For most of the last decade, iGaming fraud teams lived by a comforting fiction: verify a player once at sign-up, pass the regulator’s know-your-customer (KYC) box, and move on. Through 2026, that fiction collapsed. A 700% surge in deepfake attacks, a 4.5× jump in suspicious iGaming transactions in a single year, and the arrival of autonomous fraud agents turned the industry’s one-and-done onboarding check into a liability. Vendors raced to close the gap – Mindway AI, for instance, launched GameScanner mobile in September 2025 for rapid betting-risk scans and geo-jump alerts – but the defining story of AI fraud detection in iGaming this year is not a bigger firewall – it is the death of point-in-time verification and its replacement by continuous, behavioural intelligence that never stops watching.
This analysis unpacks how detection actually changed in 2025 and 2026: the numbers behind the surge, why “blink-and-turn” liveness checks stopped working, how behavioural biometrics became the new baseline, what a modern real-time risk decision looks like under the hood, and how regulators from the UK Gambling Commission to Australia’s AUSTRAC are forcing operators to keep monitoring long after the first deposit clears.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
The 2026 Turning Point: Deepfakes Broke One-Time KYC
The single most important shift of 2026 is conceptual, not technical. Operators stopped treating identity as a gate to be passed and started treating it as a state to be continuously re-scored. The trigger was simple economics: generative AI made forging the moment of verification cheaper than defending it. When a fraudster can synthesise a passport image, animate a stolen face through a liveness check, and script a plausible first session in minutes, the value of a single successful KYC pass drops to near zero.
Sumsub’s annual identity fraud report, published in late 2025, framed the change bluntly. Attackers, it argued, had moved from high-volume automation to high-fidelity deception – fewer, smarter, multi-step attacks that chain synthetic-identity creation, deepfake verification, bonus abuse and money laundering into one automated flow. “The Sophistication Shift marks a turning point, as businesses now face challenges tied to their velocity: the speed at which they can detect threats and adapt,” said Andrew Sever, co-founder and CEO of Sumsub. Velocity, not volume, is now the battlefield.
Why “Verify Once” Stopped Working
Point-in-time KYC assumes the person who onboarded is the person who plays. In 2026 that assumption broke on three fronts: account takeover using valid stolen credentials, “money muling” where a genuinely verified account is rented or sold after approval, and deepfake-assisted onboarding that defeats the check itself. Each vector renders the onboarding snapshot meaningless within days. The only defence that survives contact with these attacks is one that keeps evaluating the player mid-session, every session.
The Numbers That Redrew the Threat Map
The 2025–2026 data is unusually consistent across sources, which is why it now anchors nearly every vendor deck and regulatory briefing. The headline figures below all trace to Sumsub’s annual identity fraud report and its June 2026 iGaming update, cross-referenced against public reporting.
| Metric | Baseline | 2025 / Q1 2026 | Change |
|---|---|---|---|
| Multi-step attacks (share of all identity fraud) | 10% (2024) | 28% (2025) | +180% YoY “sophisticated” fraud |
| iGaming fraud rate | ~1.09% (2024) | 1.53% (Q1 2026) | +18% YoY / +40% vs 2024 |
| Deepfake attacks | Q1 2024 baseline | +700% (Q1 2025) | ~11% of first-party fraud |
| Deepfake share of fraud attempts, Europe | – | 41% | Highest of any region |
| Suspicious iGaming transactions | Q1 2025 baseline | 4.5× | Q1 2025 → Q1 2026 |
iGaming’s 1.53% Fraud Rate and the 4.5× Spike
Sumsub recorded an iGaming-specific fraud rate of 1.53% in Q1 2026 – an 18% year-on-year increase and a 40% jump from 2024 – while suspicious transaction volumes for iGaming rose 4.5× between Q1 2025 and Q1 2026 – a figure Sumsub’s 2026 iGaming Fraud Report confirmed was still holding as of June 2026. Those two numbers matter together: the rate of confirmed fraud rose modestly, but the volume of activity that looks suspicious enough to review exploded. That gap is exactly what continuous, automated scoring exists to close, because human teams cannot triage a 4.5× caseload manually. Vendors are already quantifying the payoff of that automation: Zipdo reported in February 2026 that AI-driven detection now stops 93% of refund-scam attempts in online casinos, precisely the kind of high-volume caseload no manual team could review at scale.
