How to withhold the welcome bonus from risky players

Why gate the bonus instead of the account

Most sign-up fraud decisions are framed as "let in or keep out". For gambling operators that framing is expensive both ways. Refuse a borderline player and you lose a customer you paid to acquire. Let every borderline player in with full offers and the promotion budget funds multi-accounters. Trade press frames the dilemma well: can operators stop bonus abuse without driving players away (iGamingBusiness)?

Sift calls the answer "risk-based bonus delivery": at registration, withhold or reduce the offer for high-risk accounts instead of refusing the account (Sift). A genuine player who gets no bonus on day one can still deposit and play, and usually gets the offer a little later. An abuser who gets no bonus has no reason to stay.

Three bands, not two

The middle band is the new one. It should hold the sign-ups that are a bit unusual but not a specific red flag: a generic role mailbox like [email protected] as a personal account, say. Specific red flags, such as an inbox that already has an account, belong in review.

Pick release conditions in advance

A withheld bonus should have a clear way back, or it's just a quiet refusal. Common choices:

• After identity verification. The player completes KYC and the offer is credited.
• After a first deposit from a payment method in the player's own name.
• After a manual look by your risk team, for high-value offers.
• After a period of ordinary play, for loyalty-style offers.

Write the condition into your bonus terms, so withholding is something the terms allow rather than a surprise. Advertising rules and consumer law in your markets may say how offers must be described and when they can be withdrawn: check your licence conditions before you change the wording.

Tell the player

Silence is what turns a careful policy into a complaint. A short, neutral message works: "Your welcome offer will be added once we've verified your account. This usually takes a few minutes." Never say "we think you're a fraudster"; you don't know that, and most people in this band aren't.

Doing it with InlineShield

InlineShield screens each sign-up before the account exists and returns a recommendedAction that maps onto the bands:

• allow: clean, so credit the offer.
• allow_no_bonus: the sign-up was allowed but its risk score is 25 or higher, so open the account and hold the offer back.
• review: held for your team, for example a repeat Gmail inbox, a plus-tagged address or a VPN. When it's approved, the signup.approved webhook says require_kyc or allow.
• block: refuse, for example a disposable address under the default rules.

The action is advice sent next to the plain verdict, never instead of it: your bonus engine decides. Each answer also carries plain-language reasons, which your support team can use when a player asks. Every plan includes every action. Full detail on risk verdicts; for KYC in the review band, see when to require KYC at registration; and for the casino view, the iGaming overview.

Measure it

Track, per band, how many accounts go on to deposit and how many offers are later released. If almost nobody in the middle band ever deposits, it is doing its job. If most of them do and are released, you can loosen it. Feedback you give in the console, marking sign-ups as fraud or legitimate, also feeds InlineShield's learning, and anything beyond a hold needs your approval first.