iGaming Fraud Prevention: How to Stop Bot-Driven Fraud at Signup, Login, & Promo Claim

A bot attack hit a major European sports-betting platform on the eve of the 2026 FIFA World Cup. In 87 seconds, it sent 786,000 requests, peaking at nearly 18,000 requests per second. DataDome detected and blocked the attack in real time, but the incident highlights how quickly automated threats can disrupt betting platforms.

For iGaming operators, the impact goes beyond service disruption. Bots can create fake accounts, exploit welcome bonuses, and target player logins, driving up fraud losses and investigation costs while putting genuine player experiences at risk.

The answer starts with stopping malicious automation early, before it moves through signup, login, and bonus claims. Bot protection is the layer that makes every other control work better: KYC, payment fraud controls, and anti-money-laundering monitoring then spend their time on real players, not scripts.

Here’s how.

Key takeaways

• Fake accounts, bonus abuse, and account takeover can begin at signup or login.
• Major sporting events and promotion launches create predictable windows for attacks.
• Bot detection complements KYC, payment fraud controls, and AML monitoring.

What is online gambling fraud, and why do operators get targeted?

Online gambling fraud uses deception, stolen information, or automation to take money, bonuses, or other value from operators or players.

Betting and casino platforms attract fraud because accounts can be created quickly, transactions happen around the clock, and promotions offer financial incentives. A fraudster might create several accounts to claim the same welcome bonus, use stolen credentials to access a player’s balance, or automate requests to disrupt a platform during a major event.

The impact extends beyond direct losses. Fraud can distort acquisition and affiliate metrics, increase chargebacks, create support and investigation work, undermine player trust, and expose operators to regulatory scrutiny.

And most gaming and gambling websites lack sufficient defenses. DataDome’s 2026 State of Bot & Agent Security Report found that 64% of gaming and gambling sites are unprotected against bots and spoofed AI agents. 

What are the main types of online gambling fraud?

Seven types can affect operators. Four are often bot-driven: fake accounts, bonus abuse, account takeover, and game manipulation or scraping. DDoS is another automated threat, focused on disrupting service rather than directly taking money.

How do fake accounts and multi-accounting work?

Multi-accounting happens when one person or group operates several accounts, often under different names or email addresses. The accounts may be used to claim welcome bonuses repeatedly, exploit referral incentives, or evade restrictions.

Some campaigns use scripts to create accounts at scale. Others rely on fabricated identities, human operators, or device farms. In poker, related tactics include gnoming, where one person controls multiple players, and chip dumping, where players deliberately transfer value to another account.

Individual accounts may look legitimate in isolation. Device fingerprints, network signals, registration behavior, and links between accounts can reveal the wider pattern.

How does bonus abuse work?

Bonus abuse occurs when players exploit promotional rules to collect value they were not meant to receive repeatedly. It can drain acquisition budgets while making campaigns look more successful than they are.

Warning signs include several new accounts sharing device or payment signals, repeated signups followed by minimum qualifying bets and rapid withdrawal attempts, or account clusters claiming the same offer in a similar sequence.

These signals do not prove fraud on their own. Families, shared networks, and legitimate players can have overlapping signals. Risk teams should combine them with account history, promotion rules, and behavior before blocking an account or withholding a payout.

How do credential stuffing and account takeover hit betting accounts?

Credential stuffing uses username and password combinations exposed in other breaches to try to access betting accounts. If players reuse passwords, attackers can test credentials that already work elsewhere rather than breaking the operator’s authentication system.

Bots can spread attempts across many IP addresses and keep each source below simple rate limits. Residential proxies make this harder because requests can appear to come from ordinary internet connections.

Once an attacker takes over an account, they may access personal data, abuse promotions, place unauthorized bets, or attempt to withdraw funds. See DataDome’s guides to credential stuffing prevention and account takeover prevention.

How do bots and scripts manipulate casino games and odds?

Scripts can automate play, execute repetitive actions, or collect odds and other platform data at scale. In multiplayer games, collusion can involve coordinated accounts or players sharing information to disadvantage legitimate opponents.

