Online casino bonus abuse detection
Online casino bonus abuse starts at registration: one person, many accounts, one welcome package each. InlineShield checks every new casino sign-up for Gmail dot tricks, disposable emails, VPNs, datacenter IPs and bots before the account exists, and tells you whether to pay the bonus, withhold it, hold the account or refuse it.
Last updated
The welcome offer is the target
Deposit matches, free spins and no-deposit bonuses all have the same weak point: they are paid once per account. A bonus hunter who can make ten accounts gets ten offers. Wagering requirements slow them down, but they don't stop the claim.
Stopping the claim means knowing, at the moment of sign-up, that this "new" player has been here before or is hiding something. That is the one moment InlineShield is built for.
Five sign-ups, four answers
An illustration of how InlineShield answers different sign-ups at one casino. The addresses are made up.
Sign-up Answer What happens
[email protected], home broadband allow account + welcome bonus
[email protected], home broadband allow_no_bonus account, bonus withheld: role address
[email protected], home broadband review held: plus-tagged address
[email protected], VPN review held: same inbox as j.o.h.n+spins
[email protected], cloud IP block no accountAnna is a normal new player and gets the full offer. A generic role address like info@ scores just high enough to skip the bonus, so that player gets an account but not the welcome offer. John's plus-tagged address is held for review; if your team approves him, the webhook says require_kyc, so he can play but is verified before any payout. When John comes back as [email protected] through a VPN, it is the same inbox, so that sign-up waits for your team too. The last one uses a throwaway domain from a cloud server and is refused.
What the casino sign-up check covers
- Inbox aliases: Gmail dot and plus variants and
googlemail.com, matched against earlier sign-ups at your casino. More - Temp mail: listed disposable domains, and unlisted ones found through their mail servers. More
- IP risk: VPNs, Tor exit nodes and datacenter IPs, and a browser time zone that doesn't fit the IP country. More
- Automation: headless browsers, automation frameworks, scripted HTTP clients and machine-made addresses. More
Each answer comes with a risk score, the triggers that fired and reasons in plain language, so your fraud and VIP teams can see why.
Fits any casino platform
On a custom platform, add the browser script to your sign-up page and call the REST API from your registration handler. Copy-paste code is ready for PHP, Node.js, Python, Java and C#. On WordPress or WooCommerce, the plugin needs no code.
Most new accounts start with a 14-day Pro trial, then keep the Free plan with 1,000 screenings a month; move up when your traffic does. See pricing.
Frequently asked questions
Can I still accept players who look a little risky?
Yes. That is what allow_no_bonus is for. The account is created and the player can deposit and play; only the sign-up bonus is held back.
Does InlineShield replace KYC?
No. It screens the sign-up before KYC would normally happen, and tells you when a held account should go through KYC before any payout (require_kyc).
Will it catch a bonus hunter who uses a brand-new email domain?
Often, yes. New temp-mail domains usually run on the same mail servers as known ones, and InlineShield matches them through that infrastructure.
Are my players compared with other casinos’ players?
No. Repeat sign-ups are matched only against your own earlier sign-ups.
How long does integration take?
For a typical registration handler it is one script tag and one server call. The console's Setup page gives you the code with your own keys filled in, and a test button.
Does it use device fingerprinting?
No. InlineShield works from the email, the IP address, the browser's own signals and your sign-up history.
Stop paying the same bonus twice
The Free plan includes 1,000 screenings a month. Create an account, add your keys and see real verdicts on your own traffic. No card, no sales call, no setup fee.