Why Multi-Step Attacks Jumped From 10% to 28%
The share of multi-step attacks climbing from 10% of all identity fraud in 2024 to 28% in 2025 – a 180% year-on-year rise in “sophisticated” fraud, as Sumsub reported – is the clearest signal that isolated checks fail. A multi-step attack is invisible to any single control: the KYC check sees a valid document, the payment check sees a funded card, the geolocation check sees a permitted region. Only a system that correlates all of them across time catches the chain.
The 700% Deepfake Surge and Europe’s 41% Concentration
Deepfake fraud rose roughly 700% between early 2024 and early 2025 and now accounts for about 11% of first-party fraud. Europe is the epicentre: deepfakes make up 41% of fraud attempts there, more than any other region – a direct consequence of dense regulated markets where verified accounts carry the most value.
Why Verify-Once KYC Collapsed
The 2026 pivot from static to continuous verification did not happen because someone invented a better algorithm. It happened because the old model’s core assumption – that a face on a camera at 9:00 a.m. is a reliable proxy for the human behind every action that follows – stopped being true.
The Death of “Blink and Turn”
Active liveness challenges – “blink twice,” “turn your head left,” “read these numbers aloud” – were the gold standard for years. In 2025 they became a checklist for attackers. Real-time face-swap tools and injection frameworks can satisfy every scripted prompt, and because the prompts are predictable, they are trivial to automate. Operators responded by abandoning active challenges in favour of passive liveness detection, which analyses micro-textures, lighting physics, screen-reflection artefacts and camera-sensor noise the user never sees and cannot consciously fake. Document checks evolved alongside liveness: Sumsub added a GenAI document-forgery detection module in Q1 2026 that it says catches synthetic IDs with 98% accuracy, closing the companion gap that passive liveness alone leaves open. Group-IB moved in the same direction, unveiling its BioConfirm biometric KYC module on 22 July 2025 specifically to harden iGaming onboarding against the same deepfake and forgery vectors.
From Point-in-Time Checks to Continuous Intelligence
The strategic answer is continuous behavioural intelligence: every session action – how a player types, moves a cursor, paces bets, navigates menus – feeds a risk profile that updates in real time. Pavel Goldman-Kalaydin, Sumsub’s Head of AI and Machine Learning, captured the symmetry of the arms race: “AI reshapes both offense and defense. Attackers gain deepfakes, synthetic IDs, and autonomous fraud agents; defenders gain behavior modeling, millisecond anomaly detection, and self-learning systems. The next frontier is verifying AI agents themselves – confirming not just who you are, but who acts on your behalf.” Operators building this stack from scratch increasingly start from a documented reference integration; our walkthrough on how to integrate the Sumsub KYC API into an iGaming platform shows where the onboarding check ends and continuous monitoring begins.
Behavioural Biometrics Becomes the 2026 Baseline
If 2024 was the year of graph machine learning, 2026 is the year behavioural biometrics went from premium add-on to default expectation. In August 2025, analyst firm QKS Group named Feedzai, BioCatch and IBM as market leaders in behavioural biometrics, per Biometric Update – a signal that the category had matured from experiment to infrastructure.
What Micro-Interaction Analysis Measures
Behavioural biometrics turns the raw exhaust of a user session into an identity signal. The system fingerprints cursor movement paths, click timing, scroll velocity, keystroke cadence, swipe pressure and navigation flow, then compares each live session against the account’s historical baseline. These patterns reflect neuromuscular habits that are nearly impossible to spoof at scale. A returning player who suddenly types twice as fast and heads straight for the withdrawal page without browsing a single game trips the anomaly detector before any money moves.
Passive Liveness and the Zero-Friction Layer
The commercial appeal is friction: behavioural analytics run silently in the background, adding no steps for legitimate users. Roughly 90% of users say they prefer passive behavioural verification to explicit credential prompts, which is why Tier-1 operators integrated background behavioural layers into deposit flows through 2026. Vendor case studies report meaningful drops in bonus-abuse claims once passive analytics flag anomalous play patterns immediately after registration – the exact window where promo-abuse rings operate. Firesand entered this space on 16 June 2025 with Firesand Shield, an anti-account-fraud product built specifically to catch that same post-registration abuse window for iGaming operators.
