Dive into the World of Fraud with the "What The Fraud?" podcast! 🚀 Our guest today is Kris Galloway, Head of iGaming Product at Sumsub, who has 12 years of experience in the iGaming industry. In this episode, Tom and Kris discuss market growth, tightening regulations, and new technologies that are transforming the iGaming industry for both businesses and players.
TOM TARANIUK: Hello and welcome back to “What The Fraud?”, a podcast by Sumsub where digital fraudsters meet their match. I’m Thomas Taraniuk, currently responsible for some of our very exciting partnerships here at Sumsub. The world of iGaming in 2024 is ever-changing and evolving, where market growth, stricter regulations, and novel technologies are reshaping the industry landscape for businesses and players alike. With global revenues projected to exceed 114 billion USD by 2028, the sector faces a growing wave of fraud, showing a 64% year-on-year increase between 2022 and 2024. So staggering stuff, people. So today we are going to unpack all of this and discuss a specific account fraud scenario to further bring the topic alive with the help of our esteemed expert guest. I would like to welcome Sumsub’s very own Kris Galloway to “What The Fraud?”
I feel Kris is certainly going to teach me a thing or two in this episode, and we hope the same for you listeners out there. He first entered the industry as a poker specialist working at PokerStars casino. You might have heard of it gaining experience in global markets across poker, sports and of course, online casinos as well. Nearly a decade and a half later—12 years, to be exact—he joined Entain in 2023, transitioning to the world of skin gambling, where he was exposed to Gen Z culture and their product expectations shaped by evolving tech landscapes. Now, I have the pleasure of working alongside Kris as Head of iGaming Product at Sumsub. In this role, Kris focuses on transaction monitoring and building a department to cater to the ever-evolving requirements of gaming operators and platforms globally. Thank you for joining me today, Kris. How is life in sunny Spain? I wish I was there this time of year, but unfortunately I’m in dreary old London.
KRIS GALLOWAY: You should come visit. It’s beautiful. It’s exactly what you’d expect. It’s not scorching hot like it was over summer. It’s kind of still shorts and t-shirt weather. Good food, nice beaches. What you’d expect. Come over at some point.
TOM TARANIUK: Well, I’m going to take you up on that offer, but for now, let’s get stuck into the episode, Kris, as we have plenty to talk about.
KRIS GALLOWAY: Let’s go. Can’t wait, let’s go.
TOM TARANIUK: So as I said, there’s lots I want to discuss with you today, including regulatory changes, market expansion, AI, artificial intelligence and responsible gambling measures.
Suggested read: What is Responsible Gaming?
Whilst we’ll also touch a little bit around the adoption of cryptocurrency within this vertical or industry rather.
So before we get into the thick of it, Kris, I wanted to explore a specific scenario involving both machine learning and of course, account fraud as well. And I do want to pick your brain on a case that’s as common as it is complex. So what makes this case so intriguing, Kris, is how deceptive it appears. At first glance, everything seems perfectly legitimate. Yet beneath the surface, of course, it’s anything but that. So imagine this, Kris: a fraudster deposits a large and I mean large sum of illicit money into a gambling account, and then they place favorable odds to them around 1.2 to 1.3 and then withdraw the original deposit to the same account while withdrawing if they win the winnings to a different account. This makes these illicit funds appear legitimate by passing AML or anti-money laundering and rollback protocols, so if they indeed lose, it’s not a real loss as the money was illicit, and if they indeed win, the profits are harder to trace. And of course, this money, if they do win, is used for other nefarious purposes globally. So, Kris, my question to you: is this type of fraud on the rise among both online gambling and sports betting accounts? And Kris, if so, why is it gaining momentum now?
KRIS GALLOWAY: So much to unpack here. I feel it’s it’s certainly common enough to defraud people of millions, but I wouldn’t say it’s common enough that it’s been solved just yet. Fraud in general in iGaming is very liquid. It’s very responsive to its environment. There’s a constant arms race between between the fraudster and the operator. So as soon as a specific scheme in this case gains momentum, it usually gets shut down fairly quickly. The more people cottoned onto it, it’ll kind of snowball. And obviously operators want to prevent that from happening as quickly as possible. If there’s already a small group of people getting away with it. I’d say another example of this would be Courtsiding, for example. I think the BBC recently did a report on this, and there had been a community of people who were traveling around looking for tennis matches with very slow umpires and placing bets before the score was updated. So whenever there’s something like that, it tends to have its moment and then it gets shut down as soon as it starts to become more prominent. So I wouldn’t say that this is on the rise, but it’s certainly worth keeping tabs on.
