The online gaming industry has exploded, attracting not only millions of legitimate players but also sophisticated fraudsters who are looking to exploit vulnerabilities. In fact, two men were recently charged with defrauding FanDuel and other online gambling sites of $3 million using the stolen identities of approximately 3,000 victims.
From small-time scammers trying to abuse sign-up bonuses to large-scale operations laundering illicit funds, fraud in gaming has evolved into a global, high-stakes problem. This shift is proving that traditional identity checks — such as manual reviews, static data checks and basic Know Your Customer (KYC) processes — are no longer enough.
This is compounded by the fact that in many regions, regulatory boundaries remain weak and loosely defined, leading many operators to deliver only the bare minimum required by law. By treating compliance as a ceiling rather than a floor, these companies inadvertently create security gaps that fraudsters can easily exploit.
That’s why today’s gaming operators must move beyond reactive security and proactively monitor identities, transactions and behaviors — deploying face-based biometrics and advanced liveness detection to stay ahead of bad actors before they cause damage.
The Rise of Account Takeovers in Gaming
The need for proactive, continuous identity verification has never been more urgent as fraud becomes increasingly automated. AI is accelerating identity fraud and putting significant pressure on online gaming and betting platforms. Small groups of fraudsters can now steal hundreds of identities in minutes and operate as a full fraud ring.
These stolen identities contribute to account takeovers, one of the major problems for many gaming operators. Criminals are buying lists of stolen credentials, usually usernames and passwords from data breaches, to access user accounts or to create new ones. Once they sign in, they can transfer funds out of the account or simply use the account credits to gamble.
In the FanDuel case, fraudsters purchased the stolen personally identifiable information (PII) of approximately 3,000 victims on the darknet, then exploited background check services like TruthFinder and BeenVerified to gather additional details needed to pass knowledge-based authentication questions during onboarding. By combining darknet data with publicly accessible background services, bad actors were able to impersonate real victims and bypass static identity checks entirely.
Once these accounts were created, they were exploited at scale. When fraudsters operate these attacks, they can use multiple accounts to claim sign-up bonuses, free credits, and promotional rewards repeatedly. This enables them to carry out further scams, such as using the free credits to place bets on all possible outcomes to ensure a win, using multiple accounts to join the same table to help one of their accounts win, and intentionally losing in order to transfer money from one account to another.
Criminals aren’t just buying credentials to steal funds; they are also buying accounts. By purchasing aged accounts that have already been verified, they can oftentimes bypass initial onboarding friction and use these accounts for money laundering.
The Risks of Static Identity Checks
These advanced fraud schemes highlight the fundamental flaws in legacy verification tools. If platforms are only using a basic onboarding solution that can be easily bypassed by finding the right information online to answer knowledge-based questions, they risk significant financial losses as well as damage to player trust.
Not only can these platforms lose thousands of dollars, but stolen identities can also create massive compliance gaps for these businesses. If they can’t prove that they are preventing underage gambling or money laundering, operators risk massive fines and potential loss of license.
Some online platforms in the gaming space and beyond are more concerned about conversion and friction than securing their onboarding solution. This fear that robust checks will lead to player drop-off can present a blind spot that fraudsters can easily exploit. Implementing an advanced defense isn’t just about stronger identity checks, but rather smarter ones.
Advanced Fraud vs. Advanced Technology
To counter these increasingly sophisticated attacks, gaming operators must rethink how they approach identity verification by implementing a comprehensive identity intelligence solution. By using a layered approach with AI-driven tools, fraudsters using stolen IDs will ultimately fail onboarding checks and will be stopped in their tracks if they’re reusing the same credentials to open multiple accounts.
Implementing an identity intelligence solution involves these strategies:
- AI and Machine Learning Models: AI can analyze millions of data points across user behavior, transactions, and device activity to detect subtle anomalies. Through this analysis, it can continuously learn from new fraud patterns, enabling faster threat detection to stay ahead of organized fraud networks.
- Biometrics with Liveness Checks: By pairing a valid government-issued ID with a selfie and then using advanced liveness detection to confirm the user is physically present, gaming operators can reduce the risks of deepfakes and spoofing while strengthening authentication against account takeover, ensuring the user is always the same person who opened the account.
- Identity Network: Sharing fraud intelligence collectively can increase the probability of understanding if a stolen credential was used elsewhere, allowing an operator to identify fraud patterns before any damage occurs.
- Risk-Based Signals: Gaming and gambling sites should continuously analyze and assess aggregated data and activity across devices and transactions to detect emerging risks and support informed decision-making in identity verification. By using risk signals, operators can establish trust with legitimate players and only introduce friction if suspicious activity has been flagged.
Bank-Grade Security for High-Stakes Gaming
Robust identity verification doesn’t have to involve tedious onboarding processes. When operators are using identity intelligence, they can ensure that operators are only introducing friction when it’s absolutely necessary to protect conversion and prevent player drop-off.
Beyond the user experience for legitimate players, comprehensive identity solutions can also aid in maintaining compliance with local gambling laws and responsible gaming requirements by verifying age and location.
Protecting the Gaming Ecosystem
The future of online gaming platforms will belong to those who can combine airtight fraud prevention with a trusted user experience. As organized fraud network activity grows, so does the need to ensure that players feel confident in the system. By investing in smarter, AI-driven verification defenses, operators can protect the integrity of the gaming ecosystem.
About the Author
Reinhard Hochrieser is the SVP of Product and Technology at Jumio, where he drives the strategy and execution for Jumio’s ID Verification. He leads cross-functional teams focused on building secure, scalable, AI-driven solutions that help businesses drive conversion and prevent fraud at scale.
Reinhard can be reached on LinkedIn or Jumio’s website, https://www.jumio.com/.
