At GanaExpress, a betting operator in Peru, multi-accounting fraud came to account for 15% of the commissions it paid to its agent network. Much of the conversation around multi-accounting treats it as a device and IP address problem. My view is that it is, above all, an identity problem, because the rule being broken is one person, one account. From that starting point, I look at how it works in online betting, why the usual controls fail to stop it and which combination of measures makes it possible to detect.
What is multi-accounting fraud?
Multi-accounting fraud is the practice of a single person opening and controlling several accounts on a platform, under their own identity or with fake or borrowed identities, to obtain benefits that the operator limits to one account per person, such as bonuses, commissions or betting advantages.
Not everyone with two accounts is committing fraud. Some players forget their password and sign up again, and some families share the same phone, each betting from their own account. Multiple accounts become fraud when there is intent to exploit a rule designed for a single account holder. In the region’s regulated markets, that rule is often already written into the regulations, which require operators to identify every player.
How multi-accounting fraud works in online betting
When an operator tells me they have a multi-accounting problem, the first thing I try to understand is which benefit is being exploited. The answer changes the diagnosis, because each variant leaves a different trail and hits a different part of the business.
Bonus abuse and welcome promotions
This is the best-known variant. A sign-up bonus, a free bet or a batch of free spins is designed to acquire a new customer, and someone who opens ten accounts collects it ten times. The impact goes beyond the value of the bonus, because acquisition cost is calculated per customer and multi-accounting multiplies it by customers who do not exist.
In the region’s recently regulated markets, much of the competition for players is fought with promotions, which makes the welcome bonus the first target. Once the attack is automated, the scale changes completely, because a single network can register accounts in bulk and replace every blocked account with a new one.
Agent and affiliate commission fraud
This is the variant least discussed outside Latin America, and I think the reason lies in the business model. In the region, many operators grow through networks of agents who assist players and earn a commission based on their results. To inflate it, an agent opens a second account under a fake identity and splits bets between the two.
The registered account takes the winning bets and generates commission, while the fake account absorbs the losses and is eventually abandoned. Because the two accounts are never netted against each other, the house can come out ahead overall and still pay commission on inflated figures.
Multiplied across thousands of agents, that gap reached 15% of commission payouts at GanaExpress. The same scheme appears in affiliate programs that pay per registration or per first deposit.
Collusion and coordinated betting
Here, several accounts controlled by the same actor play toward a single outcome. At an online poker table, whoever controls two seats sees more cards than their opponents and can coordinate their play.
With chip dumping, one account deliberately loses to another controlled by the same actor in order to transfer balance, a technique that can also give illicit funds a legitimate appearance.
In sports betting, splitting a stake across several accounts makes it possible to cover several outcomes, claim promotional odds more than once or get around the limit the operator sets for each customer.
Fake and synthetic identities to open accounts
Every additional account needs an identity that can pass registration. Fraudsters rely on stolen documents, synthetic identities that combine real and invented data, and identities borrowed or bought from people who hand over their details for money.
Regulators already treat this as a priority risk. The UK Gambling Commission rates inadequate controls over linked or duplicate accounts as a high risk, and documents the case of a customer who deposited around £40,000 in six months after opening accounts with the details of five different people.
Evading self-exclusion and account bans
A player banned for abuse, or someone enrolled in a self-exclusion register, can return through an account in another person’s name. At this point, multi-accounting directly affects the operator’s responsible gambling obligations.
According to an analysis of identity theft complaints by Spain’s gambling regulator, the Dirección General de Ordenación del Juego (DGOJ), more than 7,600 people on the national self-exclusion register may have gambled using third-party data. As Latin American markets develop their own responsible gambling tools, this risk will grow, because every limit set on a person creates an incentive to play under someone else’s identity.
Why traditional controls fail to stop multi-accounting
To explain where the chain breaks, I prefer to start from a scenario. It is hypothetical, but each piece reflects patterns that regulators and operators have already documented.