The signals depend on the game and behavior. Unusually repetitive actions, implausible interaction speeds, linked accounts, and high-volume data requests can all warrant closer assessment. Effective casino bot protection considers these signals in context rather than treating every fast player or shared IP address as malicious.

How do identity theft, payment fraud, and DDoS affect operators?

Identity theft uses another person’s details or fabricated information to open or access an account. Payment fraud can involve stolen card details, unauthorized deposits, or transactions later disputed through a chargeback. Money laundering involves disguising the origin or movement of funds.

These threats can overlap with bots, but they are not inherently bot-driven. Operators need identity verification, payment controls, account investigation, and AML monitoring alongside bot detection.

A distributed denial-of-service (DDoS) attack has a different goal: to disrupt availability by flooding a site or endpoint with requests. Scraping repeatedly collects odds or other platform data. Both can consume resources, and DDoS can cause slowdowns or service disruption. Defenses should assess request volume, session behavior, and endpoint context, not just individual requests.

Why do attackers target big events and promo launches?

Major sporting events and promotion launches concentrate traffic, financial incentives, and operational pressure. Attackers know operators are busy serving more players, adjusting odds, and managing high-value transactions. That makes event preparation a security task, not just a capacity-planning exercise.

During the 2026 FIFA World Cup, DataDome blocked nearly 19 million malicious requests in three weeks for one major European betting platform. On June 10, the eve of the opening match, a flash DDoS attack fired 786,000 requests in 87 seconds, peaking at nearly 18,000 requests per second. DataDome also reported that 91% of traffic from the identified Biterika Group infrastructure was malicious. 

Ahead of the Super Bowl, DataDome assessed account creation and login flows on the five leading betting platforms and found that all five lacked defenses against basic automation techniques. No CAPTCHA was triggered during the tests, even on sites that claimed to use reCAPTCHA. These findings apply to the five platforms assessed, not every betting site.  

Two types of attacks often take shape during these events: 

• Flash attacks: sudden bursts designed to cause disruption before a manual response can be organized.
• Sustained attacks: distributed activity that stays below obvious per-IP thresholds but accumulates over time.

A defense prepared for only one shape leaves a gap.

Before the next major event, use this checklist to prepare:

• Review the event calendar, promotional launches, and expected traffic peaks with security, product, and operations teams.
• Baseline normal request volume and behavior for signup, login, bonus, and payment endpoints.
• Test detection against both sudden request spikes and low-rate distributed automation.
• Confirm escalation paths, on-call ownership, and real-time blocking policies before the event.
• Monitor malicious traffic, legitimate-player approvals, and service performance together during the event.

How do you prevent online gambling fraud?

To successfully prevent online gambling fraud, you’ll want to stop malicious bots at signup and login, then layer identity, payment, and compliance controls behind them. Fake accounts and credential stuffing start at those entry points, so catching them early helps stop bot-driven fraud before it reaches your bonuses, deposits, and withdrawals.

DataDome covers that first layer with two products. Bot Protect analyzes every request using hundreds of client-side and server-side signals across your websites, mobile apps, and APIs. It stops malicious bots without adding friction for genuine players. Account Protect assesses intent at registration and login, and keeps assessing risk in real time beyond login.

Here is how the controls map to each stage of the player journey: 

Why do IP blocking and CAPTCHAs fail against betting bots?

IP reputation helps, but residential proxies can route automated traffic through addresses associated with ordinary users. Distributed campaigns can also rotate IPs to avoid per-address limits.

CAPTCHAs have limits too. Solving services and AI-based methods can defeat some challenges, while false positives create friction for legitimate players. DataDome recently stopped a CAPTCHA farm built specifically to beat a Slider challenge, blocking nearly 19 million ticket scalping attempts. 

For alternatives to traditional CAPTCHAs, see DataDome’s CAPTCHA alternative.

What should bot detection do at signup, login, and promo claim?

Bot detection should assess intent, not just the apparent identity of a request. It should combine behavior with device, browser, network, and session signals, then make decisions in real time. It should also cover websites, mobile apps, and APIs while allowing operators to manage trusted partners and affiliates.

