VerifyNowOnline Betting and
Online Casino Fraud2026 iGaming Industry Report
Industry growth, fraud exposure, AI-enabled attacks, prevention and FIC Act obligations.
Table of Contents
Twelve sections, with claim-level citations and source limitations.
Executive Summary
What changed, where fraud occurs and what operators must do
The NGB-reported online betting component increased 53.5%. It rose from R28.970 billion in FY2023/24 to R44.458 billion in FY2024/25. The NGB attributed 85.5% of betting revenue to its published online component in the latest year, compared with 80.7% in FY2023/24. Eastern Cape was added to the named provincial coverage in FY2024/25, so these figures do not isolate underlying market growth. (National Gambling Board, November 2024) (National Gambling Board, October 2025) (South African Reserve Bank, 2 April 2026)
Fraud occurs throughout the life of an account. In one global operator survey, deposits were the most frequently cited stage for fraud, followed by onboarding and withdrawals. Identity fraud, money laundering and bonus abuse were the three most commonly reported types. (Sumsub, 2025)
AI makes familiar attacks faster and harder to spot. Deepfake documents, injection attacks and human-like bots target remote onboarding and authentication. Operators must connect identity, device, payment, account and transaction evidence, then send uncertain cases to trained reviewers.
FIC Act duties continue after the account is opened. Schedule 1 Item 9 covers licensed gambling businesses. They must maintain customer due diligence, monitoring, records, reporting, governance and a risk management and compliance programme. (Financial Intelligence Centre, Accessed 26 July 2026)
Operator-retained revenue · FY2024/25
Online component · provincial coverage changed
Of total SA betting revenue · FY2024/25
Gaming and gambling · 2025 vendor network
South African Legal Position
Licensed online betting and online casino gambling are different legal categories
The NGB identifies casinos, bingo, betting and limited payout machines as legal gambling modes when the operator is licensed through a South African provincial gambling board and the player is over 18. It states that general online gambling is prohibited in South Africa. The exception is online betting, including sports and horse-racing betting, through licensed bookmakers. (National Gambling Board, Accessed 26 July 2026)
In this report, licensed online betting means bookmaker activity permitted under the South African licensing framework. Licensed casino operations means the casino category in NGB statistics. Online casino refers to fraud methods seen in international online gambling; it does not mean that general online casino gambling is lawful in South Africa.
Licensed online betting
South African bookmakers licensed for online betting, subject to provincial gambling requirements and the FIC Act where Item 9 applies.
Licensed casino operations
Land-based casino gambling included in the NGB’s audited market statistics and within the gambling accountable-institution category.
General online casino
Included only where online casino fraud methods are relevant. The NGB says online gambling is prohibited locally except for licensed online betting.
iGaming Industry Growth
South African betting and casino revenue, with the reported online share shown only where published
How revenue is measured. The NGB reports gross gambling revenue: stakes received minus winnings paid to players. It is revenue retained by operators before costs and taxes. It is not the total amount wagered, profit or fraud loss. (South African Reserve Bank, 2 April 2026)
Total betting revenue rose from R10.610 billion in FY2020/21 to R51.975 billion in FY2024/25. Casino revenue rose from R9.107 billion to R16.646 billion, but it has been flat to slightly lower since FY2022/23. For FY2024/25, the NGB attributed R44.458 billion, or 85.5% of betting revenue, to its published online component. The prior release reported an 80.7% share, but the named provincial coverage changed between releases. (National Gambling Board, 24 October 2022) (National Gambling Board, October 2025)
Betting expanded while casino revenue levelled off
Revenue in R billions · South Africa · FY2020/21 to FY2024/25 · reported online share shown separately for the latest two years
| Year | Total betting | Casinos | Published online component | Online share of betting |
|---|---|---|---|---|
| FY20/21 | R10.610bn | R9.107bn | Not published | Not published |
| FY21/22 | R15.468bn | R13.754bn | Not published | Not published |
| FY22/23 | R23.748bn | R17.342bn | Not published | Not published |
| FY23/24 | R35.909bn | R17.356bn | R28.970bn | 80.7% |
| FY24/25 | R51.975bn | R16.646bn | R44.458bn | 85.5% |
Why there is no South African online-casino growth chart
The NGB states that general online gambling is prohibited in South Africa, except for online betting through licensed bookmakers. It does not publish a licensed domestic online casino revenue series because that category is not lawful. (National Gambling Board, Accessed 26 July 2026)
The NGB has also recorded growth in bookmaker bets on the outcomes of online casino games. Those products are reported as betting, not as a licensed online-casino category. This distinction matters when comparing market figures or applying licence conditions. (National Gambling Board, 2024)
What Fraud Costs
Losses span transaction fraud, promotion abuse, investigations and regulatory cases
South Africa does not publish a complete series of online betting fraud losses. Each operator must measure its own confirmed losses, recoveries, chargebacks, bonus write-offs, review time and regulatory cases.
