How to stop multi-accounting in online gambling: sportsbooks, poker, and casinos

To stop multi-accounting in online gambling, operators link every new account to the device and network behind it at sign-up, compare that link against existing, limited, closed, and self-excluded accounts, and keep checking at login, deposit, the poker table, and withdrawal. Identity checks confirm that a person is real. Device-level linking shows when one person is behind several real-looking accounts, including accounts opened in someone else's name.

Regulators treat this as a baseline duty. The UK Gambling Commission requires remote operators to have "policies and procedures designed to identify separate accounts which are held by the same individual". Two penalties in 2025 show what that means in practice. In August the regulator fined 888 UK 33,075 GBP for failing to link customers' accounts across its group companies, and in October it fined Platinum Gaming 10 million GBP for anti-money laundering and social responsibility failings, one of which "enabled some customers whose accounts had been blocked to open new accounts and gamble." Multi-accounting in online gambling is a bonus problem, a fairness problem at the poker table, and a compliance problem at the same time.

Key takeaways

• Multi-accounting in online gambling means one person holding or controlling more than one account at the same operator. Accounts at several different bookmakers are normal; most operators allow one account per person, and some allow one across every product they run.
• Bonus abuse is only one motive. Players also open accounts to get around stake limits, self-exclusion, bans, and AML closures, to collude at poker tables, and to rent or sell accounts.
• The hardest cases pass identity checks, because the second account belongs to a real person: a relative, a friend, or someone paid for their details. What links them is the device and network doing the betting.
• The strongest signals are one device behind several accounts, a device that matches a closed or self-excluded account, one account used from many devices, and location jumps no trip explains.
• Check at sign-up, login, deposit, the table, and withdrawal, across every brand in the group, and treat shared households with a step-up rather than a closure.

What is multi-accounting in online gambling?

Multi-accounting in online gambling is one person holding or controlling more than one account at the same operator. The rule it breaks is written into nearly every set of terms. DraftKings puts it plainly: "You may establish only one account per person," and it reserves the right to suspend or terminate every account and withhold winnings when it finds a second one. FanDuel goes further: each player "is allowed one account to be used across all FanDuel products (including Fantasy, Sportsbook, Casino, Racing, and Faceoff)."

Holding multiple betting accounts at different bookmakers is a separate thing. Comparing prices across books is normal, and nothing stops a player from doing it. The problem starts with a second account at the same operator or group, whether it sits in the player's own name or in someone else's.

The vocabulary shifts between sportsbooks, casinos, and poker rooms, but it describes the same behavior:

• Gnoming: running betting accounts opened in the names of friends or family, a term from matched betting.
• Gubbed: UK slang for an account the bookmaker has limited or restricted, usually after consistent winning or heavy use of offers.
• Beard: a second person who places bets for a limited bettor, or whose account the limited bettor uses.
• Chip dumping: losing chips to another account on purpose, a form of poker collusion.

Why players open multiple betting accounts

Most writing on the subject stops at welcome bonuses. On a sportsbook, casino, or poker site, the motives are wider, and each one hits a different part of the business.

Bonus abuse is the best-known motive: the same person claims a welcome offer, a free bet, or a refer-a-friend reward through account after account. It is covered in depth in how to prevent bonus abuse in iGaming. It is also increasingly automated: account-creation scripts are one of the betting bots operators see most often.

Limit evasion follows from how sportsbooks manage risk. In Massachusetts, the state Gaming Commission's review of operator data found that "players who consistently beat the closing line are likely to have a lower stake factor, meaning have their limit lowered", and that just over 0.5 percent of bettors were limited. A gubbed bettor has two ways back to full stakes: a new account in their own name, which identity checks usually catch, or an account in someone else's name, which they usually do not.

Self-exclusion evasion is the case with the most at stake for the player. UK rules require operators to "take all reasonable steps to refuse service or to otherwise prevent an individual who has entered a self-exclusion agreement from participating in gambling" (LCCP 3.5.3). A self-excluded player who signs up again with a new email, or with a partner's details, is exactly the person those steps exist to stop.

Ban and closure evasion covers players closed for fraud, abuse, or anti-money laundering reasons. The Platinum Gaming finding is this case: customers blocked earlier were able to open new accounts. Ban evasion detection deals with the general form of the problem.

Account renting and selling has become a business of its own. In January 2025, The Guardian reported on a UK company that paid people 100 GBP to upload their ID documents so it could open bookmaker accounts in their names, and found accounts offered for sale on Instagram, Reddit, and Telegram. As the paper put it, buying a "clean" account "can be used as a method of bypassing restrictions imposed by gambling companies."

Multi-accounting in poker: collusion and chip dumping

Poker is where multi-accounting does the most direct damage to other players, because the extra accounts sit at the same tables as everyone else.

Two accounts controlled by one person at the same cash table see twice the hole cards and can squeeze the players between them. In tournaments, extra accounts mean extra entries, extra chances at the prize pool, and friendly opponents to play soft against. Poker collusion between two different people works the same way; multi-accounting simply removes the need for a partner.

PokerStrategy defines chip dumping as "losing to another player on purpose," typically by making a huge raise and then folding to a small reraise so the other player takes the pot uncontested. Between accounts held by one person, it concentrates chips on the account with the best chance of a deep run. Between two different people, it moves money, which is why operators also treat it as an anti-money laundering signal.

At the table, the linked accounts are the tell. Two accounts on the same device or network should never sit at the same table or in the same tournament. Chip flows that keep going one way between the same pair, folds that make no sense against the pot odds, and tournament entries registered seconds apart from one device are all worth a review.

