Fraud detection for gaming: multi-accounts, bonus farms and bots
Maskbreak checks the web moments where a player account gains value: signup, login, the bonus or reward claim, the marketplace listing and the withdrawal. One server-side call answers allow, review or block and says why: a scripted browser, a fake browser, a residential proxy, or a device already linked to other accounts of yours. It is not anti-cheat and never sees your game client.
Fake accounts, bots and takeovers: six places gaming fraud shows up
Multi-accounting and ban evasion
A banned cheater back an hour later, a smurf for the ranked ladder, an alt that mules items to a main. Each arrives with a new email and often a new IP address, so uniqueness rules see strangers. What repeats is the device, unless it is hidden behind a fake browser, and then the spoofing itself is often the signal.
Welcome bonus and referral farming
Free spins, deposit matches, first-purchase credit, refer-a-friend rewards. The account costs the farmer nothing; the bonus is the payout. Some farms register accounts weeks or months early and let them sit, so a check at signup alone misses them. The claim is the moment that pays.
Scripted signups and reward bots
Bulk registration and daily-reward collection run in Puppeteer, Playwright or Selenium, often behind residential proxies so every account gets a home address in the country the promotion targets. Per-IP limits rarely trip, because each address is used once or twice.
Emulator and virtual-machine farms
Mobile-first titles get farmed from rows of Android emulators on one desktop, each posing as a separate phone. When a farm drives your web signup or bonus page, the evidence is the automation, the browser tampering or the virtual machine underneath, when the device check sees them. There is no in-app SDK to inspect a native emulator.
Account takeover for skins, items and balances
Leaked passwords replayed against your player login, one attempt per account from rotating residential exits. The prize is whatever can be traded, gifted or withdrawn, and the support ticket lands with you, not with the site that leaked the password.
Account sellers and item muling
Levelled and ranked accounts are sold, and the buyer logs in from a device the original player never used, often through a VPN. Farmed items move through trades and gifts to accounts that are cashed out. The difference between a shared login and a resold one is in the device history, not the IP.
Multi-accounting and bonus abuse: the sixth account on one device
Multi-account detection needs one thing a fraud API cannot guess: which of your accounts is asking. Send your own player ID as accountId with each check, set on your server from the signed-in session, never taken from the form. Maskbreak links it as a keyed hash, counts how many distinct accounts of yours the same device fingerprint has been linked to, and adds multi_account_device once that count passes one. Links stay inside your account: accounts the same device holds with another operator never count toward yours, and a link is removed after more than 90 days without activity.
Out of the box that reason does not change the decision, because shared devices are normal in gaming: siblings on the family PC, an internet café machine, a LAN event. Here is a bonus claim from an ordinary home connection on a device that five earlier accounts of yours have used, first under the default policy and then with Multi-accounting set to Review on the console's Rules tab:
// Example response (excerpt): default policy { "decision": "allow", "risk_score": 0, "reasons": ["multi_account_device"], "network": { "vpn": false, "proxy": false, "datacenter": false, "residential": true }, "device": { "antidetect": false, "automation": false, "emulator": false, "linked_accounts": 6, "multi_account": true } } // Example response (excerpt): Rules tab, Multi-accounting = Review { "decision": "review", "engine_decision": "allow", "decision_source": "rules", "rule_matched": ["multi_account"], "reasons": ["multi_account_device"], "device": { "linked_accounts": 6, "multi_account": true } }
The safer path is a threshold in your own code. Leave the rule at its default and read device.linked_accounts in the claim handler with a threshold of your own: the hold then applies to bonus claims only, and the engine's answer stays as it was. An internet café machine will usually sit far above a household PC, so take the number from what your Events log shows, not from a guess. The multi-accounting playbook covers ban evasion and sock puppets beyond gaming.
A rule applies to every check on your account, and it speaks only for its own signal. Multi-accounting = Review holds logins and trades from a linked device as well as bonus claims. It never lowers another signal's block: a linked device behind a proxy, a fake browser or automation still blocks. Pick Block for Multi-accounting if shared devices are rare on your platform.
