One welcome bonus, forty welcomes.

Fictional scenarios and synthetic data. Reviewed 6 November 2026.

Lagoon Casino runs a welcome offer: match the first deposit up to a set amount, with a wagering requirement before the bonus balance can be withdrawn. On a Tuesday the operator's promotions team notices that forty accounts opened in the past six days have each deposited exactly the minimum qualifying amount, claimed the match, and are now a few rounds away from clearing the requirement. Twenty-two of them used the same referral code. The team wants to void all forty bonuses before the withdrawals arrive. Tomas, who sees the deposits at Northbank Pay, is asked whether the cards back that up.

What is actually being decided.

A welcome bonus is a price. The operator pays it, in expectation, for a player who will go on to deposit again. The decision on the desk is whether these forty accounts are forty players at that price, or one or a few people collecting the price forty times, and what to do that is proportionate to how sure the team is.

Four parties carry something. The operator carries the bonus cost, the game-provider fees on the wagering, and the affiliate commission if those sign-ups were referred. The affiliate carries a reputation and, if the operator claws back, a cash-flow problem. The PSP carries forty small deposits and, soon, a set of withdrawal requests it will be asked to send. The players, if they are players, carry a voided bonus as their first memory of the brand.

The bonus as a contract.

Write the offer out as a sentence with its parts. "Deposit at least 20, receive 20 as bonus balance, wager the bonus 30 times on qualifying games, then withdraw." Each part is a term the operator chose, and each is a place where the operator's expectation can be captured. The expectation is that the average player loses most of the bonus during the wagering. Bonus abuse, as we use the term, is any arrangement that captures the bonus value without being the player the offer was priced for; multi-accounting is the commonest arrangement, one person behind many accounts.

We do not set out here how wagering requirements are cleared efficiently; that is not the defender's problem to describe. The defender's problem is that the offer is priced per account, and the account is the thing that is easy to multiply. OWASP's automated-threats catalogue lists account creation (OAT-019) as a threat in its own right precisely because so many downstream prices, bonuses among them, are paid per account.

Forty sign-ups is a pattern. Forty deposits is evidence.

The sign-up layer, forty accounts in six days with shared referral codes, is where the promotions team is looking. It is a lead. The innocent explanation is real: a referral code is meant to be shared, and an affiliate who posts it to a forum will produce forty sign-ups in six days on a good week.

The deposit layer is where the inference firms up or dissolves. A synthetic illustration from the Northbank export. Forty deposits of exactly 20.00. Fourteen distinct card references (BIN plus last four) across the forty accounts, so several cards fund three accounts each. Three issuer countries, none of them the country the operator is licensed in. Seven device references across forty accounts. Twelve of the deposits produced a soft decline on the first attempt with an insufficient-funds code before succeeding on a second card. Those are observations.

Our reading is that a handful of people control most of the forty. The alternative we keep alive is a group: a shared house, a sports club, a streamer's audience signing up together on one evening. A group explains the referral code and the timing. It explains the shared devices less well and the shared cards badly, since groups of friends do not usually fund each other's casino accounts. The weight is in the cards, which is why the PSP's export, not the operator's CRM, is where the team should start.

Both errors have a price.

Some direct losses in this fictional case can be estimated: forty bonuses, the provider fees on the wagering, and the affiliate's cost per acquisition if it was paid on first deposit. The customer we interrupt is harder to see because the cost arrives later and elsewhere. If the team voids forty bonuses and ten of them belonged to real new players, those ten tell their friends, post the screenshot and, a few of them dispute the deposit with their issuer. The dispute arrives as a 10.4 or a "not as described" code depending on the claim and the applicable classification, and it lands in the ratio the operator's acquirer watches. The Volume 01 lesson measuring errors is the discipline for keeping both numbers on the page.

Where the money wants to go.

The last tell is the withdrawal. Multi-accounted bonus balances, once cleared, tend to want to leave by a route other than the one they arrived by, because the cards that funded them are few and the destinations need to be many. A withdrawal request to a wallet or bank account never used to deposit is a separate decision, with its own rules, covered in deposits, withdrawals and cash-out. For this article it is enough to say that the withdrawal is the point at which a hold costs the operator least and tells it most.

A failure mode to watch.

Acting on the sign-up pattern alone, and acting broadly. A device block covering the seven references removes forty accounts and every future account from a household, a hall of residence or a hotel. A referral-code block punishes an affiliate whose only fault may be a good week. A rule on registrations per hour will be tuned off after the next legitimate promotion. All of them are easier than reading the deposit export, and none of them teaches the team anything about who the forty were.

A way to work it.

1. Write the offer as a sentence with its terms. Note which term each observation touches.
2. From the PSP export, count distinct card references, issuer countries and device references against distinct accounts. Write the ratios down.
3. For each shared attribute, name the innocent explanation and ask whether it covers the whole cluster or a few members.
4. Separate the cluster into accounts where the cards link and accounts where only the referral code links. Treat them differently.
5. For the linked set, hold bonus-funded withdrawals and ask the source-of-funds question on the cards. For the rest, let the bonus run and watch the second deposit.
6. Tell the affiliate manager what you found, in observations, before any clawback. Set a review date and an owner for the hold.

Take it to the desk.

If you voided every bonus in this cluster and you were wrong about a quarter of them, what would those ten players tell their friends? Try it: Bonus multi-accounting, and the Volume 01 case Promo abuse for the retail version. Look up: bonus abuse and multi-accounting.

Edited 6 November 2026. Primary references are listed above; fictional scenarios are not claims about Antifrog customers or operating experience.

Fictional learning material. Any numerical examples are synthetic. Use only authorised, appropriately minimised records for workplace exercises; do not upload customer information to this learning site.