When you think about sports betting, the words “ringleader,” “dark web,” or “fraudsters” don’t necessarily come to mind. But those words offer a window into bonus abuse, an identity-theft type of fraud unique to the digital world.
“Someone will go onto the dark web and buy 100 stolen identities for $15,” GeoComply’s Senior Director of Risk Services Danny DiRienzo told Sports Handle. “And if you’re looking for just enough information to get through the KYC (know-your-customer) process, it’s very cheap.”
In the nearly five years since the Supreme Court overturned the Professional and Amateur Sports Protection Act, sports betting has been legalized in more than 35 U.S. jurisdictions, where controls have been put into place to preserve the integrity of games, to ensure that customers are dealing with legitimate operators, and to tamp down the black market. But despite the best efforts of operators, regulators, and law enforcement, a small group of criminals has found a way in. These same scofflaws use stolen identities to create online accounts for shopping and ride share apps, among other fraudulent uses.
Every time a new state goes live with sports betting, operators offer lucrative bonuses to try to attract new customers. Those offers reached their zenith in January 2022, when multiple operators offered thousands of bonus dollars to new customers in New York, the biggest market with legal betting to date. And while those bonuses look attractive to the average bettor, they also appeal to thieves who make their living using stolen identities.
Bonus abuse not a regulatory issue
Geolocation services across North America have the ability to track wagering accounts, and it’s not unusual for GeoComply to share a map of location checks around a big event or when a new state launches. The maps show successful log-in attempts by type of device, as well as failed attempts that originate outside a state’s geofence.
DiRienzo said that when a new state goes live or during an event like the Super Bowl, his company can also identify clusters of devices in a single location, which may indicate fraud. When GeoComply sees such clusters, it shares that information with operators, who may or may not shut down accounts or contact law enforcement to open a criminal investigation.
“It isn’t considered illegal by regulators,” GeoComply SVP of Compliance Lindsay Slader said. “But it costs operators money. And each operator has its own temperature to gauge how much bonus abuse they are willing to accept.”
From a regulatory standpoint, there’s little recourse for bonus abuse. One regulator told Sports Handle that while operators can ban someone for bonus abuse, it’s “not something that we would exert regulatory resources” on. That said, if bonus abuse can be linked to identity theft or another kind of fraud, regulators in every jurisdiction have partnerships with law enforcement, including gaming agents at casinos and enforcement divisions that could potentially act if it is determined that a crime has been committed.
What does fraud look like?
On a GeoComply map, bonus fraud could look like hundreds of accounts coming from a single device or hundreds (or even thousands) coming from multiple devices in the same location. Bonus abuse could be as simple as one spouse trying to get a little extra from an operator by opening an account in the other spouse’s name or, as DiRienzo described, identity theft with criminal intent. It is when bonus abuse involves identity theft or another crime that law enforcement gets involved.
“Bonus abuse, the way that we have treated it is that it’s a business issue because it’s free play offered by the platforms,” a state police officer who works in gambling enforcement told Sports Handle. “The bonus money that is being abused by the fraudsters is kind of like monopoly money. … They play and then they lose it, and they can’t get it back. For us, it’s more of an identity theft problem.”
The officer said his office has received “thousands” of fraud alerts from live gambling and sports betting operators in his state. He also said that operators often do their own internal investigations to try “to determine who the ringleader is” by looking at withdrawals, the age range of the users, or other identifying characteristics or trends. In many states, when an operator files a fraud alert, law enforcement reviews the file to determine if it rises to the level of criminal behavior.
The officer is careful to point out that not all bonus abuse is identity theft, but that all identity theft originates with a human victim who’s likely had their life turned inside out. Fraud can range from “friendly fraud,” which usually involves a family member or friend using the identity of other family members or friends, to a more highly developed criminal venture.
Geolocation services shine a light
Some bonus fraud cases involve hundreds, if not thousands, of stolen identities or significant sums of money.
“When it’s an identity crime,” the officer said, “we try to ensure that the person whose identity was used is actually a victim, and then we try to identify who is utilizing the information. That can be challenging, but we have a pretty good methodology for honing it down. GeoComply and other location providers can lead us to an individual rather than online identity.”
Slader said that as part of its regular monitoring, GeoComply can “recognize unique users and devices,” which can aid law enforcement in tracking down criminals.
In today’s world of #IdentityTheft & fraud, it’s critical for gaming, #casinos & #SportsBetting institutions to know that every gamer is who they say they are & that their documents are legitimate. #IDauthentication #FraudPrevention
See how #HID can help: https://t.co/NqV3YdSo41 pic.twitter.com/mRXu8C7xlo
— HID (@HIDGlobal) December 6, 2022
To get to the point of making an arrest, law enforcement must determine what type of device was used, where the device and person are, and how to tie an individual to the identity theft. Beyond that, the officer said, cases might also involve the use of fraudulent credit cards or money laundering.
The officer in question has tracked cases involving embezzled funds used for wagering, as well as one involving a person who stole more than 3,000 identities in order to feed a gambling habit. The officer said that when his group does solve a gambling-related crime, the trail often leads to a person with a gambling addiction who perpetrated a crime in order to keep gambling. In most cases, operators won’t recover any funds, though accounts can be shut down and users can be put on exclusion lists.
Gaming industry could be model
While GeoComply can’t identify an individual from its data, it does gather significant information about devices it tracks — and all U.S. jurisdictions require that operators geolocate their customers to confirm they are within legal boundaries.
DiRienzo said that gaming isn’t the only industry that relies on online registration or geolocation for business. But it’s the wagering industry, which is among the most tightly regulated in the U.S., that DiRienzo believes will take KYC, tracking, and other online business technology to the next level.
“We are going to find solutions to problems that can be used in other industries,” DiRienzo said. “What we’re seeing is no different than what anyone else sees in other industries. But we see so much data, and there are so many good people working in it, that we have a unique opportunity.
“We in this industry are really good at catching fraud. If you were to compare [wagering] to online shopping or fintech, we don’t miss much. Our numbers might look higher, but that’s because we don’t miss much.”
