How bonus abusers use the Gmail dot trick

What Gmail actually does with dots and plus signs

Google says it plainly in its own help pages: dots in a Gmail username don't change where mail goes, so every dotted version reaches the same account (Google Help). Gmail also delivers anything after a + to the base address, a feature meant for filtering mail, and treats googlemail.com as the same as gmail.com.

The arithmetic is what makes it useful to abusers. A ten-letter username has nine gaps that can each hold a dot or not, which already gives hundreds of spellings, before a single plus tag is added. Upper and lower case add nothing to delivery, but they defeat a sloppy uniqueness check too.

[email protected]            ← the real inbox
[email protected]           → [email protected]
[email protected]          → [email protected]
[email protected]   → [email protected]
[email protected] → [email protected]

How the trick is used against casinos and sportsbooks

The pattern is simple. The abuser registers with the base address, claims the welcome bonus or free bet, and clears the wagering. Then they register again with a dotted variant, confirm the account from the same inbox, and repeat. Every confirmation email lands in one place, so the "is the email verified?" box is ticked each time.

It has also been industrialised. Services sold as "temporary Gmail" hand out dot and plus variants of a small pool of real Gmail accounts, so the addresses look like ordinary webmail instead of temp mail. When Castle studied one of them, it found 46,000 scraped addresses that normalised down to just 291 base accounts, some of which had signed up at a Castle customer (Castle). No disposable-domain blocklist catches that, because the domain is gmail.com.

Not every provider works the same way

The fix is normalisation: reduce each address to the inbox it delivers to. The rules differ per provider, and getting them wrong either misses aliases or merges different people:

• Consumer Gmail (gmail.com, googlemail.com): dots are ignored and the plus tag is dropped.
• Google Workspace on a company domain: dots can matter, so a dotted Workspace address may be a different person. Don't strip them on custom domains.
• Outlook and Microsoft 365: plus addressing is on by default in Exchange Online (Microsoft Learn), and dots are part of the address. Drop the tag, keep the dots.
• Everything else: lower-case it and leave it alone unless you know the provider's rules.

Normalise at registration, before the bonus

If you build it yourself, store the normalised inbox in its own indexed column next to the address the player typed, and check that column for an earlier account before you create the new one. Keep sending mail to the address as typed; the player chose it. A minimal version for Gmail:

// Fold a consumer Gmail address to its inbox. Other domains: lower-case only.
function gmailInbox(address) {
  const email = address.trim().toLowerCase();
  const at = email.lastIndexOf('@');
  if (at < 1) return null;
  let local = email.slice(0, at);
  const domain = email.slice(at + 1);
  if (domain !== 'gmail.com' && domain !== 'googlemail.com') return email;
  local = local.split('+')[0].replace(/\./g, '');
  return local ? `${local}@gmail.com` : null;
}

gmailInbox('[email protected]'); // '[email protected]'

Two practical points. First, do the check on your server, not only in the browser form. Second, decide in advance what happens on a match. Refusing outright is harsh on the forgetful player who registered once before; holding the sign-up for a look is fairer.

How InlineShield handles it

InlineShield applies these per-provider rules to every sign-up it screens and compares the inbox with earlier sign-ups at your site only, never with other operators' players. Two rules apply:

1. A plus-tagged address is held for review (verdict QUARANTINED, recommendedAction: "review"). It isn't refused. If your team approves it, the signup.approved webhook comes back with require_kyc, so the player can join and is verified before any payout.
2. A second account from an inbox already registered at your site is held with the trigger DUPLICATE_INBOX_ALIAS, so the reviewer sees which earlier sign-up it matches. This hold has a switch in Settings › Rules.

A first sign-up that only uses dots, like [email protected], isn't held for the dots alone. Dots are how many people write their name. It's the repeat that matters. See Gmail alias detection for the feature and online casino bonus abuse for the wider picture.