Security & Fraud

This framework is used in online poker to ensure fair play and protect game integrity by monitoring player behaviour, detecting collusion, and preventing account fraud. It analyses gameplay statistics like VPIP, PFR, aggression, showdown frequency, and win rates to spot unnatural patterns that may indicate bots or Real-Time Assistance (RTA) usage.

Player Behaviour Metrics

VPIP (Voluntarily Put Money In Pot)

• Definition: Percentage of hands a player voluntarily enters (excluding blinds/antes).

• Purpose: Identifies overly loose or tight play, which may indicate bots or RTA (Real-Time Assistance) usage.

• Industry Norm: Solid players in 6-handed games have VPIP ~20–30%.

• Suspicion Indicator: Anomalies such as >45% or <10%.

• Threshold: Flag players with VPIP >45% or <10% over 1,000+ hands.

PFR (Pre-Flop Raise)

• Definition: Percentage of hands a player raises pre-flop.

• Purpose: Measures aggression; compares to VPIP for behavioural patterns.

• Suspicion Indicator: High VPIP but very low PFR (e.g., VPIP >40% but PFR <10%) may suggest passive bots or collusion.

• Threshold: Flag when PFR deviates significantly from VPIP.

Aggression Factor (AF)

• Definition: Ratio of bets/raises to calls post-flop.

• Purpose: Detects unnatural aggression patterns—bots may maintain consistently extreme AF values.

• Threshold: Flag AF >4 or <0.5 over 1,000+ hands.

WTSD% (Went to Showdown)

• Definition: Percentage of hands taken to showdown after seeing the flop.

• Purpose:

  • High WTSD% (>40%) → possible RTA use for optimal call decisions.

  • Low WTSD% (<15%) → possible collusion to avoid confrontations.

• Threshold: Flag WTSD% >40% or <15% over 1,000+ hands.

Win Rate (BB/100)

• Definition: Big blinds won per 100 hands.

• Purpose: Extremely high win rates may suggest cheating or superuser accounts.

• Industry Norm: Professionals average 2–5 BB/100.

• Threshold: Flag win rates >10 BB/100 over 10,000+ hands.

Account & Device Metrics

IP Address Tracking

• Definition: Logs IP addresses for all logins.

• Purpose: Detects multi-accounting, shared devices, or VPN usage.

• Threshold: Flag accounts logging in from multiple distant geolocations within 24 hours.

KYC Verification Status

• Definition: Completion of identity verification (Know Your Customer).

• Purpose: Prevents fraudulent or duplicate accounts.

• Threshold: Flag unverified accounts with deposits or withdrawals exceeding $500.

Collusion Detection Metrics

Table Overlap Frequency

• Definition: Number of times players appear at the same table.

• Purpose: Frequent overlap may indicate collusion or multi-accounting.

• Threshold: Flag players appearing together in >50% of sessions over 30 days.

Soft-Play Patterns

• Definition: Players avoiding aggressive play (e.g., folding strong hands) against specific opponents.

• Purpose: Detects collusion where players protect each other.

• Threshold: Flag if a player folds >80% of strong hands (top pair or better) to the same opponent over 500+ hands.

Chip Dumping

• Definition: Large, intentional transfers of chips from one player to another.

• Purpose: Identifies intentionally losing to benefit another player.

• Threshold: Flag chip transfers >100 big blinds in a single session without strategic justification.

It also tracks suspicious interactions between players, such as repeated table overlap, soft-play, or chip dumping, which can signal collusion. Additionally, it verifies account authenticity through IP tracking and KYC checks to stop multi-accounting and identity misuse. By flagging anomalies based on set thresholds, operators can quickly investigate and act, keeping the platform secure, fair, and trustworthy for all players.