Spotting rigged RNGs: how machine learning flags anomalies
Rigged RNG claims are rare but real. Learn how statistical testing and machine learning actually detect anomalies in casino random number generators.
Security, Fraud Detection & Fair Play
Data on RNG testing, identity fraud, regulator fines, and match-fixing alerts shows how GamblScout scores security and fair play.
Fair play in online gambling rests on three pillars: certified randomness in the games themselves, identity and transaction controls that keep fraud out, and regulators willing to enforce the rules when operators fail. In 2025, 82.9% of iGaming operators reported an increase in fraud attempts, while the UK's Gambling Commission alone issued fines running into the tens of millions of pounds. This hub explains how each pillar works and links to every GamblScout.com article that unpacks the methodology behind our own fairness and integrity scoring.
Key takeaways
- Independent labs such as eCOGRA, GLI, iTech Labs and BMM Testlabs certify the random number generators (RNGs) and return-to-player (RTP) math behind casino games before and after launch.
- Identity fraud in verification checks moderated to 2.2% in 2025, still above the 2.0% baseline seen in 2023, even as attacks grew more sophisticated.
- UK regulators fined operators including Platinum Gaming, Spreadex and ProgressPlay millions of pounds in 2025 alone for anti-money-laundering and player-protection failings.
- Sports betting integrity monitors logged 300 suspicious betting alerts in 2025, the highest annual total on record.
- GamblScout.com's algorithm treats security and fair play as scraped, verifiable data points rather than editorial opinion — see our core principles for why that distinction matters.
Table of contents
What "fair play" means in online gambling
"Fair play" is a compliance term as much as an ethical one. It covers three overlapping obligations an operator must meet to hold a gambling license: games must produce statistically random, independently verified outcomes; player funds and personal data must be protected against fraud and money laundering; and sports betting markets must be monitored for manipulation. Each obligation generates its own paper trail — certification reports, regulatory filings, integrity alerts — which is exactly the kind of structured, publicly available data our algorithm is built to parse rather than rely on an operator's own marketing copy.
Unregulated or offshore platforms sit outside this framework entirely, which is one reason the category exists: a casino operating without a recognized license has no obligation to submit to RNG testing, KYC audits or integrity monitoring, and no regulator to fine it if it doesn't.
RNG and RTP testing: the technical backbone of fairness
Random number generator testing and RTP verification are performed by independent labs, not by regulators themselves. Testing labs assess an RNG's resistance to attacks that could predict or influence its output, and conduct periodic re-audits to confirm the algorithm hasn't been altered after launch. The distinction between the two headline metrics matters: RNG determines the randomness of each individual outcome, while RTP describes the average share of stakes returned to players over millions of rounds. A game can have a certified RNG and still carry a low RTP — the two figures answer different questions.
The market for this testing is concentrated among a handful of accredited labs — eCOGRA, Gaming Laboratories International (GLI), iTech Labs, BMM Testlabs and a few regional bodies such as SIQ — and eCOGRA was the first online-gambling-specific lab to hold ISO/IEC 17021-1:2015 accreditation, the standard that underpins accredited information-security certifications. In practice this means a "certified" seal on a casino footer should be traceable back to a specific lab report, not treated as a static logo.
Regulatory enforcement: how watchdogs punish unfair operators
Enforcement data is one of the clearest signals of how seriously an operator treats compliance. The UK Gambling Commission published a run of penalties through 2025 for anti-money-laundering and social-responsibility failings, several of them against well-known consumer brands.
| Operator | Penalty | Date announced |
|---|---|---|
| Platinum Gaming Limited | £10m | 22 Oct 2025 |
| Spreadex Limited | £2.02m | 7 May 2025 |
| Done Brothers (Betfred) | £825,000 | 3 Dec 2025 |
| Videoslots Limited | £650,000 | 20 Nov 2025 |
| NetBet Enterprises Limited | £650,000 | 5 Nov 2025 |
| ProgressPlay Limited | £1m | 21 Aug 2025 |
Source: Gambling Commission enforcement action log; CMS Law summary of 2025 actions.
The framework behind these numbers changed mid-year. From 10 October 2025, the Commission ties fines to a percentage of gross gambling yield during the breach period, with the most severe violations facing penalties of up to 15% of GGY or higher in exceptional cases. That shift makes penalty size a function of both the severity of the breach and how long it went undetected — which is why our algorithm treats enforcement recency and repeat-offense status as distinct signals rather than a single "has this operator ever been fined" flag.