BioCatch, Feedzai and the Device-Level Shift
The frontier moved down the stack to the device itself. In March 2026, BioCatch launched DeviceIQ, targeting AI-driven fraud at the device level rather than only at the behavioural layer. Combining device intelligence with behavioural signals closes a gap that pure behavioural systems leave open: a fraudster who perfectly mimics a victim’s typing rhythm still cannot perfectly replicate the victim’s hardware, sensor fingerprint and network path at the same time. Capital followed the same logic: fraud-prevention platform Trustfull raised €6 million in July 2025 to expand its own device- and identity-signal tooling, part of a broader wave of investment chasing the device-level opportunity BioCatch is now targeting with DeviceIQ.
Inside a Modern Real-Time Risk Decision
What does “continuous intelligence” look like in code? Detection in 2026 is a fusion problem: no single signal decides, and the decision is re-computed continuously rather than once. A modern risk engine ingests KYC status, device fingerprint, geolocation, payment metadata and live behavioural biometrics, weights them, and returns an action – allow, step-up, or block – in milliseconds. The payoff is measurable: WorldMetrics reported in June 2026 that AI-driven risk engines now block 95% of card fraud in online gambling and flag 92% of unusual betting patterns before they settle.
Fusing KYC, Device, Geo and Behavioural Signals
The architecture that won in 2026 does not replace identity verification vendors – it orchestrates them. Onboarding still calls a KYC provider; the difference is that the same signals feed a running score. Platform vendors are building that orchestration in natively – Altenar shipped an AI fraud suite upgrade in January 2026 adding live odds-shift checks and linked-account detection on top of its existing risk stack. Vendor documentation increasingly spells out the layers explicitly – NuxGame’s July 2026 framework describes a five-layer real-time AI scoring model, from device and behavioural signals through to API-based pass/step-up/block decisions, that mirrors exactly this orchestration pattern. Operators comparing where each vendor fits often start from a side-by-side of the major identity players; our Sumsub vs Onfido vs Jumio vs Veriff KYC comparison maps auto-approval rates and liveness approaches across the field.
def score_session(session):
signals = {
"kyc_confidence": kyc.status(session.user), # 0..1 from onboarding vendor
"device_trust": device.reputation(session.fp), # BioCatch DeviceIQ-style
"geo_consistency": geo.match(session.ip, session.user.home),
"behaviour_anomaly": biometrics.deviation(session), # keystroke/cursor vs baseline
"velocity_risk": aml.velocity(session.user), # deposit/withdraw pacing
}
weights = {"kyc_confidence": .15, "device_trust": .20,
"geo_consistency": .15, "behaviour_anomaly": .35,
"velocity_risk": .15}
risk = sum((1 - signals[k]) * w for k, w in weights.items())
if risk > 0.75: return "BLOCK" # fail-closed on withdrawal
if risk > 0.45: return "STEP_UP" # passive liveness + re-auth
return "ALLOW"The Continuous Re-Check Pattern
Note the weighting: in most 2026 deployments the behavioural anomaly signal carries the heaviest weight because it is the hardest to fake continuously. The engine re-runs this scoring on high-risk events – a withdrawal request, a payment-method change, an unusual bet size – not just at login. A typical behavioural event payload the engine consumes looks like this: For broader market context, see our coverage of best sweepstakes casino sites.
{
"event": "withdrawal_request",
"user_id": "u_88231",
"session_id": "s_5f2a",
"behaviour": {
"keystroke_dwell_ms": 92,
"cursor_entropy": 0.41,
"nav_path": ["deposit", "withdraw"],
"baseline_deviation": 0.63
},
"device": { "fingerprint_match": 0.88, "emulator": false },
"geo": { "ip_country": "GB", "vpn_suspected": true },
"decision": "STEP_UP"
}Graph ML and the Hunt for Fraud Rings
Continuous behavioural intelligence handles the individual; graph machine learning handles the network. By 2026 graph ML had become the industry baseline for exposing coordinated fraud, mapping relationships across devices, payment instruments and IP addresses rather than scoring accounts in isolation. Zipdo’s February 2026 analysis put a number on the payoff, finding that casino AI systems using this kind of network analysis now catch 87% of collusive betting rings – chip-dumping partnerships and coordinated player pods that individual-account scoring simply cannot see.
