Bonus abuse prevention for iGaming
Make every bonus
bring in a real player.
SybilZero is a bonus abuse prevention API for iGaming operators. It shows you when the same person is behind several accounts, before the payout, so your budget goes to players who stay.
Send a sample of signup emails. Get a one-page report. No code, no call.
- Decision Time
- <80ms
- Free Trial
- 14 days
- Required to Start
- No CC
- Checks Combined
- 5
Built for operators licensed by the UKGC, MGA, AGCO, Gibraltar, Isle of Man and others.
From paying twice to
promoting with confidence.
Same offers. Same players. A very different payout.
The same person claims your welcome bonus again and again.
One bonus per player, enforced at signup and at claim.
You find out after the money is gone.
You decide before the payout leaves.
Your team digs through accounts to guess who's linked.
Every verdict arrives with the reasons, so the work is half done.
Big promos feel risky, so you keep them small.
Run the offer you want, and know who's behind each claim.
Strict rules block real players too.
REVIEW sits between ALLOW and BLOCK: borderline players get a human, not a wall.
The clean one
Real documents, a real address, an email with years of history. Nothing looks wrong. It's their fifth account.
The variation
Name, birth date and address shuffled a little each time. Every version passes. None of them match each other.
The one-source
Passes on a single data source. The phone number has only ever appeared on their other applications.
Your bonus budget is
paying for players
who aren't new.
You built the welcome offer to win customers. Then someone opens a second account, a third, a fifth. Each one passes KYC. Each one claims the bonus. By the time anyone notices, the money is gone, and the "new player" was never new.
Bonus abuse is when one person, or a coordinated group, claims welcome offers repeatedly through several accounts, cashes out, and leaves. Security researchers call this a Sybil attack: one actor behind many identities. KYC tells you who someone says they are. SybilZero tells you how many accounts they control.
In a 2026 survey of 993 gaming decision-makers, 78% named bonus abuse a top fraud threat, and about 60% of fraud sat at account creation and withdrawal.
What changes when you know
who's behind every claim.
Your budget reaches real new players
Duplicate accounts and repeat claims are flagged before the payout, so the offer you designed reaches the people you designed it for.
Promote with confidence
Launch the big offer without wondering who will exploit it. If a ring shows up on launch day, you see the linked accounts, not just a spike in spend.
Real players keep moving
Not every flag is a block. REVIEW gives borderline cases a human look, and clean players pass without friction.
Decisions, not detective work
Every verdict lists its reasons: linked accounts, VPN, hosting IP, repeated device, duplicate claim. Your analysts start from the answer.
Show where the money went
Every check and verdict is recorded, so you can show finance what you stopped and why.
Add one check.
Change what happens at payout.
SybilZero runs at the moment it matters: when someone signs up or claims a bonus, before any money is committed.
- Step 01
Add the agent
One JavaScript snippet on your signup and claim pages, and one API call from your backend. No KYC integration needed for a first signal.
1 + 1 snippet, plus an API call - Step 02
We score the attempt
Device, email, network and velocity signals become a 0 to 100 risk score in under 80ms.
0–100 risk score on every check - Step 03
You decide
ALLOW, REVIEW or BLOCK, with the reasons attached. You choose what each one triggers.
3 verdicts: allow, review, block
How we tell it's
the same person.
Five checks, combined into one verdict. Every response lists which ones fired.
Device linking
Resets, new browsers and incognito don't make a player new. Accounts that share a device or network are linked.
Known disposable domains are blocked instantly. Gmail dots and plus-aliases are normalized, so one inbox can't pose as many.
Network
Tor, VPNs, open proxies and cloud-hosting IPs add to the risk score.
Velocity
The same device or TLS fingerprint showing up again and again in one day.
Duplicate claims
Send a bonus_id and we flag the same person claiming the same promo twice.
Find out what you're leaking,
before you commit to anything.
Send us a sample of signup emails or domains. We check them against our disposable-email list and IP risk signals, and send back a one-page report: what looks risky, and why. No code, no call, no commitment.
Request my free audit →We'll publish measured results from pilots here as soon as we have them.
What would one bonus
per player be worth?
Move the sliders to your own numbers. These are your assumptions, not a prediction.
This is your estimate, not a prediction. Real results depend on your traffic and promos.
Priced to be small next to
what you protect.
No per-seat fees. Pay for the checks you process, nothing more.
All plans include a 14-day free trial. No credit card required. No lock-in contract. Need a custom volume tier? Talk to us.
Straight answers.
What is bonus abuse in iGaming?
Bonus abuse is when one person, or a coordinated group, claims welcome offers and promotions repeatedly, usually through several accounts, cashes out, and leaves. The operator pays the bonus and keeps no lasting customer.
What is a Sybil attack?
A Sybil attack is when one actor creates many fake identities to gain more rewards or influence than one person should have. In iGaming it shows up as multi-accounting: one person opening several accounts to claim welcome bonuses again and again.
What is SybilZero?
SybilZero is a bonus abuse prevention API for iGaming operators. It scores each signup and bonus claim from 0 to 100 and returns ALLOW, REVIEW or BLOCK with the reasons, so you can stop multi-accounting and duplicate bonus claims before the payout.
We already have KYC. Do we still need SybilZero?
Yes. KYC confirms who someone is. SybilZero shows how many accounts they control, by linking accounts that share a device or network and flagging repeated claims. It sits next to your KYC vendor and does not replace it.
How does SybilZero detect multi-accounting?
It combines five checks: device linking across accounts, email checks (known disposable domains are blocked and Gmail dots and plus-aliases are normalized), network signals such as Tor, VPNs, open proxies and cloud-hosting IPs, velocity of the same device or TLS fingerprint within a day, and duplicate claims per bonus ID.
Will SybilZero block real players?
REVIEW and BLOCK are separate verdicts, and every verdict lists its reasons. You decide what happens at each level, including sending borderline cases to a human instead of blocking them.
How long does integration take?
One JavaScript snippet on your signup and claim pages and one API call from your backend. Most teams can try it in a day. No KYC integration is needed for a first signal.
What does SybilZero not do?
SybilZero does not verify identities, it is not a bot-detection tool, and it does not have a mobile SDK yet. It focuses on linking accounts and flagging duplicate bonus claims.
How much does SybilZero cost?
Starter is $299 per month with 10,000 checks included. Pro is $999 per month with 50,000 checks, priority support and a Slack SLA. Custom volume plans are available, and every plan starts with a 14-day free trial, no credit card required.
Give your bonuses back
to real players.
Find out how many of your signups are the same people.