Fraud prevention and signal governance
Fraud controls in gambling act on real people's money: blocking a deposit, holding a withdrawal or closing an account. Good governance means every rule and score has an owner, a documented purpose, a way to be challenged and a measured effect, so that prevention does not become unfair friction for legitimate players.
Principles
- Proportion: the stronger the action, the stronger the evidence needed. Slowing a login needs less than closing an account with a balance.
- Combination: no single signal, such as an IP address or device fingerprint, should decide on its own; OWASP warns both can be spoofed or circumvented.
- Human review: people decide where money is withheld or accounts closed, with clear criteria.
- Challenge: players can ask for a review and get an answer in reasonable time.
- Measurement: every rule's effect is tracked, including false positives.
A rule register
| Field | Why it matters |
|---|---|
| Purpose and owner | Someone answers for each rule and its effects. |
| Data used | Shows the rule only uses data you are entitled to use for this purpose. |
| Action taken | Challenge, hold, review or block, and who can override. |
| Expected and measured outcomes | Fraud caught, false positives, support contacts. |
| Review date | Rules decay as attackers adapt and products change. |
Friction where it counts
Put the strongest checks on the highest-risk moments: new payout destinations, contact detail changes, large or unusual withdrawals, and bonus claims. Keep low-risk journeys smooth. In Great Britain, the Gambling Commission has said it is not acceptable for operators to introduce friction when a customer tries to withdraw, so withdrawal checks need to be targeted and quick.
Automated decisions
Fully automated decisions with significant effects on people, such as closing an account, can engage data protection rules on automated decision-making in the UK and EU. In the UK, the revised rules in section 80 of the Data (Use and Access) Act 2025 came into force on 5 February 2026 under SI 2026/82. They keep safeguards for significant decisions made solely by automated means, including information about the decision and the ability to contest it and obtain human intervention. Requirements differ in the EU and elsewhere; take legal advice for your markets.
Testing rules
Before switching a rule on, run it in monitor-only mode and measure how many legitimate players it would affect. Check whether it falls unevenly on groups of players, such as those on shared networks or using assistive technology. Re-test after product changes.
Questions about fraud signal governance
Should fraud systems close gambling accounts automatically?
Closing an account or withholding funds is a significant decision. Good practice is human review with clear criteria, and data protection rules on automated decisions may apply.
How do you measure whether a fraud rule is working?
Track confirmed fraud it caught, legitimate players it affected, support contacts it caused and losses avoided, and review regularly as patterns change.
Sources
- OWASP, Credential Stuffing Prevention Cheat Sheet (on spoofable signals)
- Gambling Commission blog on withdrawals (18 July 2024), as cited
- The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82), made 29 January 2026
- All sources checked 24 October 2026.