TOM TARANIUK: I’d love for you to break down the withdrawal part, as I’d like to know exactly how fraudsters manipulate the process to bypass AML or anti-money laundering checks. And also, from your perspective, what weaknesses does this usually reveal?
KRIS GALLOWAY: So in this case, one of the purposes of the rollback or closing the loop, as it’s also called, is to prevent fraud and also to prevent money laundering, because the money you deposit has to go back to the account of origin. In this example, because of the way it’s done, the withdrawal process appears to be legitimate. As far as the operator is concerned there, the bulk of the money is being put back to where it came from as far as the bank account holder is concerned, the money’s gone out and it’s come back. So this is very difficult to identify as far as what weaknesses it reveals. I think it suggests that at the operator level, there aren’t checks in place which identify this as a potential cause of concern. For example, one trigger or one rule that you may have would be to identify instances where a large deposit has been made, whereas normally a user might not necessarily deposit an increment of that size, it would be looking at how soon after an account has been created is a deposit made, and what’s the size of that deposit? How soon after a deposit has been made, a bet is then placed? What’s the value of that bet? Has another bet been placed after that? Are the bets being made on, or are the wages being made on bets with odds which are favourable to the objective of the of the fraudster in this case? So all of these are things that can be that can be put in place with existing rules. I think we’ll talk about this a little bit later. AI is fantastic, but it’s not necessary to identify fraud at this level.
TOM TARANIUK: Why is it also a challenge to trace the money back to its original source in this particular scheme? Are there any signs that could help operators detect it earlier?
KRIS GALLOWAY: Yes there are. I should start by saying that once a transaction has been approved by the operator—particularly in iGaming—the money is gone. This is where the uniqueness of this situation lies. Sometimes, the victim doesn’t even notice, or they may notice but aren’t concerned because, upon checking, the funds either appear to be there or have been returned. It could have just been an error that was rectified somehow. It could be that they already have a betting account somewhere else, and they think that maybe this is a parent company or something, so they might just dismiss it, which means that they’re leaving themselves open for this to happen again. It could be detected in a number of ways, typically by looking at the events that are taking place on the operator’s platform. Because ultimately, and I have a feeling we’ll come back to this a little later. The operator wants to avoid chargebacks, so system or methods can be put in place to monitor what’s happening. And then rules can be created to make sure that you’re identifying instances where this occurs and you nip it in the bud before it does.
Suggested read: 4 Ways to Protect Your Business from Chargeback Claims
TOM TARANIUK: Beyond the payment fraud side, how does identity fraud play a part in this entire process? I mean, is it not primarily a scheme that facilitates the theft of funds from the operator itself?
KRIS GALLOWAY: It is. They’re creating an account on the operator’s platform, mimicking the bank account owners’ details in this case. So and another thing worth remembering is that in general, the industry focuses much more on money coming in, than money going out. So that’s they try to facilitate that process as much as possible. So in this case the fraudster is ultimately placing bets pretending to be someone after depositing a large sum. So as far as the identity fraud is concerned at the operator level, they are adopting a fake identity to so that they can reflect who the card holder is in this case, or who the bank account owner is. But it could go deeper than that, because on one hand, they could just be buying lists off of the dark web and getting people’s details that way. In other cases, I mean, it could be somebody they know in real life who they’re whose identity they’re using. So there are lots of different levels to it. But that’s where the identity fraud part comes in.
TOM TARANIUK: Well, often what you’ll see with the bonus abuse other individuals selling their, let’s say, their details or their login credentials to go in, right? Is this a big issue or increasing issue, or are there sort of things that we can tackle it with technology wise?
KRIS GALLOWAY: This type of fraud dates back at least a couple of decades, and it continues to be prevalent in places like Brazil—though recent legislation aims to crack down on it to some degree. It often begins opportunistically, with individuals reaching out to family and friends to offer a commission, for example, on money earned through bonus abuse. However, it can also occur on an industrial scale.
