidence also supports reporting decisions: under UK GDPR, notifications made after 72 hours must give reasons for the delay. In Canada, the Breach of Security Safeguards Regulations require a record of every breach to be kept for 24 months.
Sharing with others
Evidence may need to go to a gambling regulator, police, a payment provider or another operator. Check the legal basis for each disclosure, share the minimum, and record what was shared and why. Ontario's notification matrix, for example, requires suspicious behavior, cheating at play and other unlawful activity (money laundering is handled separately) to be reported to the AGCO immediately, and says personal information must be left out of that submission.
Questions about investigation evidence
How long should gambling operators keep security logs?
Long enough to investigate incidents and meet legal duties, balanced against data protection limits. Set periods by log type and document the reasoning; Canada requires breach records to be kept for 24 months.
What is chain of custody?
A record of who collected a piece of evidence, when and how, and everyone who has handled it since, so you can show it has not been altered.
Sources
- OWASP, Top 10:2025 (A09)
- AGCO, Registrar's Standards 5.10 and Internet Gaming Notification Matrix v1.6
- UK GDPR Art. 33; Canada SOR/2018-64
- All sources checked 24 October 2026.