How the attack works
A welcome bonus with a clearable wagering requirement is a priced instrument. Professional bonus abuse is the business of buying it repeatedly at a discount, and at the top end it is genuinely industrialised: recruited document holders, funded cards, and a technical stack whose entire job is to make one operator look like forty customers.
- An antidetect browser profile per account, each with its own canvas, WebGL, fonts, screen metrics and timezone, kept stable so the account can return and clear its wagering.
- A residential proxy exit per account, ideally in-region, so geolocation agrees with the documents.
- Real identity documents, either rented from willing participants for a cut or bought outright. This is the part that defeats KYC, and it defeats it completely — there is nothing wrong with the documents.
- Payment instruments that match the identity, so deposit-side checks agree too.
Every layer is designed against a control you are required by licence to operate. That is the uncomfortable part: a fully compliant onboarding process is not an obstacle to this attack, and treating KYC as a fraud control is the most common structural mistake in the sector.
Why KYC cannot stop it
KYC answers "is this a real person, and are they who they claim". Against a ring using rented real identities the answer is yes, truthfully, every time. The question that would separate them — "are these forty people actually one operator" — is not an identity question at all. It is a question about infrastructure: the connections and the browser environments the accounts arrive through.
Device fingerprinting would be the natural place to catch it, and antidetect browsers exist precisely to defeat device fingerprinting. A fresh profile per account is a genuinely new device by every attribute a fingerprint measures.
What the verdict returns
Screened at registration, and again at first deposit:
{
"decision": "block",
"risk_score": 96,
"reasons": [
"antidetect_browser",
"browser_tampering",
"residential_proxy",
"multi_account_device"
],
"network": { "proxy": true, "datacenter": false },
"device": {
"antidetect": true,
"tampering": true,
"linked_accounts": 14,
"multi_account": true
}
}device.antidetect is the field KYC has no equivalent for. It does not ask whether the fingerprint has been seen before — it asks whether the browser environment is being managed by a tool built to lie about it, which stays true no matter how new the profile is.
Where to screen, and where not to
Registration and first deposit are the two points worth spending a call on. Screening every page view of a logged-in session buys nothing and adds latency to a product where latency is a product feature.
On the middle band, hold the bonus rather than the account. A plain VPN returns review, and in this sector VPN use among entirely legitimate players is high enough that refusing on it is a self-inflicted commercial wound. An account that can play with its own money and cannot claim a promotion until a manual check clears is a proportionate answer, and it is also the one your regulator will find easiest to accept.
The arithmetic
A worked model. Replace the inputs with yours.
| Input | Model value | Yours |
|---|---|---|
| Welcome bonus value | €150 | — |
| Ring accounts cleared per month | 96 | — |
| Expected loss per cleared bonus after wagering | €45 | — |
| Manual review cost per flagged account | €6 | — |
96 × €45 = €4,320 a month in realised bonus loss, or roughly €52,000 a year, before the cost of reviewing them. The third input is the one worth arguing about internally: the headline bonus value overstates the loss, because wagering requirements mean the house edge recovers part of it even from an abuser. Modelling on the headline number will make the problem look twice its real size, and any decision built on that will be wrong in a predictable direction.
The licensing angle
Bonus abuse is a commercial loss. Two things adjacent to it are not: an account whose real controller is not the person who passed KYC is a beneficial-ownership problem, and coordinated multi-accounting is a recognised money-laundering typology in gambling. That changes who cares about this internally — the evidence that a set of accounts shares infrastructure is a compliance artifact, not just a fraud one, and it is worth retaining as such.