Suggested read: Brazil Gambling Regulations: All You Need to Know in 2024
In some cases, fraudsters exploit the identities of deceased individuals to create accounts, using their information for fraudulent purposes. There are many levels to this type of fraud: from someone who opportunistically thinks, ‘I could maybe take advantage of this,’ to industrial operations where people are essentially running fraud ‘sweatshops.’ We’ll likely discuss examples across this spectrum today.
TOM TARANIUK: So it’s not a victimless sort of crime. These these bonus abuse is harmless as it might sound, if we’re talking about an opportunistic person jumping in and saying, look, can I borrow your details because I want to go in and actually make some money and take advantage of the system. What I’d really find interesting is, I mean, from our perspective, as you well know, we do produce on a yearly basis the annual Sumsub fraud report. And in 2023 version, we state that over 70% of fraud happens after the initial onboarding of the player, right? So in the perspective of account takeovers, money muling and moving illicit funds through businesses to make them primarily available within their bank accounts, what would you say needs to be done?
KRIS GALLOWAY: I mean, we need to come at this from a couple of different perspectives. The KYC process in itself can vary greatly depending on whether the user is in a regulated market and unregulated market, depending on how strict the regulator is. In those markets, it can be a case of submitting documentation, submitting a selfie and setting deposit limits. Or it could just be a case of using social sign on and logging in using your steam account, for example. So depending on how stringent that is, would determine how many opportunities the fraudster would have to then take advantage of the platform. In other cases, though, if we look at crypto, which is considerably more anonymous, then it’s sometimes the case that the operator won’t have any information on the actual user. So at that point, there’s much more of a dependency on behavioral biometrics. So you can identify what the user is doing based on their past behavior based on standard deviation of what they’ve done before versus what they’re doing now. And you can raise flags from that perspective.
TOM TARANIUK: Okay. That makes sense. I mean, when we’re talking about them actually placing bets, withdrawals, etc., what happens if a fraudster loses the bets that we talked about earlier? Does the risks fall on the operator that you mentioned or is there? I mean, it’s a tough sort of challenge to tackle, isn’t it, for the the operator. Do you know why that is?
KRIS GALLOWAY: I mean it does fall on them basically. So as far as the user is concerned, they can just burn the account and they’re long gone before anybody realizes the risk for the operator is the chargeback, which they always have to pay it. A chargeback can be contested, but typically this requires a lot of legwork on the operator’s side, they’d need to to create a case. They’d need a lot of info, including betting patterns, geolocations, IP addresses, things like this to really prove that they did everything they could to prevent that from happening, which in this case is often not the case because they have already adhered to all of the the standard requirements that you would. And this is what makes it so unique again is the fact that they—the fraudster—really understand what the requirements are and they’re adhering to those and then they’re manipulating it.
TOM TARANIUK: Yeah. Of course, Kris. And from the angle of, let’s say, chargebacks costing huge amounts of capital for a lot of these operators and platforms, is there anything that’s being placed into sort of the frameworks, the risk frameworks to actually stop this as we move forward?
KRIS GALLOWAY: I think there’s this constant arms race between the fraudsters and the operators. So yeah. Typically as soon as something like this has a big enough impact, then it becomes more cost effective to implement a solution than it does to continue suffering those losses. So depending on what the fraud is and depending on how it’s happening, how prevalent it is, where it’s coming from, if you can simply close a gate somewhere else to prevent it, all of those factors determine what the solution is and typically how much is invested in solving the problem.
TOM TARANIUK: We often have a sugar coated perspective around the basis of these hackers, these these people who are defrauding people. It’s not someone in a “V for Vendetta” mask or black hat hiding in a bunker doing matrix code, and often not with the democratization of like, let’s say, these technologies. It’s real life people who are acquiring new information through different groups to bypass a lot of the securities around these iGaming operators and platforms. So I would love to see, Kris, from your perspective, what you feel about the romanticization of these hackers and obviously these fraudsters as well.
