Bonus Abuse in iGaming: How Operators Detect and Prevent It
Promotions are how iGaming operators win players, and bonus abuse is how a minority of them turn those promotions into a direct loss. By one widely cited estimate, bonus abuse accounts for around 63.8% of all fraud in the iGaming sector, more than card fraud or identity theft ( 2025 iGaming Fraud Report). The uncomfortable part is that most of it is not classic external fraud with a stolen card. It is first-party abuse: real or fabricated people opening more accounts than they should, to claim promotions they were never meant to claim.
That single fact shapes everything about how you stop it. Bonus abuse is, at its root, an identity and multi-accounting problem, and the cheapest place to solve an identity problem is at the front door.
This guide explains what bonus abuse is, the bonuses and tactics involved, how organized syndicates industrialise it, how bonus funds get funnelled into high-volatility game features, and the layered controls operators use, with identity verification at onboarding as the highest-leverage one. For how this fits the wider sector, see our overview for iGaming operators.
What Is Bonus Abuse?
Bonus abuse, also called promo abuse, promotional abuse or bonus hunting, is the exploitation of an operator's promotional offers beyond their intended use, almost always by holding more than one account, in order to extract value with little or no genuine play behind it. It sits on a spectrum.
At one end is the casual opportunist who opens a second account to grab a welcome offer twice. At the other is a professional ring running thousands of accounts as a business.
It is worth drawing the line between a sharp but legitimate player and an abuser. Chasing the best promotions, reading the terms, and timing a deposit is not abuse; operators design bonuses to attract exactly that behaviour.
Abuse begins when a player breaks the rules that make the promotion work, most commonly by creating multiple or fake accounts, by misrepresenting who they are, or by exploiting a loophole the terms did not foresee.
Because the abuser is often a real customer rather than a thief using stolen data, bonus abuse frequently slips past tools built to catch third-party fraud.
The Bonuses That Get Targeted
Almost any promotion can be abused, but a few are magnets because they pay out quickly or with little commitment. Knowing which offers draw abuse helps you design terms and set risk thresholds before a campaign goes live:
Welcome and no-deposit bonuses, the classic target, because they reward account creation itself.
Deposit-match bonuses, which also attract stolen-card deposits and the chargebacks that follow.
Free spins and free bets, often harvested at scale with bots.
Cashback and reload bonuses, farmed by coordinating deposits and withdrawals across accounts.
Refer-a-friend offers, abused through self-referral loops and fabricated identities.
Loyalty and VIP rewards, collected by accounts kept alive purely to accrue points.
The Main Types of Bonus Abuse
Underneath the different offers, a handful of techniques recur. Most share the same engine, multiple accounts, and differ mainly in how value is extracted:
Type | How it works |
|---|---|
Multi-accounting (gnoming) | One person or ring runs many linked or fake accounts to claim the same offer repeatedly; gnoming keeps accounts alive long-term to farm ongoing rewards |
Bonus cycling / hunting | Sign up, bet the minimum to qualify, withdraw, then repeat across sites, sometimes with bots |
Reload and loyalty abuse | Coordinated deposits, withdrawals or play across accounts to farm reloads and loyalty points |
Arbitrage / cross-betting | Betting all outcomes across bookmakers, or across bonus and real funds, to lock in risk-free value |
Chip dumping | Deliberately losing to a controlled account in poker, which doubles as a money-laundering method |
Affiliate and referral fraud | Self-referral loops, or rogue affiliates generating fake sign-ups to earn commission and bonuses at once |
The Bonus Abuse Lifecycle
However it is dressed up, organized bonus abuse follows the same four steps: create accounts, claim bonuses, unlock and convert the value through play, and cash out. Mapping it this way makes the key point obvious: each step is cheaper to stop than the one after it, and the first step is an identity decision.
Bonus abuse is cheapest to stop at account creation and hardest once funds are cashing out.
Bonus Stacking: When the Terms Create the Loss
Stacking is abuse through combination. In its simple form, a player sequences offers, welcome, then reload, then cashback, then free spins, so that each one props up the next and the wagering requirement is cleared at minimal risk.