Scoring Relationships, Not Accounts
Isolated scoring misses the whole point of organised iGaming fraud, which is coordination – bonus-abuse rings, chip-dumping partnerships, multi-accounting farms. Graph ML represents every account, device and card as a node and every shared attribute as an edge, then surfaces clusters no single-account model could see. Fraudsters who launder identity through hundreds of “clean” accounts light up as a dense subgraph the moment they share a device fingerprint or funding source. New entrants have been built specifically for this graph-forensics layer – Frogo launched at ICE Barcelona in January 2025 with device fingerprinting, real-time scoring and graph forensics built in from day one. Sportsbooks got their own dedicated layer in December 2025, when Genius Sports added graph ML fraud alerts that link second-degree devices and payment instruments – catching the associate of an associate, not just a direct shared card or IP. Geolocation and device-intelligence networks feed these graphs directly, and the underlying location signal keeps getting sharper: GeoComply upgraded its PinPoint engine to v8 in Q2 2026, claiming under 50 milliseconds of latency for Wi-Fi triangulation alongside VPN and proxy detection; our GeoComply vs Xpoint vs LocationSmart geolocation comparison details how US operators source the location and device signals that anchor the edges.
Synthetic Identities and Professionalised Clusters
SEON’s 2026 iGaming risk research highlighted the shift from high-volume automation to professionalised account clusters – synthetic identities built patiently to look like long-term legitimate players. SEON rolled out its own Graph ML v3 engine in Q1 2026, purpose-built to detect multi-accounting rings across device, email and IP graphs – precisely the pattern its research flags. Graph ML is the counter, because a synthetic identity that is flawless in isolation still betrays itself through the relationships it must share to be operated at scale.
Agentic AI: When Attackers and Defenders Both Automate
The most forward-looking theme of 2026 – and the one Sumsub named its report after – is agentic AI on both sides of the fight. The same autonomous-agent technology powering defensive investigation is powering the attacks.
Autonomous Fraud Fleets
Sumsub warned that a single AI agent can now orchestrate an entire attack chain – generating fake ID documents, submitting deepfake video, and mimicking human interaction at high speed – and predicted a 2026 boom in coordinated fleets of such agents running high-speed, multi-step attacks at scale. This is the mechanism behind the jump to 28% multi-step attacks: automation made complex chains cheap.
Agentic Response and the Human-in-the-Loop Question
Defensively, vendors shipped agentic response layers through mid-2026 that autonomously investigate alerts and block low-risk fraud events without waiting for human approval, reserving analysts for the highest-complexity cases. The open governance question – one regulators are already circling – is how much autonomy to grant a system that can freeze a player’s funds. As Goldman-Kalaydin framed it, the “next frontier is verifying AI agents themselves,” a problem the industry has barely started.
The Regulators Push Back on “Blind” AI
Regulation is the second force making one-time KYC untenable. Supervisors now expect ongoing monitoring, and in 2026 they began punishing operators who leaned on AI as an excuse rather than a control.
| Operator / Case | Penalty | Date | Failure |
|---|---|---|---|
| Platinum Gaming | £10,000,000 | October 2025 | AML & safer-gambling failings |
| Spreadex | £2,022,000 | May 2025 | AML & social responsibility |
| ProgressPlay | £1,000,000 | August 2025 | AML breaches |
| Videoslots | £650,000 | Recent enforcement | Automated risk scoring missed warning signs |
£10m Penalties and the Enforcement Surge
The UK Gambling Commission carried out 9,700 compliance actions in 2024/25, up from 4,200 the year before, and reports that one in four operators still fails to hit satisfactory AML ratings. Its enforcement director, John Pierce, warned operators against blind reliance on technology, cautioning that AML algorithms “too often they simply aren’t delivering.” The Videoslots case is the cautionary tale: its automated risk scoring overlooked high-value digital-voucher deposits, rapid fund transfers and withdrawals to multiple destinations – precisely the multi-step pattern continuous monitoring is meant to catch. Full case history is published on the Gambling Commission’s enforcement pages.