Take a licensed operator that launches a welcome bonus at the height of the soccer season. Its registration flow validates the document and a selfie, but the liveness check cannot tell a real person from a video played in front of the camera. A single network opens dozens of accounts with third-party documents, claims the bonus on each one and withdraws to different bank accounts. Among those accounts is also someone who had self-excluded. The bonus paid out is only the first cost. The fraud team manually reviews hundreds of sign-ups, the operator has to explain to the regulator why a self-excluded player was able to gamble again and, in the worst case, it faces sanction proceedings.
What concerns me most about situations like this is the false sense of control. The operator sees its system approving legitimate users without issue and concludes that it works, when in reality it has never been tested by a well-resourced attacker. In this scenario, there are three points of failure.
Document verification without robust liveness detection
Confirming that a document is authentic does not prove that the person presenting it is its holder, or that they are in front of the camera. That is what happened to GanaExpress before it changed its approach. Its two previous solutions, an external vendor and an in-house development, validated honest users without trouble, but a photo or a video was enough to sustain a fake identity. They stopped the first wave of attempts, but not the second or the third, each more sophisticated than the last. Without robust liveness detection, verification works for honest users and lets fraudsters through.
Photos, videos, deepfakes and injection attacks
Attacks on liveness detection have evolved in two directions. Presentation attacks hold a photo, a screen or a mask up to the camera. Injection attacks go further, replacing the camera feed with a fabricated video through virtual cameras or emulators, so the system analyzes an image that never passed through the sensor. With AI-generated deepfakes, that video can reproduce a third party’s face with convincing expressions. Defending against video injection attacks is now a baseline requirement for remote onboarding, and it will matter even more as these tools get cheaper.
Device and IP signals, useful but not enough on their own
Device fingerprinting and IP analysis catch the unsophisticated fraudster, the one who opens several accounts from the same phone. Organized fraudsters use anti-detect browsers that alter the device fingerprint, residential proxies that mimic independent home connections, and emulators or device farms to make each account look like a different user. At the same time, these signals produce false positives with families or roommates who share a connection. They are useful for linking accounts, but none of them proves that a different person is behind each one.
How to detect and prevent multi-accounting fraud in 6 steps
None of these measures solves the problem on its own. What I have seen work is combining them, with identity as the common thread throughout the life of the account. The first three act at registration and ensure that every account is tied to a real and unique person. The next two monitor the account once it is active, when it changes hands or starts behaving like part of a network. The last one ensures that every decision can be explained to the regulator.
1. Biometric onboarding with document validation, liveness detection and face matching
Registration is the moment when each account’s identity is established. Complete biometric onboarding validates the document, uses liveness detection to confirm there is a real person in front of the camera and matches their face against the document photo. This ensures that every account is tied to a verified person from the start.
2. 1:N facial deduplication to enforce one person, one account
For me, this is the piece that closes the loop. Registration checks answer whether the person is who they claim to be, and deduplication answers whether they already have another account. It works by comparing every new face against the existing user base. If it matches an account registered under a different name, the alert is triggered before the second account is activated. This is the control that turns the one-person-one-account rule into something verifiable, and it is part of identity verification for online betting and gaming operators.
3. Injection attack and deepfake detection
Deduplication is only reliable if the captured face is real. Injection detection checks that the image comes from the device’s physical camera, while deepfake analysis looks for traces of synthetic manipulation in the video.
4. Recurring authentication at moments of risk
Verifying at sign-up is not enough if the account later changes hands. Re-authenticating the account holder biometrically at a withdrawal, a commission payout or a change of sensitive details confirms that it is still the same person, with minimal friction for legitimate users. GanaExpress applied this logic through periodic verification of its agents, following the principle of perpetual KYC (pKYC).
5. Behavioral signals and links between accounts
Some indicators only emerge after registration, such as accounts that mirror each other’s bets, withdraw to the same bank account or become active in the same time slots. Behavioral biometrics adds another signal, the way each user types, taps the screen or navigates. Combined with device signals, these indicators help prioritize which accounts to review.
6. Traceability for regulatory audits
Every decision on an account should leave evidence of what was verified, when, with what result and why it was approved or blocked. That traceability allows the operator to answer a regulator’s request with data rather than after-the-fact reconstructions.