Transaction loss
Stolen cards, account takeover, disputed deposits, refund abuse and withdrawals to controlled accounts can create direct loss and chargeback cost.
Promotion leakage
Multi-accounting, fabricated referrals and coordinated bonus abuse waste acquisition spend and distort campaign results.
Regulatory exposure
Weak customer due diligence, monitoring, record keeping or reporting can become a licensing and FIC Act problem even where the operator recovers the transaction value.
Operating cost
False positives, manual reviews, source-of-funds enquiries, complaints and investigation time increase the cost of serving legitimate players.
Customer harm
Account takeover, identity theft and fraudulent use of payment instruments can lock customers out and expose personal or financial information.
Market integrity
Money-mule activity, match manipulation, illegal platforms and opaque payment flows weaken confidence in the licensed market.
Where Fraud Occurs
Deposit controls deserve the same attention as onboarding
In Sumsub's 2025 operator survey, 41.9% of respondents named deposits as the main stage for fraud. Onboarding accounted for 23.8%, withdrawals 22.9% and in-game activity 11.4%. The percentages describe operator responses, not the share of all confirmed fraud incidents. (Sumsub, 2025)
Stage most often cited for fraud
Percentage of surveyed operators · global iGaming survey · 2025
| Stage | Common abuse | Control question |
|---|---|---|
| Onboarding | Stolen, synthetic or repeated identity; underage account; mule recruitment | Can the operator establish a real person, a genuine document and a consistent device before activation? |
| Login | Credential stuffing, SIM compromise, session theft and social engineering | Does authentication respond to device, network and behavioural risk rather than password validity alone? |
| Deposit | Stolen cards, payment-owner mismatch, rapid card testing and third-party funding | Does the named player match the funding instrument and historical account behaviour? |
| Play | Bonus rings, collusion, robotic wagering, match manipulation and low-risk value transfer | Can monitoring connect accounts, devices, bets, timing and counterparties? |
| Withdrawal | Cash-out to a new beneficiary, minimal play, source-of-funds mismatch and account takeover | Does risk step up before payout, and can the operator explain the source and destination of funds? |
Fraud and Financial-Crime Methods
One account can combine identity, payment and money-laundering risk
Operators in the survey reported identity fraud, money laundering and bonus abuse at similar rates. An account opened with a stolen identity can receive third-party funds, claim promotions and withdraw money to an account controlled by a mule. (Sumsub, 2025)
Threats cited by iGaming operators
Percentage of surveyed operators selecting each threat · multiple responses allowed · 2025
Stolen or synthetic identity
Identity attributes, documents and biometrics are stolen, altered or assembled to create an account that passes weak onboarding checks.
Multi-accounting and bonus abuse
One person or coordinated group controls multiple nominal players to claim promotions, referrals or favourable odds.
Account takeover
A legitimate account is compromised after onboarding, allowing the attacker to change details, deposit, wager or withdraw.
Payment and withdrawal fraud
Funding comes from a stolen, third-party or mule-controlled instrument, or payout is redirected to a different beneficiary.
Money laundering through wagering
The account is used to place, layer or withdraw criminal proceeds while creating an apparent gambling explanation.
Illegal or cloned platform
An unlicensed or impersonated betting product collects deposits, identity documents or credentials outside the legal market.