AUSTRAC’s $5,000 Threshold and the EU’s AMLA
The pressure is global. Australia’s AUSTRAC reforms taking effect 31 March 2026 cut the gambling customer-due-diligence threshold from A$10,000 to A$5,000, forcing far more granular ongoing checks. In the EU, the new Anti-Money Laundering Authority (AMLA) became operational in Frankfurt on 1 July 2025, and the AMLR regulation sets a €2,000 due-diligence trigger for gambling from July 2027. Every one of these rules assumes continuous, not one-time, verification. For broader market context, see our coverage of leading online casino sites.
Consortium Intelligence and Cross-Operator Data Sharing
The hardest fraud to catch is the ring that spreads a thin layer of activity across many operators, staying under each one’s individual radar. The 2026 answer is shared intelligence.
Federated Learning and Shared Signals
Cross-operator device- and identity-intelligence networks let operators flag a device or synthetic cluster once and warn the whole network, without exposing raw customer data. Federated learning – training shared models on distributed data that never leaves each operator’s environment – is the privacy-preserving mechanism that makes this legally viable under GDPR and equivalent regimes.
The Privacy Tension
Shared intelligence collides with data-protection law. An operator that blocks a player based on another operator’s signal must be able to justify the decision, honour the right to explanation, and avoid importing another firm’s false positives. Resolving that tension – technically and legally – is the quiet engineering challenge that will define whether consortium networks scale in regulated markets.
Vendor Landscape: Who Powers 2026 Detection
No single vendor owns the stack. Modern detection is an orchestration of specialists, each contributing a signal to the fused score.
| Vendor | Category | 2026 signal / product | Role in the stack |
|---|---|---|---|
| Sumsub | KYC / AML orchestration | Non-Doc verification, deepfake-resistant liveness | Onboarding + ongoing identity signal |
| BioCatch | Behavioural biometrics | DeviceIQ (March 2026) | Device + behaviour anomaly layer |
| Feedzai | Transaction & behavioural risk | Real-time risk-scoring platform | Payment-flow anomaly detection |
| GeoComply | Geolocation / device intelligence | Location + device fingerprinting | Geo-consistency edge in graph ML |
| SEON | Digital-footprint risk | Email/phone/IP enrichment | Synthetic-identity and cluster signal |
Market sizing for this category is contested – analyst estimates for fraud-detection spend touching iGaming range from roughly US$1.5 billion to figures approaching US$14.7 billion depending on how much adjacent identity and AML tooling is counted – but the operational metrics, not the market number, are what change behaviour. For readers who want the market-and-consolidation view in depth, our companion analysis of how iGaming AI fraud detection reached $1.9B in 2026 tracks the vendor M&A story this piece leaves aside.
Beyond the Standard Coverage: What SEON, CrossClassify and Group-IB Leave Out
The best public explainers on iGaming fraud are genuinely useful, but they share blind spots that matter to anyone building or buying detection in 2026. Here is where the standard coverage stops.
The Gaps in the Leading Guides
SEON’s widely-cited iGaming fraud primer runs to roughly 3,200 words and catalogues fraud types – multi-accounting, gnoming, bonus abuse, chargebacks – with solid statistics such as up to 15% of revenue lost to promo abuse and every $100 in chargebacks costing $207 all-in. What it does not cover: the 2026 regulatory landscape, agentic AI, behavioural biometrics or passive liveness, market sizing, or consortium data sharing. CrossClassify’s ~4,500-word solution page is strong on account-takeover mechanics – citing a 54% rise in online-gaming fraud, $2.8 billion in first-party losses, and roughly 4% of gambling logins flagged as ATO attempts – but omits vendor benchmarks, agentic decisioning and cross-operator networks. Group-IB’s generative-AI coverage nails the deepfake threat but stops short of the defensive architecture.
What This Article Adds
Three things the standard guides miss: first, the mechanics of continuous scoring – how KYC, device, geo and behavioural signals fuse into a single re-computed decision, shown here in code. Second, the 2026 regulatory teeth, from the UKGC’s £10m penalties and John Pierce’s warning against blind AI to AUSTRAC’s A$5,000 threshold. Third, honest treatment of the market-size disagreement rather than a single confident figure. Detection in 2026 is a systems problem, not a product you buy once.