In its organized form the stack goes sideways: the same offer is claimed across many accounts, or across several brands owned by the same group, multiplying a single promotion into dozens of payouts.
The defensive lesson is that stacking only pays when the terms allow it. Much of the exposure is created before any fraudster appears, in promotions that can be combined, chained or claimed per account rather than per person.
Tightening the terms, limiting one bonus per identity rather than per account, and preventing offers from being combined, removes the expected value that makes stacking worthwhile in the first place.
Organized Syndicates and Their Toolchain
The accounts behind large-scale abuse are rarely run by lone players. They are run by professional operations, account farms, that treat bonus extraction as a business. Understanding their toolchain, at a defensive level, explains why some controls fail and others hold:
Identity sourcing. Farms use real identities (sometimes rented from willing people or recruited friends and family), identities from data breaches, and synthetic identities assembled from mixed data. Markets exist for aged, pre-verified accounts, which is why account age alone is a weak trust signal.
Device and network spoofing. Anti-detect browsers and virtual machines spoof operating system, screen resolution, time zone and browser fingerprints, while residential and mobile proxies defeat IP and geolocation signals. This is why device-only defences degrade against determined rings.
Automation. Bots and emulator farms create accounts, claim offers and place qualifying bets at a scale no manual review can match.
Affiliate collusion. Some rings pose as or work with affiliates, so the same operation collects acquisition commission and bonus value together, blending bonus abuse with affiliate fraud.
The common thread is that a syndicate is only powerful because it can pass as many different people. Break the link between an account and a unique, verified human and the economics of the farm collapse, which is the argument for an identity-first defence later in this guide.
Using Bonus Funds to Trigger Game Features
One of the most overlooked exploits sits at the meeting point of bonus terms and game mechanics. Because an abuser is playing the operator's money rather than their own, the rational move is to route bonus funds into the highest-variance outcome available and chase the big payout with no personal downside.
In slots, that means the feature or free-spin round, where the large multipliers live. Where a game offers a bonus-buy or feature-buy option, and where the terms allow bonus funds to be used on it, the abuser can effectively buy the high-variance feature on the house.
Even without a buy feature, a positive-value bonus combined with a high-volatility title and a generous maximum bet lets a player convert bonus balance into withdrawable feature wins far more efficiently than normal play would. The exploit is not a secret technique so much as a gap in the terms. The defences are correspondingly concrete, and most operators under-use them:
Game eligibility and weighting: restrict which games count toward wagering, and weight high-volatility or feature-buy titles low or at zero.
Bonus-buy exclusion: prohibit the use of bonus funds on feature-buy or bonus-buy mechanics.
Maximum bet with an active bonus: cap stake size while bonus funds are in play, so a single spin cannot swing the whole balance.
Maximum win or conversion caps: limit how much bonus-derived balance can be withdrawn, removing the top-end payoff that makes feature hunting worthwhile.
What Bonus Abuse Costs Operators
The cost is larger than the individual payouts suggest, because abused bonuses buy no real customers and distort every acquisition metric built on them. The figures below come from fraud-prevention vendors and industry press, so treat them as directional rather than precise, but the direction is consistent:
Bonus abuse is estimated at around 63.8% of all iGaming fraud (Sumsub, 2025), the single largest category.
Operators commonly cite losses of roughly 10 to 20% of annual revenue to fraud, with bonus abuse the costliest type, and some estimates put bonus-related leakage near 15% of gross gaming revenue (Sumsub; GBG; SEON).
Around 83% of operators reported fraud increasing in 2024, with a large share concentrated at the deposit phase (Sumsub, cited by EveryMatrix).
One UK bonus-abuse scheme using more than 1,000 accounts earned roughly £236,000 before the operator was jailed for five years (Sumsub), a reminder that organized abuse is prosecutable fraud.
From January 2026, the UK's cap limiting wagering requirements to 10 times the bonus also removes one of the older defences, making bonuses easier to clear and raising the premium on upstream controls.
