How Can We Minimise Fraud from Stolen Cards?

The Transaction That Was Never Meant to Succeed

A fraudster acquires 200 stolen card credentials from a dark web marketplace. They write a script that creates iGaming accounts at twelve different platforms, using variation in personal details to avoid exact-match duplicate detection. They deposit small amounts — £20 to £50 — to test which cards are live. The cards that succeed are then used for larger deposits — £500 to £2,000 — before the legitimate cardholders discover the charges and file disputes.

From the operator’s perspective: new accounts, small initial deposits, rapid escalation to larger amounts, then a chargeback wave 30–60 days later. By then, the fraudster is gone. The operator carries the chargeback liability, the ratio impact, and the forensic challenge of understanding what happened. Stolen card fraud in iGaming is not opportunistic — it is systematic, industrial, and increasingly automated.

Why iGaming Is a Primary Target

iGaming platforms are disproportionately targeted for structural reasons that organised fraud operations have identified and exploit:

• Card testing opportunity: Small minimum deposits allow efficient verification of stolen card validity before committing to larger amounts

• Rapid value extraction: Funds can be withdrawn relatively quickly compared to other merchant types

• 100% card-not-present volume: Inherently higher fraud risk than card-present transactions

• MCC 7995 chargeback dynamics: Legitimate cardholders disputing gambling charges receive sympathetic issuer treatment

• High transaction velocity: The volume of gambling deposits provides camouflage for fraudulent transactions within normal-looking patterns

**£180–£2,400 **estimated value extracted per successful stolen card fraud attack before detection — making iGaming commercially attractive for organised fraud operations

The Stolen Card Fraud Kill Chain

Stage 1: Account Creation

Fraudsters create accounts using synthetic or stolen personal details. This is where KYC and registration-time fraud controls have the most impact. Detection signals: disposable or generated email addresses; VoIP numbers rather than mobile carrier numbers; names and addresses that don’t appear in authoritative verification databases; IP addresses associated with known fraud infrastructure; device fingerprints associated with previous fraud.

Stage 2: Card Testing

Small deposits to verify card validity. Detection signals: multiple cards attempted on a single account in a short window; multiple accounts attempting deposits from the same IP or device; transaction amounts consistently at the minimum deposit level; bot-speed deposit succession rather than human-paced interaction; card BINs that frequently appear in card testing patterns across the industry.

Stage 3: Value Extraction

Larger deposits, sometimes followed by minimal play and rapid withdrawal. Detection signals: rapid escalation from small to large deposit amounts within the same session or day; large deposit immediately followed by withdrawal with no or minimal gameplay; multiple accounts at similar extraction stages simultaneously; withdrawal to a different payment method than the deposit method — a layering signal.

The Multi-Layer Stolen Card Fraud Detection Architecture

Layer 1: Device Intelligence

Device fingerprinting assigns a unique identifier to each device based on its technical characteristics. A device previously associated with fraud — on your platform or shared through industry fraud intelligence networks — can be identified and flagged at first contact, before any payment is attempted. Advanced device intelligence also detects emulators (software mimicking mobile devices), rooted or jailbroken devices, VPN and proxy usage, and device attribute inconsistencies that indicate device spoofing.

Layer 2: Identity Verification Intelligence

At registration, name and address verification against authoritative data sources (electoral roll, credit bureau, mobile carrier data) provides a signal on whether the identity presented is real and consistent. Synthetic identity fraud — combining real individual elements in combinations that don’t correspond to a real person — is detectable through cross-reference across multiple authoritative sources in milliseconds.