When the operator hides the device, the hiding can be the evidence. An antidetect browser (a fake browser such as AdsPower, Dolphin{anty}, GoLogin or Multilogin) gives every account its own invented device, so the linking has less to hold on to. The spoofing often leaves traces of its own; when the device check sees them, antidetect_browser blocks by default. How fake-browser detection works, tool by tool.
Bot detection for gaming: scripts, fake browsers and virtual machines
Maskbreak's device check looks for a browser driven by automation tools such as Puppeteer, Playwright or Selenium, for a virtual machine and for a tampered or fake browser. Maskbreak's network intelligence adds the connection: VPN, proxy, Tor or cloud server, with the service named when known. A farm account signing up from a scripted browser through a residential proxy, with the device check completed, comes back like this:
// Example response (excerpt): scripted signup via a residential proxy
{
"decision": "block",
"risk_score": 90,
"reasons": ["proxy_detected", "automation_detected"],
"network": { "vpn": false, "proxy": true, "datacenter": false, "tor": false,
"residential": false, "service": "<proxy network, when known>" },
"device": { "automation": true, "antidetect": false, "virtual_machine": false }
}A clean device block means "not flagged", not "a real player". No list of detected automation tools is published, results vary with the setup, and the device block can be missing when the browser check did not complete. Missing evidence is not a clean result; the integration guide shows how enforce mode handles it.
This is not anti-cheat. Aimbots, wallhacks, memory editors, input macros and bots playing inside a match run on the player's machine and your game servers, where anti-cheat software works. Maskbreak judges browser visits. The two meet at the account: a banned cheater's next signup is a web visit, and that is where the device link and the fake-browser signal apply. For headless and stealth-patched browsers, see headless browser detection in 2026 and the bot detection API.
Residential proxy and VPN detection without punishing players
A VPN on its own is review, never block. Players use VPNs for honest reasons: a better route to a game server, a dorm network that blocks ports, privacy on public Wi-Fi. The response adds vpn_detected and names the VPN in network.service when known. On a region-locked promotion, treat that review as "hold the bonus", not "close the account": the player keeps playing with their own money while the promotion waits for a check.
A proxy blocks. Residential proxy networks rent out home connections, so a farm can put each account on a clean household address in the right country. On a live visit, when Maskbreak's network intelligence knows the exit, the response sets network.proxy, adds proxy_detected and blocks by default. More on the exits themselves in the proxy detection API and the guide to residential proxies at the login.
The device clock is a second witness. Forward the browser's timezone (tz), as the snippet below does. When an ordinary-looking home address sits in a different country from the device's own clock, timezone_mismatch moves allow to review. Travellers land there too, which is why it never blocks.
A cloud-server address alone stays allow. datacenter_asn is listed so you can see it, but hosted desktops and some office networks make it too common to refuse on its own.
What each signal does by default
- Block:
proxy_detected,tor_exit_node,automation_detected,emulator_detected,antidetect_browser(fake browser). - Review:
vpn_detected,virtual_machine(a browser inside a virtual machine) orprivacy_relay(Apple’s iCloud Private Relay) on its own. A disposable email domain (disposable_email, when you sendemail) andtimezone_mismatchmove an allow to review. - Listed, decision unchanged:
datacenter_asn,private_browsing,ip_blocklisted,high_activity_device(a device identified unusually often). Some raise the risk score; none blocks alone. - Yours to decide:
multi_account_device. Route ondevice.linked_accountsper endpoint, or set Multi-accounting on the Rules tab, which applies to every check and leaves the other signals' blocks in place. - Always: route on
decision, not on a score threshold. When a rule changes the decision,engine_decisionkeeps the engine's own answer beside it, whether the rule raised or lowered it.
Where the check goes: signup, bonus claim, login, trade, withdrawal
Account creation. Block: refuse it like any failed signup, without naming the reason. Review: create the account, but keep bonuses and trading locked until email or phone verification passes. Send email too, and a burner domain turns an allow into a review. The fake-signup playbook covers the same pattern outside gaming.
Bonus, free-spin and referral claims. The call that pays for itself, because it guards the credit directly, including accounts registered months early that slipped through signup. Block: refuse the claim. Review: hold the bonus, not the account. The bonus-abuse playbook and the post on catching self-referral go deeper.
