In just Q1 2026, U.S. iGaming has generated about $3.04 billion, marking over 20% growth year-over-year and nearly $1 billion in April 2026 alone. For the full 2025 year, iGaming hit over $10 billion in revenue, up 27.6% over the previous year. With it being such a profitable industry, there’s no wonder why it’s ripe with fraud.
Fraud rates across the iGaming industry have risen nearly 40% in the last two years, and the losses concentrate at exactly the two moments operators can least afford to get wrong: signup and cashout. For Trust and Safety professionals running fraud programs for sportsbooks and iGaming operators, the math is simple. Growth attracts organized fraud rings, and the old playbook of static rules and manual review queues cannot keep up.
Sportsbook and iGaming fraud is growing faster than the market itself
The numbers tell the story. Commercial sports betting revenue hit $16.89 billion in 2025, up 22.6% year over year, while regulated iGaming revenue reached $10.73 billion, up 27.6%, according to the American Gaming Association. That kind of growth is a magnet for digital criminals, and the data backs it up.
The timing patterns are telling, too. Fraud attempts cluster in the early morning hours, roughly 4 a.m. to 8 a.m., while legitimate players tend to register in the late afternoon and evening. Fraudsters also concentrate their efforts at the deposit stage more than any other point in the player journey. That pattern points to organized activity running on its own schedule, probing the same platforms night after night, rather than opportunistic, one-off abuse.
Bonus abuse is the top threat, and it’s organized
Ask Trust and Safety teams in North American gaming what keeps them up at night, and bonus abuse tops the list. A 2026 study found that 78% of operators name bonus abuse as a top fraud threat to their business. It’s not hard to see why: bonus abuse rings use synthetic identities, stolen credentials, and multiple linked accounts to redeem the same welcome offer or free-bet promotion over and over.
These operations run at a scale that would surprise anyone still picturing a lone bettor gaming a signup bonus. The same study identified a single fraud network responsible for more than 95,000 fraud events and up to $3.2 million in exposure. Dedicated teams monitor promotions calendars across dozens of operators simultaneously, then deploy bots, device farms, and fabricated identities to exploit new offers within hours of launch. Treating bonus abuse as a marketing nuisance rather than a fraud problem is how operators end up funding organized crime one welcome bonus at a time.
Fraud clusters at signup and cashout
Roughly 60% of fraud exposure in online gaming occurs during account creation and withdrawal, according to a recent study. That pattern makes sense once you think like a fraudster. Account creation is where synthetic and stolen identities get planted, and withdrawal is where the payout gets extracted before anyone notices something’s gone wrong.
This concentration matters for how Trust and Safety teams allocate resources. A fraud program that reviews activity evenly across the player lifecycle is spending effort in the wrong places. The highest-value checks belong at onboarding and at withdrawal. But onboarding checks alone aren’t the fix operators often assume they are: identity verification (IDV) confirms a document or selfie matches a name, but it cannot see whether that “verified” identity is tied to a device farm, a cluster of linked accounts, or behavior consistent with a bonus abuse ring.
Fraud rings have gotten good at passing IDV with synthetic or stolen identities that hold up to a document check. Real protection comes from pairing that identity signal with device, behavioral, and network intelligence that flags the account as risky even when the paperwork looks clean. At withdrawal, that same layered approach, Payment Protection and Account Defense signals, catches an account that changed hands, or a payout method that does not match the deposit pattern, before funds leave the platform.
Synthetic identities and deepfakes are raising the stakes
Identity fraud in gambling is not evenly distributed across geographies, and that unevenness is itself a signal. Sumsub’s research found deepfake-driven identity fraud rates in Brazil running roughly 10 times higher than in Germany and five times higher than in the United States, reflecting how fraud rings target markets with lighter identity verification requirements or faster-growing player bases. As more U.S. states legalize sports betting and iGaming, operators should expect the same playbook of fraudsters testing new jurisdictions for weak points before scaling up.
Synthetic identities, built from a mix of real and fabricated data, are particularly difficult for legacy identity checks to catch because no single data point is entirely fake. Combined with deepfake tools that can defeat basic selfie verification, digital criminals now have a toolkit that older document-scan-and-selfie checks were never built to withstand.
Friction is a business decision, not just a security one
Every fraud control an operator adds also touches a legitimate player, and sportsbook and iGaming operators feel that tension more acutely than most industries. Players who hit friction at signup or during a payout often just walk to a competing platform instead. The same study found that 81% of operators say moderate onboarding friction is enough to drive customers away entirely.
That is why blanket verification, the same document checks and holds applied to every new account regardless of risk, is a losing strategy twice over. It lets sophisticated fraud rings blend in among the flood of manual reviews, while pushing away legitimate players operators most want to keep. The fix is scrutiny that scales with actual risk rather than scrutiny that gets dialed down across the board.
What effective fraud prevention looks like for sportsbook and iGaming operators
A modern Trust and Safety approach treats the player journey as one connected system rather than a series of disconnected checkpoints. Sift assesses thousands of signals, including device, behavioral, network, and identity data, across the entire journey and aggregates them into a single Sift Score from 1 to 100, where 1 indicates a trustworthy session and 100 indicates likely fraud. That score updates in real time as a player registers, deposits, plays, and requests a withdrawal.
Authentication analyzes the identity signals behind a new account, such as email, phone, and address data, to flag synthetic and fabricated identities that don’t hold together, working alongside a customer’s IDV provider to catch what document checks alone can miss before a bonus is ever claimed.
Payment Protection flags deposit and withdrawal patterns that do not match a player’s established behavior, catching account takeover and money laundering attempts before payouts go out the door.
Account Defense identifies linked accounts, device clusters, and credential-stuffing attempts behind bonus abuse rings.
Risk-based friction applies step-up checks only to sessions that actually carry risk, so most legitimate players never notice a thing.
Analysts work flagged cases in the Sift Console, using Workflows to route decisions automatically and Queues to prioritize the reviews that matter most, while Insights surfaces the fraud trends and network patterns that inform where policy needs to tighten next.
If this sounds like something that your team could really benefit from, then Sift might be a perfect fit for your team. You can try it for yourself by requesting a free demo today.
Frequently asked questions
What is bonus abuse in online gambling?
Bonus abuse happens when a person or, more often, an organized group creates multiple accounts using synthetic or stolen identities to redeem the same welcome bonus, deposit match, or free-bet promotion repeatedly. It is currently the most widespread form of fraud reported by North American gaming operators, and it can scale into tens of thousands of fraudulent events tied to a single network.
How does account takeover fraud affect sportsbooks and iGaming platforms?
Account takeover occurs when a fraudster gains access to a legitimate player’s account, often through credential stuffing or phishing, then changes payout details or drains stored funds. Because fraud concentrates so heavily at withdrawal, an account takeover that goes undetected until cashout can result in a direct financial loss with no chance to reverse the transaction.
How can sportsbook and iGaming operators reduce fraud without hurting the player experience?
The most effective approach applies risk-based, or dynamic, friction rather than uniform checks for every player. Low-risk sessions move through signup and withdrawal with minimal interruption, while sessions carrying elevated risk signals get additional identity or payment verification. This keeps manual review focused on the accounts that actually warrant it, instead of spreading scrutiny evenly across a mostly legitimate player base.