AI, Bots and Synthetic Identities
Available figures measure specific vendor networks, not all fraud
LexisNexis analysed more than 116 billion online transactions in 2025 and reported an 8% rise in its global fraud rate. Gaming and gambling sites recorded a 76% rise in attack rate, malicious bot attacks rose 59%, and agentic traffic increased 450% from January to December. The agentic-traffic measure includes legitimate and unknown-intent activity; it is not a fraud rate. (LexisNexis Risk Solutions, 26 March 2026)
Separate identity-verification evidence shows why remote account opening needs more than a selfie. Entrust reports that deepfakes were linked to roughly one in five biometric fraud attempts in its network, while iProov reports a 741% annual increase in iOS-targeted injection attacks in its monitored environment. Neither figure is a count of all identity fraud worldwide. (Entrust, 2026) (iProov, 8 April 2026)
NIST's current remote-proofing standard requires controls that raise confidence that media came from a genuine sensor, analysis for manipulation or forgery, authenticated protected channels, testing against attack artefacts and manual review where needed. It explicitly warns that biometric comparison and presentation-attack detection do not cover every injection or forged-media case. (National Institute of Standards and Technology, July 2025)
FIC Act Duties
Compliance continues after an account is opened
Schedule 1 Item 9 covers a business that makes gambling available under a licence from the NGB or a provincial licensing authority. A licensed bookmaker or casino must identify the part of Item 9 that applies to it and address its products and channels in its risk management and compliance programme (RMCP). (Financial Intelligence Centre, Accessed 26 July 2026)
Revised PCC 20 treats opening an online betting account as establishing a business relationship. In a non-face-to-face process, the operator must take reasonable steps to confirm that the customer exists and verify identity. A transmitted certified copy is not, by itself, a complete answer to impersonation risk. (Financial Intelligence Centre, 14 February 2014)
| Duty | Minimum operating implication | Evidence to retain |
|---|---|---|
| Register with the FIC | Register through goAML within 90 days after the accountable business starts operating and keep registration details current. | Registration, accountable-institution item, compliance officer and change history. |
| Maintain an RMCP | Document the institution’s risk-based approach, products, channels, customer types, geographies, delivery methods and control escalation. | Approved RMCP, risk assessment, version history, board or senior-management oversight. |
| Customer due diligence | Identify and verify customers and applicable beneficial owners; understand the intended relationship and apply enhanced measures where risk is higher. | Identity evidence, verification result, screening result, risk rating, review reason and human decision. |
| Ongoing due diligence | Monitor transactions and account behaviour against what is known about the customer and refresh information when risk or circumstances change. | Alerts, linked-account analysis, source-of-funds enquiries, periodic and event-driven reviews. |
| Targeted financial sanctions | Screen relevant parties against applicable targeted-financial-sanctions information and act on a confirmed match. | List version, match rationale, escalation, freeze or reporting action where required. |
| Record keeping | Keep the records required by the FIC Act in a form that can reconstruct the relationship, transaction and decision. | Customer, transaction, communication, report and audit records with controlled access. |
| Regulatory reporting | File the required report without tipping off the customer and keep CTR, STR/SAR and TPR duties distinct. | goAML receipt, internal decision record, supporting evidence and access log. |
| Governance and training | Appoint accountable compliance ownership, train relevant staff and test whether the RMCP works in practice. | Training attendance, competency checks, control tests, issue register and remediation proof. |
Physical cash received or paid above the threshold must be reported. File as soon as possible and no later than three business days after awareness.
Report as soon as possible, no later than 15 days after awareness, excluding Saturdays, Sundays and public holidays.
A cash threshold report does not replace a suspicious transaction/activity report or terrorist property report.
Suspicious Activity Indicators
A pattern of events is more useful than one isolated signal
The FIC's sector assessment identifies non-face-to-face onboarding through internet and telephone channels as a risk because it can obscure the customer's identity. AUSTRAC lists practical account, payment and wagering patterns for online betting agencies. Its indicators can inform monitoring, but they are not South African legal tests. (Financial Intelligence Centre, 31 January 2024) (AUSTRAC, Accessed 26 July 2026)
Identity and access
Multiple or false identities; identity-payment mismatch; shared device, IP address or contact detail; repeated failed logins; rapid profile changes.
Funding
Several cards or bank accounts; cardholder mismatch; deposits inconsistent with known income or profile; cash or third-party funding without a clear explanation.