Login. Block: answer exactly like a wrong password, so a stuffing list learns nothing. Review: step up with a one-time code to the email or phone on file. Keep your rate limits and MFA; this adds evidence, it replaces neither. See the account-takeover playbook.
Marketplace listings, trades and gifts. A scripted browser, or a device linked to many of your accounts, moving items is the shape of muling and account resale. Hold the item before it leaves the account, and send accountId at login too: a buyer's device that signs in to several of your accounts gets linked like any other. The post on telling a shared login from a resold one goes further.
Withdrawals and cashouts. The last point where money can be stopped. Review means a manual look before the payout, next to your KYC and payment checks, which keep running.
The call sits inside your own request handler, after your session check and before anything is credited. This one guards a bonus claim in watch mode: it logs the decision and the linked-account count, lets every claim through, and fails open if Maskbreak cannot be reached. Run it for a few days, compare the log with the Events tab, then switch on the enforce lines; the integration guide covers enforce mode, missing evidence and outages, and SDKs for Node.js, Python and PHP wrap the same call. The staged rollout guide explains when to move from watching to enforcing.
// POST /bonus/claim: check the claim before anything is credited // Watch mode first: log the verdict, always continue, fail open const body = req.body || {}; // sentinel.js adds monocle + sentinel_fp to your form let risk = null; try { const verdictRes = await fetch('https://maskbreak.com/v1/evaluate', { method: 'POST', signal: AbortSignal.timeout(5000), headers: { 'Authorization': 'Bearer ' + process.env.MASKBREAK_API_KEY, 'Content-Type': 'application/json' }, body: JSON.stringify({ token: body.token || body.monocle, // network evidence fingerprintEventId: body.fingerprintEventId || body.sentinel_fp, // device evidence tz: body.tz || body.sentinel_tz, accountId: String(user.id) // the signed-in player, from your session, never from the form }) }); if (verdictRes.ok) risk = await verdictRes.json(); } catch {} // unreachable or timed out: the claim handler still runs console.log('[maskbreak]', JSON.stringify({ player: user.id, decision: risk?.decision ?? null, reasons: risk?.reasons ?? null, linked_accounts: risk?.device?.linked_accounts ?? null, degraded: risk ? !!risk.degraded : null })); // Enforce later: if (risk?.decision === 'block') return res.status(403).json({ error: 'Bonus unavailable' }); // On review, hold the bonus, not the account: // if (risk?.decision === 'review') return holdBonus(user.id, risk.reasons);
behind a stack of sportsbook accounts that all pass KYC, because the documents are real. Each deposits, clears the wagering requirement, withdraws and disappears. The playbook shows why identity checks cannot see the ring, where to screen, and how to size the loss with your own numbers. A worked model, not a customer result.
Read the iGaming playbookWhat Maskbreak does not do for a gaming platform
No game-client or native SDK. There is no iOS, Android, console or PC-client SDK, and nothing runs inside your game. The checks need a browser page: your website, mobile web, or web-based account, bonus and cashier pages.
No KYC, age verification or licence-grade geolocation. A VPN flag is a risk signal, not proof of location for a regulator. Keep your identity, age and location checks; put this one in front of them.
No payment scoring and no chargeback guarantee. Card and deposit risk stays with your payment provider.
No shared blacklist between operators. Account linking is scoped to your own accounts, and there is no consortium list of banned players: a ban at another operator is not passed on to you.
No review team. A review lands in a queue you own: the Events tab lists every check with its reasons, webhooks can alert you, and CSV export feeds your own tools.
No VPN verdict from an IP alone. Screening addresses from game-server logs or chat is a different job. A bare-IP lookup covers Tor exits and published cloud ranges only; VPN and proxy verdicts, with the service name when known, need a live browser visit.
Gaming fraud detection: common questions
Put one check in front of your next bonus claim
Free plan: 10,000 visitor checks a month, every signal included, no card. Paid plans from €29 a month. Start in watch mode, and nothing changes for players until you switch to enforce.