DataDome evaluates requests in under two milliseconds, with 99.99% detection accuracy and a false-positive rate below 0.01%. The goal is to stop malicious automation without forcing genuine players, including VIPs, through unnecessary challenges.

See DataDome Bot Protect and Account Protect for more on bot and account-security controls.

Where do KYC, transaction, and account controls fit?

KYC helps establish or verify a player’s identity. Payment controls assess whether deposits and withdrawals are legitimate. Account monitoring can identify suspicious behavior or signs of compromise after registration, while AML monitoring looks for patterns that may indicate illicit movement of funds.

These controls complement bot detection. Filtering obvious automation earlier can reduce unnecessary verification and review work. Risk-based checks can then focus additional friction on sessions that need more scrutiny.

How have betting and gaming operators stopped bot-driven fraud?

Kaizen Gaming (Betano) faced bots creating fake accounts, exploiting promotional bonuses, and attempting credential stuffing. After deploying DataDome, the company reported a significant drop in bot traffic. Information Security Engineer Nikos Theodosiadis said: “We didn’t receive a single complaint about false positives or usability issues.”  

A leading gaming website faced bot-driven DDoS attacks, credential stuffing on its registration form, and frequent reCAPTCHA false positives. After implementing DataDome, it reported improved conversion and fewer CAPTCHA-related support complaints. Its Head of Product Delivery said: “It’s the right traffic that’s being blocked. Real customers aren’t getting any kind of occlusion, and our conversions increased.”  

A real-money gaming platform had a CDN bot-management layer, another vendor in full protection mode, and manual fraud review. Its payment processor still flagged more than 1,000 accounts for account takeover. In a two-week proof of concept, DataDome identified 27 times more fraudulent deposit attempts and 37 times more fraudulent withdrawal attempts than the incumbent vendor, based on traffic the existing controls had allowed through. 

How do you measure the return on fraud prevention?

Measure what the controls protect and what they cost, not just how many requests they block.

A simple starting point is to estimate the value of suspicious signups using the formula below:

Estimated bonus exposure = flagged signups × average bonus value per new account

Then compare that exposure with the value of legitimate players wrongly rejected or delayed, plus implementation, operating, and review costs. Treat the result as an estimate, as not every flagged signup would have successfully claimed a bonus, and not every blocked account represents a confirmed fraud attempt.

Track at least four measures together:

• Malicious signups and login attempts blocked.
• Estimated bonus value and transaction exposure prevented.
• Approval rate for legitimate players who go on to deposit.
• False-positive rate, conversion, and support complaints.

This gives finance, risk, and product teams a more balanced view. A high block count means little if genuine players are being turned away and fraudsters are still passing through with a low false-positive rate.

What changes with AI agents and residential proxies?

IP addresses and user-agent strings alone are increasingly unreliable indicators of intent. Residential proxies can make automated requests resemble ordinary consumer traffic, while scripts and AI-enabled tools can imitate parts of a user journey.

DataDome’s 2026 State of Bot & Agent Security Report found that more than 7 in 10 sites allow a spoofed AI agent or crawler through without any challenge. Additionally, the report found that AI agent spoofing increased 45% between February and July 2026.

 As the nature of automated traffic evolves, operators should assess intent across a session, verify claimed agent identities where relevant, and define which automated activity is permitted.

Stop bot-driven iGaming fraud before it costs you players 

Bots don’t wait for your next KYC check. They create accounts, claim bonuses, and test stolen credentials in seconds, often when your traffic and promotions peak.

DataDome stops them at the source. Bot Protect and Account Protect analyze intent across every session in under two milliseconds, on websites, mobile apps, APIs, and MCPs. With DataDome, malicious automation is blocked at signup, login, and promo claim, while genuine players, VIPs included, get through without friction.

Before your next major event:

1. Audit your signup, login, and bonus-claim flows for automation that gets through.
2. Test your defenses against both flash attacks and low-rate distributed ones.
3. Set policies for AI agents and other automation: which are allowed, which need verification, and which are blocked, so you decide instead of guessing.

Ready to see what’s getting through your defenses? Test your site with DataDome’s free vulnerability scan to see if you’re protected against bad bots and AI agents.