Payment security and fraud signals
Payment security in gambling has two halves: protecting card data, which PCI DSS governs, and stopping fraud that uses the payment flow, from testing stolen cards to redirecting payouts. The best results come from keeping card data off your own systems and watching the whole payment flow from deposit to payout.
Protecting card data
PCI DSS applies to anyone who stores, processes or transmits cardholder data. The simplest way to reduce risk and audit scope is not to handle card numbers at all: use hosted payment fields or pages from a PCI-compliant provider and store tokens. The website that embeds the payment form still matters, because a compromised script on the page can capture card details. Restrict and monitor the scripts allowed on payment pages, and use a strict content security policy. Our PCI DSS page sets out the current version and dates.
Card testing
Fraudsters use gambling deposit pages to check whether stolen cards work, often with many small deposits across many accounts. OWASP's automated threats catalog names this OAT-001 Carding, and guessing missing card details OAT-010 Card Cracking. Defenses include velocity limits per card, account, device and network; blocking repeated declines; requiring verified accounts before deposits; and strong customer authentication where it applies. See our bot mitigation guide.
Payment fraud signals
- Many cards tried on one account, or one card on many accounts.
- Card name or country that does not match the verified account.
- Deposits followed by withdrawal with little or no play.
- Change of payout destination soon after a login from a new device.
- Spikes in declines or chargebacks from a single source.
The FATF's September 2026 report on gaming and gambling risks lists indicators that overlap with these, such as discrepancies between customer and payment information and the use of multiple accounts and payment methods under different identities.
Protecting payouts
A payout to an attacker-controlled account is a direct loss. Re-authenticate before adding or changing a payout destination, notify the player through existing contact details, consider a short hold on first payouts to new destinations, and prefer paying back to the original deposit method where rules require or allow. Keep these checks fast for genuine players.
Questions about payment security
What is card testing on gambling sites?
Using deposit pages to check whether stolen cards work, usually with small amounts. OWASP calls it OAT-001 Carding. Velocity limits, verified accounts and decline monitoring are the main defenses.
Does using a payment provider remove PCI DSS duties?
It reduces them a lot if card data never touches your systems, but the pages that load the provider's payment form remain in scope, and your acquirer will set the validation you need.
Sources
- PCI Security Standards Council blogs (June and August 2024)
- OWASP, Automated Threats to Web Applications (v1.3)
- FATF, Risks of Gaming and Gambling, press release of 9 September 2026
- All sources checked 24 October 2026.