Fraud Activity on the Rise Across U.S Online Gambling

There is an increasing concern amongst U.S gaming operators that fraudulent actors are winning the cybersecurity war. In the last few days, it’s been reported that a ‘credential stuffing’ attack, whereby attempts are made to illegally gain access to existing customer accounts, successfully commandeered $300k from members registered to DraftKings’ sportsbook application. This was achieved by an individual who had purchased a pre-prepared bank of usernames and passwords, before methodically trying to log-in to account using each one. The information deployed is often acquired from the dark web, with sellers providing 100,000 usernames and passwords, which carry a 0.5%-1% rate of successful infiltration, for the modest sum of $1,000.

The news follows a recent scam which saw users of BetMGM’s online poker platform have their bank details compromised. Illicit actors managed to duplicate the accounts of existing players, consequently accessing confidential data uploaded during the original registration process. As soon as a new account was configured, a deposit was made using the impacted customer’s payment information, before funds were subsequently drawn to a separate bank account.

Many believe that a wholesale introduction of two-factor authentication controls will hope to alleviate such problems. This security function works by sending a supplementary message containing a specific access code (which must be entered upon log-in), to a device tethered to a customer account. In essence, this provides an extra verification layer, and prevents anyone from accessing account by simply being in possession of the member’s username and password. In New Jersey, operators are obligated to ensure players set-up two-factor authentication when signing-up for a betting account, however, there are currently no other states who enforce this rule. Although this does mitigate against the threat of such illicit activity, it also increases the time taken to access a betting account – something both customers and operators are often eager to avoid.

Ultimately, the industry must strike a balance: accounts must be safe, secure, and have tools to resist penetration from fraudsters, but also facilitate quick and convenient entry. As it stands, this is proving a challenging dynamic to master….