Bonus abuse prevention for casinos and sportsbooks
Bonus abuse prevention works best at the door. InlineShield screens every casino and sportsbook sign-up in real time, before the account is created and before the welcome bonus pays out, and catches the usual tricks: alias emails, temp mail, VPNs and bots. It is self-serve, from free to $699 a month, and uses no device fingerprinting.
Last updated
Where bonus abuse starts
Every welcome offer is a promise to a new player. Bonus abusers make that promise to themselves many times over, with a new account for each claim. By the time the pattern shows up in your payments data, the bonuses are spent.
Most of those accounts share the same few tricks at registration:
- One inbox, many addresses.
[email protected],[email protected]and[email protected]all deliver to one mailbox. - Throwaway inboxes. Temp-mail domains, including fresh ones that no blocklist has seen.
- Borrowed locations. VPNs, Tor and cloud servers that hide where the player really is.
- Scripts. Headless browsers and HTTP libraries that open accounts in a loop, often with random names like
[email protected].
Choose your vertical
Don't block. Decide.
Each sign-up gets a verdict and a recommended action. The one that matters most for bonus abuse is allow_no_bonus: keep the player, skip the bonus.
| recommendedAction | When you get it | What you can do |
|---|---|---|
| allow | Verdict ALLOWED with a risk score below 25. | Create the account and give the normal welcome offer. |
| allow_no_bonus | Verdict ALLOWED, but with a risk score of 25 or higher. | Create the account and let the player deposit and play, but hold back the sign-up bonus or free bet. |
| review | Verdict QUARANTINED: the sign-up is held for review. | Create the account as pending, or keep it from logging in, until you approve or reject it in the review queue. |
| block | Verdict BLOCKED, or a held sign-up you rejected (signup.rejected webhook). | Refuse the sign-up. No account, no bonus. |
| require_kyc | A held sign-up you approved (signup.approved webhook) whose hold involved an inbox alias, a VPN, a time-zone mismatch or similar signals. | Keep the account, but ask for identity verification before paying out. |
How it fits into your stack
Add a browser script to your sign-up page and one server call, /api/v1/siteverify, before you create the account. Or skip the script and call /api/v1/verify from your server alone. Ready-made code exists for PHP, Node.js, Python, Java and C#, and there is a WordPress and WooCommerce plugin.
Held sign-ups wait in a review queue, and your platform hears the outcome through signed webhooks. Email alerts tell you when an attack spikes or your integration goes quiet. See all features and plans.
Frequently asked questions
What is bonus abuse?
Opening several accounts, or using someone else's, to claim a promotion more than once, against the offer's terms. In iGaming it most often targets welcome bonuses, free spins and free bets.
How is InlineShield different from a full fraud suite?
It does one job: screen the sign-up. It is self-serve, starts free, and uses no device fingerprinting. You can run it next to the KYC and payment checks you already have.
Will it slow down registration?
The check runs inline while the player submits the form. If InlineShield cannot be reached, times out or errors, the ready-made code accepts the sign-up and logs a warning, unless you choose to reject instead.
Does it work for licensed operators who must keep player data in check?
InlineShield keeps player emails and IPs for screening and blanks the raw values after 180 days. It does not fingerprint devices. Our data processing addendum covers our role as processor.
What does it cost?
Free for 1,000 screenings a month, Starter at $199/mo for 25,000, Pro at $699/mo for 250,000, and Enterprise on request. No setup fee.
Screen your next sign-up for free
The Free plan includes 1,000 screenings a month. Create an account, add your keys and see real verdicts on your own traffic. No card, no sales call, no setup fee.