A coupon or promo code is priced for one use by one genuine new customer. Bot driven abuse breaks both halves of that assumption. Operators build accounts in bulk, a practice the fraud literature calls gnoming when one person controls many identities, using disposable emails, borrowed or synthetic identity details, VPNs and rotating devices to make each account look like a stranger. Each account claims the welcome offer or enters the same promo code, completes the minimum wagering requirement with low risk bets, often hedged, and withdraws. Industry surveys of online gaming decision makers put bonus abuse at or near the top of fraud threats, and one widely cited estimate puts the sector's promo abuse losses around 15 percent of annual gross revenue. Treat those numbers as directional, the pattern underneath them is not in dispute: the abuse is organised, it is automated at the account creation step, and it is invisible if you only review accounts one at a time.
The accounts are built to pass individual review
That is the point most promo teams miss. Each farmed account, checked alone, has a plausible name, a verified email, a deposit, and ordinary looking first bets. The fraud lives in the relationships between accounts: a shared device fingerprint under five supposedly unrelated customers, deposits of identical size landing within the same hour, the same stake sizing and market choices repeated down to the decimal. Detection therefore runs on link analysis, clustering accounts by device, payment instrument, IP behaviour, and betting pattern, then judging the cluster. Judged as a cluster, the operation is obvious. Judged as individuals, it is two hundred ordinary signups who all happened to love the same obscure market.
Related reading on this site: Home and Arbitrage Looks Risk Free Until One Leg Moves cover the neighbouring problems in more depth.
Extraction is boring, and that is the tell
Genuine new customers bet like people: uneven stakes, favourite teams, a mix of bets placed at odd hours. Promo extraction bets like a process. Minimum qualifying wagers, low odds selections chosen for certainty rather than interest, matched positions across books or across accounts, and a withdrawal request the moment the rollover completes. The account then goes dormant, because its value was the offer, not the book. An account whose entire lifetime is signup, bonus, minimum wagering, withdrawal, silence has told you what it was. When thousands of lifetimes have the same shape, you are not looking at customers who churned. You are looking at inventory that was harvested.
Design offers that are expensive to farm
The durable defences change the offer's economics, not just its detection. Value released gradually, tied to sustained play over weeks rather than a single deposit, is far less farmable because the operator's time and capital costs eat the margin. Identity checks that link a new account to accounts already on the book, device and payment instrument reuse checks at signup rather than at withdrawal, and cluster level enforcement that restricts the whole linked network at once all raise the cost of the second hundred accounts. Closing accounts one by one is whack a mole. Closing the infrastructure, devices, payment methods, and identity set together, ends the farm.
Measure it honestly afterwards: promo cost per retained, wagering customer at 30 and 90 days, not cost per signup. A farmed campaign looks cheap on signups and catastrophic on retention, and the retention number is the one that tells you whether the offer bought customers or bought an audience of scripts.
Frequently asked questions
What is promo abuse by bots?
It is the organised claiming of promotions, coupons, and welcome offers through bulk created accounts controlled by one operator or group. The accounts are made to look unrelated, each claims the offer once, completes the minimum requirements with low risk wagering, and withdraws the value.
What is gnoming in betting fraud?
Gnoming is the creation of many accounts by one person or group to exploit per customer offers repeatedly. It typically uses disposable emails, varied identity details, and tools such as VPNs to disguise the link between accounts.
How do sportsbooks detect multi accounting rings?
Through link analysis: shared device fingerprints, payment instruments, IP behaviour, identical deposit sizes and timing, and near identical betting patterns across accounts. No single account looks fraudulent, so detection works at the cluster level rather than account by account.
How can an operator make a promotion harder to farm?
Release value gradually against sustained play instead of a single deposit, check device and payment reuse at signup, verify identity against existing accounts, and enforce against the whole linked cluster at once. The aim is to raise the operator's cost per farmed account above the offer's value.