Multi-accounting fraud and betting regulation in Latin America
Peru has one of the region’s clearest frameworks for the one-person-one-account rule. Ley 31806, published in the official gazette El Peruano on June 28, 2023, amended Ley 31557 on remote gaming and sports betting. It establishes that, to become a player, a person must first register, only once, on the platform and obtain the corresponding user code or account. The operator must verify the player’s identity, age and nationality at registration, and confirming that the player’s identity matches their account is a precondition for every bet. The implementing regulation was approved through Decreto Supremo 005-2023-MINCETUR, published on October 13, 2023.
My reading is that the law sets the rule and leaves it to the operator to enforce it. A registration check confirms that the identity is real, age verification included, but cannot on its own detect that the same person has already registered with different details. For registration to be truly unique, every new player has to be compared against the existing ones.
Across the rest of the region, the picture is uneven. In Mexico, where I work, the industry has long argued that the federal gambling framework has fallen behind the growth of online betting. Brazil, which had built a federally regulated market, issued a provisional measure (Medida Provisória) in September 2026 banning the operation, offering, brokering and advertising of betting, and in November a court allowed three platforms to resume operations. We have followed that process in our analysis of online betting regulation in Brazil.
Looking beyond the region, the direction is clear. In its 2026 risk assessment, the UK Gambling Commission rates inadequate controls over linked or duplicate accounts as a high risk, including the identification of connected accounts and the application of controls across all accounts held by the same customer. The most mature regulators already supervise the person rather than the account, and I believe Latin American frameworks will move in the same direction.
How a Peruvian operator cut commission fraud from 15% to around 3%
GanaExpress, the operator I mentioned at the start, is the betting brand of The OxiaCore Project (CPEL) in Peru and the showcase for its B2B iGaming platform. After its two previous solutions failed against photos and videos, it implemented biometric onboarding, periodic verification of its agents and injection attack detection, with the first flow in production in under three weeks. Commission fraud fell from 15% to around 3%, the operator now has more than 10,000 verified agents, and it has moved from recruiting through closed campaigns to keeping recruitment permanently open. As Carlos V. of CPEL puts it, “Multiple accounts still exist, but they no longer hurt our numbers.” The details are in the GanaExpress success story.
Multi-accounting, mule accounts and synthetic identities compared
These are related phenomena that often appear together, because synthetic and borrowed identities feed multi-accounting, but each requires different controls.
| Goal | Who controls it | Key signal | |
|---|---|---|---|
| Multi-accounting | Obtain a benefit limited to one person several times | The same person or network, behind several accounts | The same face behind accounts with different details |
| Mule account | Move illicit funds and break their traceability | A third party who lends or sells their account to a network | The person operating the account is not its holder; deposits and withdrawals to other accounts |
| Synthetic identity | Create a non-existent person to open accounts or access products | The fraudster who builds it | Data or documents that do not belong to a real person |
Mule accounts call for their own approach, covered in our work on mule account detection.
Multiple accounts will not disappear from online betting, and no control eliminates them entirely. What is within an operator’s reach is ensuring they stop shaping its margins, its agent program and its relationship with the regulator. That starts with treating identity as the data point that connects every account belonging to the same person, from registration to every withdrawal.
FAQs
It is the practice of a single person opening and operating several accounts on a platform, under their own identity or with fake identities, to obtain benefits limited to one account per person, such as bonuses, commissions or betting advantages.
By combining identity verification at registration (document, liveness detection and face matching), 1:N facial deduplication against the user base, injection attack detection and recurring authentication at withdrawals or commission payouts. Device and behavioral signals help link accounts.
Ley 31557, as amended by Ley 31806, establishes that players register only once and obtain a code or account, and that the operator verifies their identity, age and nationality. Before every bet, the operator confirms that the identity matches that account.
Bonus abuse is one of the goals of multi-accounting fraud: several accounts are opened to claim the same promotion more than once. Multi-accounting is also used to inflate agent commissions, coordinate bets or evade self-exclusion.
Because verification without robust liveness detection can be fooled by a photo, a video or an injected deepfake, and because verifying at sign-up is not enough if the operator does not check whether the same person already has another account.