How Operators Detect and Prevent Bonus Abuse
No single tool stops bonus abuse. Operators layer controls so that if one is spoofed, another still fires, and so that genuine players are not punished along the way. The table maps the main controls to what they catch and where each one is weak:
Control | What it catches | Limitation |
|---|---|---|
Enforceable bonus and game terms | Stacking, feature-buy and max-bet exploits | Only as strong as the drafting and the enforcement |
Identity verification at onboarding | Duplicate, fake and synthetic accounts | A verified person can still run one account; needs linking |
Device and behavioural intelligence | Repeat devices, velocity, play patterns | Degrades against anti-detect browsers and proxies |
Risk scoring and account linking | Coordinated rings across accounts | Needs cross-account and sometimes cross-brand data |
Monitoring and cash-out holds | Bonus cycling, chip dumping, mule cash-out | Post-hoc; value may already be at risk |
Why Identity at Onboarding Is the Highest-Leverage Layer
Every control matters, but they are not equal in cost or effect. The lifecycle diagram makes the point: the abuse begins when accounts are created, so the control that works there prevents the rest. If a real, unique, live human has to be verified before a bonus is granted, the account farm loses its core capability, which is to pass as many different people.
This is also why device-only defences are not enough on their own. Anti-detect browsers and residential proxies are built precisely to defeat device and IP signals, but they cannot produce a different genuine face and government document on demand. Binding each account to a verified identity, with document verification and biometric liveness that resists fake IDs and deepfakes, is what actually scales against farms. Identity verification alone will not catch a single determined player opening one account, which is why it works together with account linking and monitoring, not instead of them.
Balancing Prevention With Player Experience
The risk runs both ways. The bluntest anti-abuse rules also punish legitimate players: blocking a shared IP blocks a household, and a strict one-bonus-per-device rule penalises family members on the same computer. Treat shared devices, IPs and VPN use as signals that feed a risk score, not as automatic bans, and keep a documented appeals path so that enforcement decisions can be explained to a player and, when it matters, to a regulator. The aim is to raise friction precisely where risk is high and keep it invisible for everyone else, which is the logic behind risk-based, dynamic verification during digital onboarding.
The Responsible-Gambling and Regulatory Angle
Multi-accounting is not only a fraud problem. A player who is self-excluded, or who has hit a deposit limit, can use a second account to get around their own protections, which turns weak multi-account detection into a responsible-gambling and licensing risk under regimes such as the UK Gambling Commission and the Malta Gaming Authority. The same evidence that links accounts for fraud purposes supports self-exclusion and deposit-limit enforcement, so an identity-first programme pays twice: it protects margin and it supports duty of care. Chip dumping and high-roller bonus schemes also shade into money laundering, which brings AML obligations into the same picture.
How Qoobiss Helps
Qoobiss gives iGaming operators the identity layer that the rest of the defence depends on, used within its stated capabilities:
Onboarding and verification. Origin builds no-code onboarding workflows with built-in KYC and AML checks and API links to core systems, while Ontrace handles remote document and biometric verification with liveness, so a real, unique person is confirmed before a bonus is granted. Age verification fits the same flow.
Screening. Omnicheck adds sanctions, PEP and adverse-media screening.
Monitoring and oversight. Overwatch runs transaction monitoring and correlates alerts across accounts, which helps surface the chip-dumping, mule cash-out and entity-linkage patterns tied to laundering.
Fraud prevention across the lifecycle. Qoobiss's fraud prevention tools help connect verification with ongoing risk signals, including against account takeover of legitimate players.
Device and behavioural analytics remain an important complementary layer, typically from specialist tooling; the point is that they work far better once every account is anchored to a verified human.
Stop Bonus Abuse at the Front Door with Qoobiss
Most bonus abuse is an identity problem wearing a promotions costume, and the cheapest place to solve it is before the bonus is ever granted. Qoobiss helps operators verify a real, unique player at onboarding and keep that assurance current across the relationship. See how Qoobiss supports iGaming operators, or get in touch to talk through your bonus-abuse controls.
Bonus Abuse - FAQs
What is bonus abuse in iGaming?
Is bonus abuse illegal?
What is multi-accounting?
How do casinos detect bonus abuse?
What is a bonus-buy or feature-buy exploit?
How can operators prevent bonus abuse without hurting real players?