Five Predictions for iGaming Fraud Detection Through 2027
Extrapolating from the 2025–2026 trajectory, five shifts look near-certain:
- Agentic defence becomes table stakes. By late 2026 into 2027, autonomous agents that investigate and resolve the routine majority of alerts will be standard, with humans supervising only the highest-complexity cases.
- One-time KYC disappears from Tier-1 operators. Continuous behavioural intelligence, not onboarding checks, becomes the primary control – the onboarding pass becomes just the first data point.
- Cross-operator networks launch in regulated markets. Real-time device- and identity-intelligence sharing, privacy-preserved via federated learning, reaches production in major regulated jurisdictions.
- “Verifying the agent” becomes a product category. As AI agents act on users’ behalf, proving who authorised an action – not just who the user is – turns into its own detection layer.
- Regulators mandate explainability. Following the UKGC’s warning against blind AI, expect formal requirements that automated fraud and AML decisions be explainable and auditable, constraining pure black-box models.
What This Means for Operators
The practical takeaway is uncomfortable but clear: any operator still treating verification as a one-time gate is already behind. The 4.5× surge in suspicious transactions and the 180% rise in sophisticated fraud are not caseloads a human team can outwork. The operators pulling ahead in 2026 pair deepfake-resistant onboarding with continuous behavioural scoring, feed both into graph ML, and keep a human in the loop for the decisions that freeze real money – while documenting every automated call for the regulator who will eventually ask.
Frequently Asked Questions
How did AI fraud detection in iGaming change most in 2026?
The biggest change was the move from point-in-time KYC to continuous behavioural intelligence. Rather than verifying a player once at onboarding, 2026 detection systems re-score every session using behavioural biometrics, device signals and payment velocity, updating risk in real time.
Why did deepfakes break traditional liveness checks?
Active liveness challenges (“blink,” “turn your head”) use predictable prompts that real-time face-swap and video-injection tools can satisfy automatically. With deepfake attacks up 700% in 2025, operators switched to passive liveness that analyses micro-textures and camera artefacts a user cannot consciously fake.
What is behavioural biometrics and why does it matter for iGaming?
Behavioural biometrics fingerprints how a person types, moves a cursor, scrolls and paces bets, comparing each live session to the account’s baseline. Because these neuromuscular patterns are extremely hard to spoof at scale, they detect account takeover and bonus abuse that pass identity checks. About 90% of users prefer this passive approach to extra credential prompts.
What is a multi-step attack?
A multi-step attack chains several fraud techniques – synthetic-identity creation, deepfake verification, bonus abuse and money laundering – into one automated flow. Each individual control sees something legitimate; only correlated, continuous scoring catches the chain. Multi-step attacks rose from 10% of identity fraud in 2024 to 28% in 2025.
How high is the iGaming fraud rate now?
Sumsub recorded an iGaming fraud rate of 1.53% in Q1 2026 – up 18% year-on-year and 40% versus 2024 – alongside a 4.5× increase in suspicious iGaming transaction volumes between Q1 2025 and Q1 2026.
Are regulators forcing continuous monitoring?
Yes. The UK Gambling Commission ran 9,700 compliance actions in 2024/25 and fined operators including Platinum Gaming (£10m, October 2025). Australia’s AUSTRAC cut the gambling due-diligence threshold to A$5,000 from 31 March 2026, and the EU’s AMLA became operational in 2025 – all assuming ongoing, not one-time, checks.
What role does agentic AI play in fraud now?
Agentic AI works both ways. Attackers use autonomous agents to run entire multi-step attack chains at speed, while defenders deploy agentic response layers that investigate alerts and block low-risk fraud without human approval. Verifying the AI agents themselves is emerging as the next frontier.
Which vendors lead iGaming fraud detection in 2026?
Detection is a multi-vendor stack. Sumsub leads KYC/AML orchestration and deepfake-resistant liveness; BioCatch, Feedzai and IBM lead behavioural biometrics (BioCatch shipped DeviceIQ in March 2026); GeoComply anchors geolocation and device intelligence; SEON supplies digital-footprint enrichment. No single vendor covers the whole pipeline.
