How One Bonus-Abuse Network Created $3.2m in Fraud Exposure

A new identity is presented. It rarely starts from nothing. "The participant may falsify personal information, use stolen credentials or assemble a synthetic identity. Payment cards may be stolen as well," Britt explains. "Due to the number of breaches over the last several years, consumer information, including complete and real pictures of passports and driver's licenses, is available for purchase via the dark web and other nefarious marketplaces."

The account clears a fragmented sign-up process. The goal isn't to look legitimate forever, just long enough. "The network attempts to disguise relationships between accounts by changing identity attributes, email addresses, telephone numbers, devices and network locations," Britt says. "VPNs and proxies may conceal location, while multiple devices help prevent accounts from appearing obviously connected."

The account claims the incentive. Simple, but this is the whole point of the exercise. "The economic aim is to unlock value intended for a genuine newcomer," Britt says.

The network protects its capital. Rather than risk their own money, "the fraudster hedges a sports bet, cashes out an unhedged bet or plays through casino products, risking the promotional value rather than their own money," according to Britt.

Cash out, then repeat through another account. This is where scale turns small individual amounts into a serious aggregate problem. "Account details may be exchanged within criminal networks and coordinated participants may match bets or otherwise collude," Britt says. "The economic impact becomes material through repetition and scale rather than through one especially large transaction."

The pattern reappears, disguised. "This is why a point-in-time passed identity check is insufficient," Britt says, "and [why] a persistent identity approach can reveal recurring underlying identities even when contact details and account attributes change."

It's built into the business model. Promotions are how operators acquire customers, and those same commercial features create a repeatable monetary opportunity for organised abusers.

It scales horizontally, not vertically. Where account takeover generally requires compromising one specific existing account, bonus abuse can be repeated across many apparently new accounts by rotating identity, email, phone, device and location signals, with growth partly attributed to how easy it now is to obtain new phone numbers and email addresses.

It hides in plain sight across categories. Bonus abuse can incorporate multi-accounting, stolen credentials, synthetic identities, suspicious payment methods, device manipulation and collusion, treating those as separate alerts risks missing the network connecting them.

Individual events look small. Forty per cent of respondents placed their average unprevented fraudulent transaction between $50 and $99, and 27% reported $100 to $199, numbers that stay under the radar individually while adding up significantly in volume.