The Pennsylvania Gaming Control Board placed 11 individuals on the Involuntary Interactive Exclusion List for iGaming Fraud during last week’s monthly meeting. While that might be considered a lengthy list, PGCB Director of Communications, Doug Harbach, told PlayPennsylvania on Tuesday that fraud cases have decreased in the state.
As evidence of the 11 placed on the involuntary exclusion list for varying degrees of PA online casino fraud, the PGCB has taken notice and is starting to crackdown on the matter.
Fraud cases are decreasing, according to PGCB
Technology has been ever-evolving and the gambling industry is able to take advantage. It’s tough, nowadays, to get away with fraudulent activity, especially online.
Pennsylvania online operators have installed techniques to protect players, as well as detect any fraud taking place.
“Fraudulent activity has actually decreased since the enhanced Know Your Client process and Multi-Factor Authentication requirement has been implemented,” Harbach told PlayPennsylvania via email.
KYC is a set of guidelines that allows companies to verify the identity, suitability, and risks of a current or potential customer. It also identifies suspicious behavior before it can materialize. In addition, the PGCB required operators to implement MFA in December 2022.
There are multiple obligations operators must meet when it comes to MFA, as those include:
- Each unique device is required to have MFA performed every 14 days. This additional security measure ensures the player who is accessing the account is the player who owns the account by authenticating the account and device used to access the account.
- The PGCB requires annual security assessments performed by independent third party cyber security companies which identifies any potential vulnerabilities and weaknesses the operator’s platform may have. Operators are required to report the results of the security assessment along with a detailed remediation plan that must address any considerable risks identified as part of the security assessment.
- PGCB regulations require player personal information to be encrypted in the operator’s database and operators must attest that this regulation is being strictly enforced as part of the annual security assessment. The PGCB requires all PA operators to perform quarterly vulnerability and penetration tests that check against existing and new IT security risks.
Operators and PGCB stay ‘proactive’ on suspicious activity
Harbach told PlayPennsylvania that the PGCB and online platforms have stayed on top of suspicious activity. Operators have taken “proactive action to identify suspected fraud at the onset” and have shut down those accounts until an investigation has been completed.
“This investigation by the PGCB is what can lead to the recommendation for exclusion,” Harbach said.
There are possible enhancements coming to operators that would further restrict suspicious activity. The PGCB is also taking proactive measures, according to Harbach:
“The PGCB is currently evaluating new best industry practices and new technologies that will aid us further in fraud prevention. This included new KYC protocols and more secure methods of MFA.”
PGCB cracking down on fraud
The 11 reports of iGaming fraud is nothing to get overly concerned about. However, the PGCB has made an effort to act on cases such as these.
“We see a decent amount of fraud reports, but the majority are related to chargebacks and not necessarily more nefarious fraud,” Harbach said. “At the same time, fraud is fraud and the PGCB has begun placing individuals who engage in any such behavior on the involuntary exclusion list to prevent the bad actor from repeating that activity on other operators’ websites.
Specific instances of fraud
The PGCB published details of each fraud case in a press release. Each incident either schemed to obtain an iGaming account in another person’s name or placing funds and removing them into a personal bank account. Here are the following cases:
- Illegally requesting and receiving chargebacks to a credit card totaling $5,150
- Creating two separate online accounts using the personal identification of other individuals
- Creating five separate online accounts using the personal identification of other individuals and withdrawing $6,195 into their own personal bank account
- Accessing two separate online accounts using the personal identification of two other individuals and withdrawing $1,000 into their own personal bank account
- Accessing one online account using the personal identification and credit card of another individual and unsuccessfully attempting to withdraw $1,300
- Accessing one online account using the personal identification and credit card of another individual and withdrawing $900 into their own personal bank account
- Accessing one online account using the personal identification and credit card of another individual and withdrawing $200 into their own personal bank account
- Creating six separate online accounts using the personal identification and credit cards of other individuals and withdrawing $450 into their own personal bank account
- Creating 14 separate online accounts using the personal identification and credit cards of other individuals and withdrawing $8,595 into their own personal bank account
- Creating three separate online accounts using the personal identification and credit cards of other individuals and withdrawing $600 into their own personal bank account
- Illegally requesting and receiving chargebacks to a credit card totaling $684 and creating other online accounts using the personal identification of other individuals
No matter the amount of the fraud, the PGCB is committed to taking action.