KRIS GALLOWAY: This is just one example. Ultimately, operators aim to keep these types of examples under wraps. In real life, hacking and fraud isn’t always using a secret code and finding a back door, then navigating through a bond villains files to find a folder titled “World Domination”. It’s an ugly exploitation of human nature and normal vulnerabilities. And the important thing is to be aware that you can’t catch everything and just prepare as best you can.
TOM TARANIUK: Absolutely. It’s throwing a net. I’ve had the matrix in my head just then as well. Kris, your experience working in many complementary markets, both unregulated and regulated, is very fascinating to me. A quick question for you, Kris. What recent global regulatory changes are impacting the iGaming industry the most?
KRIS GALLOWAY: That’s a deep question. In general, I’d say there’s an increased focus on player protection, which is happening consistently across the board. For example, vulnerability checks were recently introduced in the UK and will continue to evolve over the coming months. Enhanced KYC practices, such as Non-Doc verification (which consults a government database) and responsible gambling database checks like Germany’s Oasis, are also being implemented. There’s a constant evolution of features such as deposit limits, reality checks, and time-outs, which vary across regions. Brazil, for instance, is in the process of regulating and rolling out more requirements. So there are numerous changes impacting the industry globally in different ways.
TOM TARANIUK: Absolutely. So, Kris, from your perspective, then we’re talking a lot about the vulnerability checks, which are being implemented in very mature markets for iGaming. But when we’re talking about Brazil, where let’s say they’re moving from the grey market into a more open but regulated market, is there a lifecycle where they slowly build up these regulations, or does it all happen at once?
KRIS GALLOWAY: It can vary massively depending on how strict they want to be from the get go. Germany, for example, is notorious for being very strict from very early on. A lot of the US states have that as well. Where there are some others who will take a template, they’ll look at what other markets or other regulators have done and they’ll adopt that and then they’ll slowly evolve it over time.
TOM TARANIUK: Would you say that regulators in these markets are more reactive than actually proactive when implementing new critical regulations, which protect players within the iGaming industry?
KRIS GALLOWAY: One of the main challenges is creating a backend that’s dynamic and adaptable enough for all the regions you operate in. For example, we recently looked at the differences between Germany and the UK. While there are many overlaps, there are also significant areas where different requirements are needed for each region. This issue isn’t limited to the product alone; it also affects bonuses, marketing strategies, and the way VIPs are managed.
For instance, an operator might need to adapt to specific loss limits in one region and enforce preset slot speeds in another. I don’t think it will be long until regulators start demanding at least basic event monitoring. With event monitoring, everything they require—or aim to achieve—can be tracked and enforced. I believe operators should start preparing for this, especially in terms of user experience.
Balancing compliance with user experience is another challenge, as you don’t want to interfere too much with the user’s purpose, which is to gamble and have fun. At the same time, you need to ensure regulatory requirements are being met.
TOM TARANIUK: Completely agree. I think the predominant force for these regulators is to protect the users. These players who actually want to have a good time, right? So when we’re speaking about Germany and the United Kingdom. As iGaming actually expands into emerging markets like Asia, APAC and Latin America, what are the main regulatory challenges businesses need to be aware of?
KRIS GALLOWAY: I think the biggest challenge is the variability in regulation. As we discussed earlier, regulations can differ significantly—not only between countries but even within the same country, as in Canada, the US, or India. Keeping up with compliance is challenging: understanding what’s required is difficult enough, and staying up to date with changes adds another layer of complexity. Some regions also have very vague regulations that evolve over time, making it unclear when specific changes are necessary.
There’s always a strong focus on KYC. In Latin America, for example, Brazil requires users to submit their CPF (identity number) along with verification documentation. Additionally, the cultural impact of regulations is worth considering. In Brazil, for instance, users are accustomed to operators providing a very simple onboarding process. In the absence of strict regulations, this streamlined approach made sense to facilitate a smooth user experience. Moving forward, however, operators in that market will need to balance compliance with ease of onboarding to prevent users from turning to black-market alternatives.