Layer 3: Payment Intelligence

At the deposit stage, payment-level signals provide the most direct stolen card fraud indicators:

✓ CVV mismatch: Strong fraud signal — the person initiating the transaction doesn’t have accurate card details

✓ AVS mismatch: Address provided doesn’t match the card’s registered address — significant fraud indicator

✓ Card velocity: Same card used across multiple accounts in a short window — definitive multi-account signal

✓ BIN-level historical fraud rate: BINs with high fraud rates in your portfolio warrant heightened scrutiny

✓ First deposit value anomaly: Very small initial deposits from new accounts consistent with card testing

✓ Deposit attempt velocity: Bot-speed succession of attempts — humans don’t initiate five deposits in 30 seconds

Layer 4: Behavioural Analysis

Post-deposit, player behaviour distinguishes genuine players from fraudsters. Genuine players exhibit game preference patterns; fraudsters select games algorithmically to meet wagering requirements with minimum risk. Genuine sessions have organic rhythm; fraudulent sessions are uniform in timing and bet size. Immediate withdrawal requests after meeting minimum wagering requirements are consistent with cash extraction rather than gambling. Bot-driven accounts exhibit interaction timing and navigation patterns that differ measurably from human patterns.

Layer 5: Network and Pattern Analysis

Individual transaction signals reveal individual fraudulent accounts. Network analysis reveals coordinated fraud operations. Shared device fingerprints across multiple accounts are definitive multi-accounting signals. Shared IP addresses, correlated account behaviour in timing, and card cluster analysis — multiple cards from the same BIN range used across multiple accounts in a short period — are characteristic of bulk-purchased stolen card data from a single breach event.

3DS Authentication: The Fraud Prevention and Liability Shift Layer

3D Secure authentication is both a fraud prevention tool and a liability management mechanism. When a transaction is successfully authenticated through 3DS, fraud-related chargeback liability shifts from the merchant to the issuing bank. A fraudster who has stolen card data but not the cardholder’s authentication factor cannot complete a 3DS challenge — the payment fails at the authentication stage rather than generating a chargeback.

3DS catches what fraud detection misses — the stolen card that looks legitimate because the stolen data is accurate. Liability shift means that even when 3DS-authenticated stolen card fraud does occur, the financial liability is with the issuer, not the operator. Implementing 3DS on all new account first deposits is the single highest-impact fraud prevention change available.

Industry Fraud Intelligence Networks

No single operator has sufficient transaction data to build comprehensive stolen card fraud profiles independently. Industry fraud intelligence networks — where fraud signals are shared across multiple operators — provide coverage that individual operator data cannot achieve. Ethoca Consumer Clarity, Sift Network, and SEON provide device and identity intelligence across thousands of merchants. Operators who participate in these networks effectively benefit from the fraud detection learnings of every other participant — when a device fingerprint or email address is identified as fraudulent at one operator, that intelligence is available to all others in the network.

Common Stolen Card Fraud Prevention Mistakes

⚠ CVV-only verification — necessary but deeply insufficient without additional signals

⚠ No device fingerprinting — fraudsters can create new accounts indefinitely without device-level detection

⚠ No velocity monitoring across accounts — detecting individual fraudulent accounts while missing coordinated operations

⚠ 3DS not applied to new account first deposits — skipping it at the highest-risk moment

⚠ No industry fraud intelligence participation — operating with only your own historical data

⚠ Fraud detection calibrated only for false negative minimisation — not measuring the false positive cost to legitimate players

Future Trends: AI-Native Fraud Detection

The adversarial dynamic between fraudsters and fraud detection is accelerating. The next generation of stolen card fraud uses AI-assisted account creation, machine learning-based card testing patterns designed to evade velocity rules, and synthetic identity generation that passes conventional document verification. The detection response must be AI-native systems that learn from evolving attack patterns in real time. Operators who invest in continuously learning fraud detection will maintain capability as tactics evolve; those relying on static rule sets will find their detection progressively degraded.

Call to Action

Stolen card fraud in iGaming is industrial, systematic, and continuously evolving. The detection architecture that stopped it two years ago may not stop the current generation of attacks. If your fraud prevention is built on static rules and CVV matching, let’s assess what a modern multi-layer detection architecture would look like for your operation.