Wagering
Minimal play before withdrawal; robotic or highly repetitive betting; coordinated opposing positions; patterns inconsistent with ordinary entertainment or stated purpose.
Withdrawal
New beneficiary after a credential reset; withdrawal to an account not held by the player; repeated deposit-and-withdraw cycles; urgency after account changes.
Network behaviour
Many nominal players linked by device, address, payment instrument, network or promotion; circular referrals; synchronised account creation and wagering.
Context
Dormant account reactivation, unusual hour or geography, source-of-funds inconsistency, adverse information, sanctions match or match-fixing concern.
Controls from Account Opening to Payout
Identity, device, payment and transaction checks must work together
Establish the customer and licence context
Confirm the service is offered under the correct licence; verify age and identity; validate document authenticity; compare biometrics where appropriate; check genuine-sensor and injection signals; screen applicable sanctions and prominent-person risks.
Bind the account, device and payment owner
Link verified identity to contact details, device, session and funding instrument. Detect device emulation, shared infrastructure, cardholder mismatch and repeated identity elements.
Protect authentication and profile changes
Use phishing-resistant or risk-based authentication where feasible; step up on new devices, contact changes, password resets and beneficiary changes; apply recovery controls as strongly as login controls.
Monitor money and wagering together
Combine deposits, bets, bonuses, linked accounts, play velocity, withdrawals and customer risk. Test for rapid in-and-out movement, collusion, coordinated promotion use and profile inconsistency.
Interrupt high-risk withdrawals
Re-verify high-risk sessions; compare the payout beneficiary with the verified customer; review source of funds where required; hold for manual review under a documented policy without tipping off.
Investigate, report and learn
Give analysts the full event chain; preserve evidence; separate fraud, AML and responsible-gambling decisions; submit the correct FIC report; feed confirmed outcomes into rule and model testing.
Measuring Whether Controls Work
Track confirmed outcomes, customer friction and regulatory evidence
Exposure
- Confirmed fraud loss and recovered value by lifecycle stage
- Chargeback and disputed-deposit rate by payment method
- Bonus abuse and multi-account write-offs
- Account-takeover loss and customer-resolution time
Detection quality
- True-positive and false-positive rate by rule or model
- Time from first signal to restriction and analyst decision
- Linked-account detection before first withdrawal
- Manual-review overturn and customer-friction rate
FIC Act evidence
- CDD completion and exception ageing
- High-risk and event-driven review completion
- CTR, STR/SAR and TPR timeliness
- RMCP control testing and remediation closure
Model and supplier assurance
- Attack-artefact testing for documents and biometrics
- False acceptance and false rejection by document and channel
- Provider outage, fallback and manual-review performance
- Data retention, access, deletion and audit-log testing
The board or senior management should be able to answer four questions from one control pack: where confirmed loss occurs, which risks are increasing, whether customer friction is proportionate, and whether regulatory reports and remediation are timely. A growing alert queue is not evidence that controls are effective.
Open questions for each operator
- 1.Can the operator connect accounts controlled by one person or device before a bonus or withdrawal is paid?
- 2.Does a high-risk profile change trigger the same scrutiny as initial onboarding?
- 3.Can investigators reconstruct why an automated decision was made and which source data was used?
- 4.Are fraud, AML, sanctions, licensing and responsible-gambling teams sharing the right signals without collapsing distinct legal duties?
- 5.Has the operator tested its controls against current injection, document, bot and account-recovery attacks?
Method, Limits and Sources
What the evidence can and cannot establish
The report prioritises audited regulator statistics, legislation, official guidance and public technical standards. It uses industry studies where public data does not measure a fraud method or account stage. Each industry figure keeps the source's population and denominator and is labelled as a network result or operator survey.
The growth chart uses NGB total betting and casino revenue for five financial years. Online betting values appear only for FY2023/24 and FY2024/25. The first release covered five named provinces; the second covered six. The change between those observations is not a like-for-like measure of underlying market growth. Rounded commentary may differ slightly from the source tables. Gross gambling revenue is not turnover, household expenditure, fraud loss or operator profit.