Suggested read: KYC and AML—Key Differences and Best Practices (2024)
TOM TARANIUK: Completely agree. You want to keep everything regulated and of course taxable as well. I love your first point there. Keeping up with compliance. It can be our new reality TV show here at Sumsub. But of course I mean from the perspective of obviously these new regulations, we should also look at responsible gambling as well. Online gambling operator Gamesys Operations Limited was fined 6 million GBP for social responsibility and anti-money laundering, or AML, failings, by the UK Gambling Commission. So, Kris, can you explain for us and of course, the listeners here, how can artificial intelligence be used as a tool for responsible gambling measures? And perhaps how can I help to monitor player behavior?
KRIS GALLOWAY: Absolutely. So I mean AI is massive. It’s the future. It’s very much here to stay. And anybody who says otherwise is being rather foolish in my opinion. However, I want to caveat that just by saying that I think when we look at the example that you just mentioned, AI isn’t necessary to have prevented that. I think that could have been prevented by just ensuring that you have basic event monitoring or transaction monitoring in place, so that you’re looking at how your players are behaving, you understand how the platform is being used, and more importantly, you’ve got flags and triggers in place whenever a certain action occurs.
Now AI changes the landscape drastically I’d say, because it can obviously detect unusual and inconsistent gambling patterns, and it can trigger alerts or interventions in real time. It can predict when a player might be developing a gambling problem. Whereas you’re not relying on triggers that have been created or let’s say, rules that have been created by a human that may be based on previous trends that aren’t even being used anymore, whereas the fraudsters are going to be or they have historically been a step ahead. So AI is in a place to understand what’s happening now, understand how users are engaging with the platform, in a place to understand where nefarious practices are being applied and to really nip them in the bud in real time. I think that AI is going to do a lot for anti-fraud. I think as far as responsible gambling is concerned, the regulators need to take the first step into understanding how the technology that’s already available can be leveraged before enhancing that using AI.
TOM TARANIUK: Got you Kris. I mean, this is futuristic stuff, right? When we’re talking about all of these different variables which feed into, let’s say, a risk profile, this is on an ongoing real time basis, right? Where you can set thresholds to say if they’re too risky or if you think or the AI, let’s say model thinks that the user is going to commit fraud at one point. So we’re mitigating fraud before it even happens, which sounds quite crazy to me. And I don’t know if anyone who’s listening or yourself, Kris, if you watch Minority Report, but it’s one of those great films. I think it’s one of those situations where you’d never expect it to happen. But if we label a player with something like, ‘We think you might commit fraud in the future’ or ‘We think you might have a gambling addiction,’ even without concrete indicators—just theoretical assumptions—do you think that poses an issue, Kris?
KRIS GALLOWAY: I’m not sure if an ‘issue’ is necessarily the right word. I mean, now we can obviously in a much slower capacity, we can identify cases where users might be trying to win back their losses. For example, rules could be set up to identify that. I think the difference is that the AI model is going to have a much higher degree of confidence as far as identifying that is concerned, and then taking the humanity out of it, I suppose, may be a slight issue for some users who are going to turn around and say, no, it’s just the computer, it’s just the AI. I’m not like that. I’m the exception. That might be where an issue comes in, but ultimately it’s going to be much more accurate. It’s going to have a much more reliable sample to base its decisions off of. And as long as you’ve got the reporting in place, then hopefully you’ll have something to appease the user and show them that there is some humanity behind it after all.
TOM TARANIUK: And as you did say, regulators might be looking at this very, very soon. And if all the reporting is there, it’s going to be super important. But we’re looking at fields or variables such as IP address rights, time, deposit amount and other sort of variables which would feed into this engine. I mean, if someone as responsible, let’s say, well, if you have responsible gambling thresholds in place you don’t want someone who’s based in the centre of London at 2 am every night, depositing £10,000 or more and then losing it all and trying to deposit more at three. Those are obviously risk factors, right? Absolutely.
KRIS GALLOWAY: There are a number of them, and it’s not always the most obvious. It’s not always somebody necessarily depositing £10,000. I mean, if they’re working in the city and they’ve just got their million pound bonus and that’s not so much money for them. But it could be somebody depositing £50 and losing it and depositing another 50 and losing it, and then thinking, ‘I’ll try and win that back by depositing 100’ and putting it all on black, for example. So there are lots of different factors that point towards this. But I think going back to what you mentioned about AI, we don’t necessarily know what all of those factors are and we could know. But then as soon as you introduce a new game, there’s going to be somebody who either suffers from a responsible gaming perspective and finds a way of feeding that addiction through that game that we haven’t figured out yet that AI is going to solve much faster than we can.
