Full Report
Sumsub research finds European iGaming market is losing billions to fraud each year
Analysis Summary
# Incident Report: Widespread Revenue Loss Due to Digital Fraud in European iGaming Sector
## Executive Summary
Research indicates that nearly half (47%) of European online gambling (iGaming) operators lost over 10% of their annual revenue to fraud in the previous year. The primary attack vectors involved sophisticated digital fraud techniques, notably identity fraud, money laundering, and pervasive bonus abuse, increasingly facilitated by AI tools like deepfakes. The overall impact translates to potential losses exceeding €5 billion annually across the regulated European market. Response focuses primarily on enhancing identity verification and leveraging AI detection capabilities post-onboarding.
## Incident Details
- Discovery Date: Research published March 4, 2025 (referencing data from the previous year, 2024)
- Incident Date: Ongoing throughout 2024
- Affected Organization: European online gambling (iGaming) sector firms
- Sector: Online Gambling / iGaming
- Geography: Europe
## Timeline of Events
### Initial Access
- Date/Time: Ongoing, fraud observed frequently post-customer onboarding.
- Vector: Identity fraud, money laundering techniques, and bonus abuse schemes.
- Details: Fraudsters exploit weaknesses during or immediately following customer registration.
### Lateral Movement
- Not explicitly detailed; the primary impact seems focused on registration/transaction level fraud rather than network compromise.
### Data Exfiltration/Impact
- Impact: Significant financial loss (10% to over 20% of revenue for many firms).
- Details: Losses stem primarily from fraudulent payouts, money laundering activity, and the exploitation of promotional offers (bonus abuse).
### Detection & Response
- Detection: Firms are detecting evolving fraud types, noting an 83% increase in digital fraud in 2024. Detection focuses heavily on post-onboarding activities.
- Response actions taken: Firms are increasing focus on identity verification processes, especially in challenging AI-generated fraud.
## Attack Methodology
- Initial Access: Identity fraud used to create fraudulent accounts.
- Persistence: Not explicitly detailed (focus is transactional/onboarding fraud).
- Privilege Escalation: Not applicable to this type of financial/registration fraud.
- Defense Evasion: Use of AI/Deepfake technology to create realistic but false identification documents, evading standard checks.
- Credential Access: Not the primary focus; focused on compromising the account creation/KYC process.
- Discovery: Fraudulent activity is often discovered after customer onboarding has completed.
- Lateral Movement: Not the primary focus.
- Collection: Focused on exploiting promotional structures (bonus abuse bots).
- Exfiltration: Financial assets/revenue lost through payouts, laundered funds, or exploited bonuses.
- Impact: Direct revenue loss, increased compliance costs.
## Impact Assessment
- Financial: 47% of firms lost over 10% of revenue; 15% lost over 20%. Estimated annual loss to the sector exceeds €5 billion ($5.2 billion).
- Data Breach: Primarily related to synthetic/fraudulent identity data used for account creation, not necessarily large-scale customer PII exfiltration (though money laundering implies financial transaction manipulation).
- Operational: Increased operational overhead managing compliance and fraud investigation processes.
- Reputational: Not specified, but significant financial drain affects market stability.
## Indicators of Compromise
- Network indicators: Not provided.
- File indicators: Not provided.
- Behavioral indicators: Use of AI-powered bots for repetitive actions (bonus abuse); submission of AI-generated/deepfake identification documents.
## Response Actions
- Containment measures: Firms are reportedly increasing identity verification measures.
- Eradication steps: Focus on banning accounts associated with identified fraud patterns (identity fraud, money laundering, bonus abuse).
- Recovery actions: Reversing financial impact where possible, strengthening KYC/AML checks.
## Lessons Learned
- Key takeaways: Digital fraud tactics are escalating rapidly in the iGaming sector, heavily leveraging AI technology. Most significant fraud occurs *after* initial customer onboarding.
- What could have been done better: Greater investment in advanced, AI-aware identity verification tools prior to onboarding and during account activity monitoring.
## Recommendations
- Prevention measures for similar incidents: Implement real-time verification checks capable of identifying deepfake and AI-generated identity submissions. Enhance monitoring for sophisticated bonus abuse patterns driven by automated bots. Strengthen AML protocols to counter money laundering attempts originating from newly created accounts.