There is no public, complete series for South African online-betting fraud losses, AI-enabled betting fraud or confirmed money-laundering cases. The report does not estimate those totals. Vendor studies are identified by publication name for research transparency, but competitor websites are not linked.
- [1]National Gambling Board: National Gambling Statistics, FY2024/25October 2025 · Audited regulator statistics · South African licensed casinos, betting, bingo and limited payout machines
- [2]National Gambling Board: National Gambling Statistics, FY2023/24November 2024 · Audited regulator statistics · South African licensed gambling, including the published online betting channel split
- [3]National Gambling Board: National Gambling Statistics, FY2021/2224 October 2022 · Audited regulator statistics · South African casino and total betting revenue for FY2020/21 and FY2021/22
- [4]National Gambling Board: Annual Performance Plan 2024/25 to 2026/272024 · Law and regulatory guidance · South African market structure and bookmaker bets linked to online casino games
- [5]South African Reserve Bank: How much South Africans actually spend on gambling2 April 2026 · Central-bank analysis · South African turnover, gross gambling revenue and household expenditure
- [6]National Gambling Board: Enforcement: Gamble LegallyAccessed 26 July 2026 · Law and regulatory guidance · South African legal gambling modes and online-betting perimeter
- [7]Financial Intelligence Centre: Gambling business: Schedule 1 Item 9Accessed 26 July 2026 · Law and regulatory guidance · Licensed gambling businesses that are accountable institutions
- [8]Financial Intelligence Centre: Compliance and supervisionAccessed 26 July 2026 · Law and regulatory guidance · Registration, customer due diligence, monitoring and regulatory reporting
- [9]Financial Intelligence Centre: Revised Guidance Note 7A1 September 2025 · Law and regulatory guidance · Risk-based implementation of FIC Act obligations and beneficial ownership
- [10]Financial Intelligence Centre: Revised assessment of the gambling sector31 January 2024 · Regulator risk indicators · South African gambling-sector money-laundering and terrorist-financing risks
- [11]Financial Intelligence Centre: Revised PCC 20: Online betting accounts14 February 2014 · Law and regulatory guidance · Non-face-to-face customer identification for online betting accounts
- [12]Financial Intelligence Centre: Regulatory reporting obligationsAccessed 26 July 2026 · Law and regulatory guidance · Cash threshold, suspicious transaction/activity and terrorist property reports
- [13]Financial Intelligence Centre: What is the reporting period?Accessed 26 July 2026 · Law and regulatory guidance · Three-business-day deadline for filing a cash threshold report after awareness
- [14]Financial Intelligence Centre: What is the period for reporting a suspicious transaction?Accessed 26 July 2026 · Law and regulatory guidance · Fifteen-day outer limit for suspicious transaction reports, excluding weekends and public holidays
- [15]Financial Intelligence Centre: When should I register with the FIC?Accessed 26 July 2026 · Law and regulatory guidance · Ninety-day registration period for a new accountable institution
- [16]LexisNexis Risk Solutions: 2026 Cybercrime Report findings26 March 2026 · Industry transaction network · More than 116 billion online transactions observed globally during 2025
- [17]Sumsub: State of Identity Verification in the iGaming Industry 20252025 · Operator survey and vendor network · Global operator survey and Sumsub iGaming verification data
- [18]AUSTRAC: Indicators of suspicious activity for online betting agenciesAccessed 26 July 2026 · Regulator risk indicators · Online betting customer, account, payment and wagering indicators
- [19]National Institute of Standards and Technology: Digital Identity Guidelines: Identity Proofing and EnrollmentJuly 2025 · Technical standard · Remote identity proofing, injection attacks and forged-media controls
- [20]Entrust: 2026 Identity Fraud Report2026 · Identity-verification network · More than one billion verifications across 195 countries, September 2024 to September 2025
- [21]iProov: 2026 Threat Intelligence Report findings8 April 2026 · Identity-verification network · Observed injection and deepfake attacks in iProov-monitored environments
Review the controls around your player journey
VerifyNow can assess identity, fraud and FIC Act controls against an operator's licence, channels, confirmed fraud and current RMCP.
Request an enterprise assessmentResearch cut-off: 26 July 2026. This report is general information, not legal, regulatory or financial advice. Verify current legislation, directives, guidance and licence conditions before acting.