Fraud в iGaming — не только chargeback. Это фермы бонусов, arbing, GNI abuse и collusion. Rule engine + manual review — минимальный viable antifraud.
Signals
- Device fingerprint, IP, email pattern
- Deposit → withdraw without play
- Shared payment instrument
Rules engine
Score-based: block, review, allow. Version rules, A/B impact on conversion.
Ops
- Risk queue UI for analysts
- SLA on withdrawal review
- Feedback loop labeled fraud cases
Чеклист
- Block list sync
- False positive monitoring
- Regulatory SAR workflow where required
Balance review queue
Withdraw > X или score > threshold попадает в очередь аналитика. SLA 15–30 мин в пик. Решение: approve, request docs, block.
Feedback loop
Размечайте кейсы fraud / false positive и пересматривайте rules раз в месяц. Без labeled data ML и rule tuning превращаются в гадание на conversion.
Velocity и device graph
Rules: >3 accounts per device fingerprint за 24h → review. Deposit → withdraw <30 min без bets → block. Same card on 5 accounts → SAR workflow where required.
ML optional после 10k labeled cases; до этого rule engine + analyst queue. A/B новых rules на 5% traffic, смотрите conversion и fraud rate одновременно.
Collusion и GNI abuse
Паттерны: coordinated betting opposite sides, shared IP pool с высоким bonus uptake, arbitrage между sportsbook и exchange. Graph analysis связывает accounts по device, payment instrument, withdrawal destination.
Playbook: soft block (cap withdraw), hard block (freeze), request SOF/video. Каждое действие — ticket с reason code для регулятора и dispute с игроком.
Минимальный antifraud без ML
- 10–15 velocity rules: device, IP, deposit-withdraw pattern
- Review queue UI с reason code
- Label fraud / false positive для tuning
- A/B новых rules на малом % traffic