TOM TARANIUK: That’s funny, Kris, because obviously, from my perspective, I don’t know anyone in the UK who makes £1 million in bonus, but I do get where you’re coming from as well. And when we’re talking about AI, it solves many different issues. Super, super fast, right? It’s a think tank all in itself, but I would love to sort of flip the switch here onto another very topical scenario that we’ve seen on the global iGaming perspective. So we’ve seen the adoption of cryptocurrencies as a huge exponential growth spurt in the space within the last couple of years, and, of course crypto betting. What are the main advantages of cryptocurrency for iGaming?
KRIS GALLOWAY: I’d say anonymity is the biggest advantage. Not everybody wants to divulge a lot of information. Crypto is less of a hassle. And obviously from an operator perspective as well, because it’s not fully regulated across the board. Operators can innovate more as far as the games that they’re providing. So it’s not just that they can allow higher wagering, for example, but they can also provide a much larger range of features. And we’re seeing much more of these becoming more and more prevalent.
TOM TARANIUK: I mean, we talked about, let’s say, skin gambling and of course, fiat gambling earlier in different markets, different regulations. But how are the regulations evolving specifically to keep up with the adoption of cryptocurrency within, let’s say, the iGaming market? And that could be anywhere, Kris.
KRIS GALLOWAY: It’s really good, I think slower than we’d like, maybe. But we are seeing progress and it seems to be snowballing. So the Travel Rule, for example, is being introduced to ensure we know who owns the crypto wallet and where the funds are coming from. And we’re also seeing more advanced tech to analyze the blockchain, helping track transactions, helping verify transactions more effectively.
Suggested read: Crypto Hygiene: Tips and Best Practices for Clean Crypto
TOM TARANIUK: Thank you so much for joining me today, Kris. There are so many interesting takeaways, not only for myself, but for our audience. And I hope you all have, of course, enjoyed it. This isn’t the end. Kris, before you go, we’d love to keep up with the tradition of firing out some questions to you to answer quickly. Are you ready? So, Kris, number one, if you were a fraudster for a day, would you hack an online casino or a sports betting site?
KRIS GALLOWAY: An online casino?
TOM TARANIUK: Fantastic answer, Kris. Who is more annoying to catch a money launderer or a bonus abuser?
KRIS GALLOWAY: A bonus abuser?
TOM TARANIUK: That’s a good answer. If you could create a fraud prevention superpower, what would it be?
KRIS GALLOWAY: An X-ray webcam that can scan the fraudsters brain to identify their intentions.
TOM TARANIUK: Wow, that’s very interesting. I would have gone with artificial intelligence of some sort. On to question number four. What’s worse, slow WiFi—I’ll pick that one—or getting locked out of your online account?
KRIS GALLOWAY: Slow WiFi.
TOM TARANIUK: Yeah, we’re in agreement here, Kris. What’s your go to move? When you get a suspicious email, would you either delete it or report it? I do both.
KRIS GALLOWAY: Tom, I’m terrible. I delete and report, but sometimes I’ll get a little bit curious, and I’ll access it to explore it a little bit more from after. After making sure I’m safe. Don’t tell.
TOM TARANIUK: Me you go down the rabbit hole. Going to see you up in any of those fraud reports. The last one, Kris, if you could actually have any other career other than the one that you’re in, what would it be?
KRIS GALLOWAY: So I’m going to say, I’d love to own an ethically sourced and fun casino, because I think that casinos definitely fulfill a need to gamble, but I don’t think they’re always fun. I’d like to work on something like that. And other than that I’d say a jet pilot. But I think that I’m too blind, too tall, and possibly a little bit too pudgy for that.
TOM TARANIUK: I always wanted to be a pilot as well. Your answers were brilliant, Kris. Thank you so much. I mean, it’s been great to get to know you on a deeper level. And thank you for all of your insights today on “What The Fraud?”.
KRIS GALLOWAY: Thank you very much, Tom. It’s been a pleasure.