Identity fraud and account security risks
Player-facing security is dominated by identity verification (KYC) and account-takeover risk. Industry-wide identity fraud rates, measured across verification checks, rose from 2.0% in 2023 to a peak of 2.6% in 2024 before moderating to 2.2% in 2025, even as the sophistication of attacks increased by 180% year over year. For iGaming specifically, most fraudulent activity clusters between 4 a.m. and 8 a.m., a window when legitimate registrations are lowest and compliance teams are typically offline.
Deepfake and synthetic-identity attacks are the fastest-growing category. Deepfake fraud increased 700% globally between Q1 2024 and Q1 2025, with Brazil seeing rates five times higher than the US and ten times higher than Germany, a spike that coincided with Brazil's regulatory transition to a licensed market. This pattern — fraud intensifying exactly when new KYC requirements roll out — is a recurring theme in how our algorithm weighs an operator's onboarding friction against its stated compliance posture, which we explore in more technical detail in our piece on natural language processing and sentiment analysis as applied to operator support and complaint data.
Sports betting integrity and match-fixing monitoring
For sportsbooks, fair play extends beyond the operator's own platform to the events being wagered on. The International Betting Integrity Association (IBIA), which monitors transactional betting data across its member operators, logged 300 suspicious betting alerts in 2025 — the highest annual total to date and a sharp rise from 232 alerts in 2024. Football and tennis remain the highest-risk sports, and 54 matches were confirmed as corrupted using IBIA data in 2025, with sanctions imposed on 24 players, teams and officials across five sports.
These figures are a useful counterweight to marketing claims about "safe, monitored markets": a rising alert count reflects both more manipulation attempts and better detection coverage, and the two are hard to disentangle from public data alone. We treat integrity-monitoring membership (IBIA, Sportradar Integrity Services, or equivalent) as a binary signal in an operator's profile rather than a proxy for how clean its markets actually are.
Articles in this category
Two articles currently anchor this category, both focused on how GamblScout.com's own scoring process avoids the conflicts of interest that affect paid human reviews:
- Our Core Principles & The Problem with "Human" Reviews explains why algorithmic scraping and scoring removes the commercial incentives that shape traditional affiliate reviews, and what data sources replace them.
- Natural Language Processing (NLP) & Sentiment Analysis details how we process player complaints, forum threads and support transcripts at scale to detect patterns — such as clusters of withheld-withdrawal complaints — that a manual review process would miss.
Future articles in this category will cover individual RNG certification bodies, regional KYC requirements, and case studies of specific enforcement actions in more depth.
Frequently asked questions
Does a licensed casino automatically have a certified RNG?
In most regulated markets, yes — licensing conditions typically require operators to use RNGs tested by an accredited lab such as eCOGRA or GLI. However, certification applies per game and per build, so a license alone doesn't confirm every title on a site is current with its testing cycle; checking for a clickable, verifiable certificate number is a more reliable check than a static badge.
What does a 2.2% identity fraud rate actually mean?
It reflects the share of identity verification attempts across Sumsub's monitored platforms that were flagged as fraudulent in 2025, down from a 2024 peak but still above the 2023 baseline. It is not a casino-specific figure — individual operators' actual fraud exposure varies significantly based on their KYC stack, geography and player base.
Do rising suspicious betting alerts mean sports betting is getting less safe?
Not necessarily. The increase to 300 alerts in 2025 partly reflects IBIA's expanded monitoring coverage and membership growth, not only a rise in actual manipulation attempts. Alert volume should be read alongside confirmed corruption cases and sanctions, which are a smaller and more conservative subset of the total.
How does GamblScout.com check an operator's fair play credentials?
Our algorithm cross-references publicly listed RNG/RTP certification records, regulator enforcement databases, and structured complaint data rather than accepting an operator's self-reported badges. The process is described in full in our core principles article.
Methodology
For this category, GamblScout.com's algorithm ingests regulator enforcement logs (UK Gambling Commission, MGA and equivalent bodies), published RNG/RTP certification records from accredited testing labs, and aggregated third-party fraud and integrity research from firms such as Sumsub and IBIA. These signals are combined with our own NLP-based analysis of player complaint volume and language patterns, detailed in our sentiment analysis methodology, to score an operator's security and fair play posture without relying on self-submitted claims.
Gambling involves risk. Only play with money you can afford to lose and use the deposit limits and self-exclusion tools available in your jurisdiction.
