This piece is part of PhishFort’s broader work protecting gambling and betting platforms. For the full picture on fraud detection across iGaming generally, see our iGaming fraud prevention guide, the account-correlation techniques described there apply directly to gnoming and chip-dumping too. Here, we’re going deep on this one specific pattern.

Why Multi-Accounting Isn’t Just a Bonus Problem

It’s easy to file multi-accounting under bonus abuse and move on, but that undersells what’s actually at stake. A player opening a second account to dodge a deposit limit or a self-exclusion restriction isn’t just gaming a promotion, they’re circumventing a responsible-gambling control the operator is often legally required to enforce. Regulators treat that differently than ordinary fraud, and operators that can’t catch it face compliance exposure on top of the financial loss.

Gnoming: When Multi-Accounting Becomes Collusion

In poker specifically, multi-accounting takes a more deliberate form known as gnoming. One player controls two or more seats at the same table, allowing them to team up against unsuspecting, honest players. Gnoming is hard to catch through gameplay analysis alone, because the accounts are designed to behave like separate people. The tell is almost always in the infrastructure underneath the accounts, not in how they play.

Chip-Dumping: Multi-Accounting as a Laundering Mechanism

Chip-dumping uses multiple accounts differently. Instead of gaining an information edge, one account deliberately loses chips or funds to another, often across supposedly unrelated players. It’s a way to move value between accounts without triggering the payment-fraud checks that would flag a direct transfer, and it’s frequently used to launder funds from other fraud schemes running elsewhere on the platform.

How Multi-Accounting Detection Actually Works

Catching this reliably comes down to correlating signals that don’t show up in any single account’s history on its own.

Device fingerprinting. Accounts that share a device, or a small cluster of devices, are the first and strongest signal. This is the same underlying technique used across iGaming fraud detection generally, it’s not a separate system, just applied with multi-accounting-specific correlation rules.

IP and network correlation. Shared IP ranges, especially residential proxy pools rotating through a consistent set of addresses, are a strong secondary signal when combined with device data.

Behavioral timing patterns. Accounts that consistently play, deposit, or fold in coordinated timing windows, especially at the same table or in the same session, strongly indicate gnoming.

Fund flow analysis. For chip-dumping, the tell is in the transaction graph: consistent one-directional value transfer between a specific set of accounts, especially when it doesn’t match normal win/loss variance.

None of these signals alone is conclusive. Real detection comes from correlating two or three of them together, which is why device fingerprinting and behavioral analytics need to work as one system rather than separate tools bolted together.

What This Means for Operators

If your platform includes poker, skill-based games, or any format where players compete directly against each other rather than against the house, multi-accounting detection deserves its own attention within your broader fraud prevention setup, not just a general bonus-abuse rule. The underlying detection infrastructure, device fingerprinting and behavioral correlation, overlaps with what’s covered in our iGaming fraud prevention guide, but the specific correlation rules for gnoming and chip-dumping need to be built and tuned on top of that foundation, not assumed to come for free.

See how PhishFort protects gambling and betting platforms →

This guide focuses specifically on iGaming, meaning platforms centered on real-money wagering (casinos, sportsbooks, poker). If you’re looking at fraud prevention across gaming more broadly, including non-gambling platforms like esports and in-game economies, see our companion guide on gaming fraud prevention.

What Counts as iGaming Fraud

Fraud in iGaming covers more ground than most people expect. The categories that matter most:

Bonus and promotion abuse. Players, often working in coordinated groups, exploit welcome bonuses, free spins, or deposit-match promotions using multiple accounts, fake documentation, or scripted play patterns designed purely to extract bonus value without genuine play.

Multi-accounting. A single individual operates several accounts to bypass deposit limits, self-exclusion restrictions, or promotional caps. This one matters beyond the financial hit, as it directly undermines responsible-gambling controls that regulators require operators to enforce.

Payment fraud. Stolen card data, synthetic identities, or compromised e-wallets used to fund accounts, often followed by a chargeback once winnings are withdrawn. The operator absorbs both the payout and the reversed deposit.

Collusion. Most visible in poker and other skill-based games. Players coordinate to gain an unfair advantage over other players, sometimes combined with chip-dumping schemes to launder funds between accounts.

Account takeover (ATO). Credential-stuffing or phishing campaigns compromise legitimate player accounts, after which the attacker drains stored balances or exploits saved payment methods. For a broader look at how these campaigns typically start, see our guide to online gambling scams.

Why iGaming Fraud Needs a Different Approach

General e-commerce fraud tools are built around a single moment: the transaction. iGaming fraud unfolds over time, across sessions, and often across accounts that look unrelated on the surface.

A few things make this space genuinely harder than standard fraud prevention.

Regulatory exposure compounds financial loss. A gaming license typically comes with explicit anti-fraud and responsible-gambling obligations. Failing to catch multi-accounting or self-exclusion violations isn’t just a financial miss, it’s a compliance failure that regulators can and do penalize separately from the fraud itself.

Chargebacks hit twice. When a fraudulent deposit funds play and the player wins before the chargeback is filed, the operator loses the deposit and pays out the winnings. Standard e-commerce fraud tools, built around simple purchase-and-refund logic, don’t model this correctly.

False positives cost real players, not just conversions. Blocking a legitimate high-value player over a false fraud flag is a different kind of loss than losing a one-time retail sale. It’s the loss of a customer’s lifetime value, and in a competitive licensed market, that player has other operators to choose from immediately.

Fraud and responsible gambling overlap. A player opening a second account isn’t always fraud in the traditional sense. Sometimes it’s a self-exclusion violation, which carries its own regulatory reporting requirements. Detection systems built purely for financial fraud tend to miss this overlap entirely.

What Makes a Fraud Detection Solution Actually Effective

Not all fraud prevention tools are built for the specific shape of iGaming risk. The ones that hold up in practice share a few characteristics.

Real-time risk scoring. Fraud signals need to be evaluated at the moment of registration, deposit, and withdrawal, not batched and reviewed hours later after the damage is done.

Device and behavioral fingerprinting. Multi-accounting and bonus abuse rely on making separate accounts look unrelated. Device fingerprinting, IP correlation, and behavioral pattern matching, typing cadence, navigation patterns, session timing, catch the connections that account-level data alone misses.

KYC/AML integration, not a bolt-on. Identity verification and fraud detection need to share signal. A document that fails verification and a device already flagged for suspicious deposit patterns should compound risk, not sit in two separate systems that never talk to each other.

Tunable false-positive thresholds. Operators need control over sensitivity by player segment. A newly registered account with a large first deposit deserves more scrutiny than a five-year player with a clean history, and the system should let you configure that difference rather than applying one blunt threshold everywhere.

Cross-operator threat intelligence. Fraud rings rarely target a single operator. Solutions that share anonymized threat signals across a broader network catch known bad actors faster than any single operator’s data can on its own.

How Operators Actually Implement This

Rolling out fraud prevention without disrupting existing operations comes down to a few practical steps.

Start with an audit of current loss patterns. Before evaluating vendors, know where the losses are actually concentrated: bonus abuse, payment fraud, ATO, or a mix. This shapes which capabilities matter most for your specific platform.

Plan the integration path early. Most modern fraud detection solutions integrate via API into the registration, deposit, and withdrawal flows. The integration effort is usually smaller than expected, but it needs to be scoped against your existing platform architecture before committing to a timeline.

Tune before you enforce. Run new detection rules in monitoring-only mode first, review what would have been flagged, and adjust thresholds before switching to active blocking. Skipping this step is the most common reason operators end up with either too many false positives or missed fraud in the first weeks after launch.

Train support and compliance teams together. Fraud detection generates flags that customer support and compliance teams both need to act on, often for the same case. Siloed training leads to slow, inconsistent responses exactly when speed matters most.

A Real-World Example

PhishFort has worked directly with iGaming operators on exactly this kind of threat. See how we handled fraud detection end-to-end for a confidential iGaming operator →

Where This Is Heading

Fraud detection in iGaming is moving in two directions at once. On the detection side, machine learning models are getting better at catching behavioral patterns that don’t fit any predefined rule, catching novel fraud tactics before they’re common enough to write a rule for. On the collaboration side, cross-operator and cross-platform threat sharing is becoming a genuine differentiator. Fraud rings identified and blocked by one operator increasingly get flagged across a shared network before they can move on to the next target.

For operators, this means the fraud prevention question is shifting from “can we detect this fraud pattern?” to “how fast can we detect it, and how much of what we learn gets shared beyond our own platform?”

Get Ahead of iGaming Fraud

Detecting fraud after the fact means the damage, financial, regulatory, or reputational, has already happened. PhishFort helps iGaming operators identify fraudulent activity, impersonation, and brand abuse targeting their platform before it reaches players.

See how PhishFort protects iGaming platforms →