Why identity checks alone miss the hardest cases

KYC answers one question well: is this a real person, and are they who they say they are? It struggles with a different one: is this the same person who is behind another account?

• An account opened in a relative's name passes KYC, because the relative is real.
• A bought or rented account passes, because its original owner was verified.
• A self-excluded player using a partner's details passes the self-exclusion check, which looks for their name, not their device.

What those accounts share is the hardware and network doing the betting: the same laptop, the same phone, the same home connection, or the same proxy used to hide it. That is why linking at the device level, not only at the document level, closes the gap.

When we tested the resets a returning player usually tries on a sign-up page, the pattern held. A new email, a private window, and a switched IP each changed what the account looked like on paper, while the device underneath resolved to the same ID every time. The reset that does change the device picture, a different browser on the same machine, is the reason network, payment, and household checks stay in the mix rather than resting on one identifier. Device fingerprinting and persistent visitor identification keep that link in place after cookies are cleared or a private window is opened.

The signals that link multiple accounts to one person

No single signal proves that two accounts belong to one person. Several together usually do.

Households are the main source of false positives. Couples and flatmates share Wi-Fi and sometimes a laptop, and both may be legitimate customers. Some operators allow one account per household; others allow several. Either way, a shared network alone should prompt a closer look, not a closure. The combination is what matters: a shared device plus a self-excluded account, or a shared device plus the same card, is a strong case.

How to stop multi-accounting: a playbook for operators

Multi-accounting is cheapest to stop before the second account places a bet. Each checkpoint below catches a different motive.

1. At sign-up, identify the device before the account is live. Compare the device and network against every existing account, including limited, closed, banned, and self-excluded ones, and across every brand in the group. The 888 penalty was about exactly that group-level link.
2. At login, watch for sharing and takeover. One account used from many devices points to account sharing or a beard. A login from a new device in a new country hours after the last one is impossible travel, which can mean a shared account or a taken-over one. On US sportsbooks, where bets are only accepted inside licensed states, a masked location is also a compliance issue: DraftKings' terms make it "a violation of these Terms of Use to disguise or attempt to disguise your physical location." Geolocation spoofing detection belongs here.
3. At deposit and bonus claim, check eligibility against the link. A payment card or e-wallet already used by another account, or a device that already claimed the offer, should make the bonus wait.
4. At the table and the bet slip, look for coordination. Keep linked accounts out of the same poker tables and tournaments, and review chip flows and bets that mirror each other across linked accounts.
5. At withdrawal, hold what is linked. Money leaving a linked account is the last cheap moment to review. Once it has left, recovery is slow or impossible.

The response should be graduated. A first, weak link asks for verification. A strong, multi-signal link justifies suspending the new account and voiding bonus winnings under the terms. For self-excluded players, UK rules go further: the operator must close the account and return the balance.

The same pattern in online games

Online games see the same behavior with different payoffs. Players open new accounts to claim starter rewards and funnel them to a main account, to come back after a ban for cheating or harassment, and to smurf: a highly ranked player on a fresh account, matched against beginners. The detection logic carries over unchanged, because the device and network behind a smurf or a ban-evading account are the same ones behind the main account. What changes is the response: games usually restrict matchmaking, rewards, or trading rather than freezing a balance.

Is it illegal to have multiple betting accounts?

In most markets, a second account at the same operator breaks the terms rather than the law. The consequences are contractual: DraftKings reserves the right to suspend or terminate any or all accounts and to withhold winnings, and FanDuel's terms say the same.

Two situations change that. Using another person's identity without their consent is identity fraud. And even with consent, letting someone else use your account is prohibited; DraftKings calls it a violation "to allow any other person to use your account." Where accounts move money between people, anti-money laundering rules apply too. The details vary by jurisdiction, so any specific case is a question for a lawyer in that market.

For operators, the regulatory side runs the other way. In Great Britain, failing to link a customer's accounts is itself a licence breach, as the 888 penalty shows.

How ShieldLabs stops multi-accounting in online gambling

ShieldLabs runs on sign-up, login, deposit, and withdrawal pages through one JavaScript snippet, with client and server SDKs, an API, and webhooks on every plan. It gives sportsbooks, casinos, and poker rooms enterprise-level functionality without enterprise pricing, and it works alongside the KYC and payment checks already in place.

At the core is persistent identification with 99.9% identification accuracy. The Device ID behind each visit survives cleared cookies, incognito windows, new browser profiles, and IP rotation, so a second account opened from the same device links back to the first even when the name, email, and documents are different. Store the Device ID with each closed, limited, or self-excluded account, and every new sign-up from that device can be matched against it. That is the link that exposes gnomed accounts, bought accounts, and self-excluded players returning under someone else's details.

ShieldLabs detects all four High-Risk Events directly, and each one maps to a gambling case: multi-accounting for account farms and returning players, account sharing for beards and rented accounts, impossible travel for logins from places no trip could connect, and account takeover for accounts that change hands without the owner's consent. Each event comes with Medium or High confidence.

Every visit also returns a risk score from 0 to 100 with the named risk signals behind it, drawn from 300+ device and network signals with 99.9% risk signal detection accuracy: VPNs, proxies, Tor, datacenter connections, anti-detect browsers, browser automation, and location spoofing. ShieldLabs stops multi-accounting and helps block fraudulent and abusive traffic, and you choose the action for each case: step up a sign-up, hold a bonus, keep linked accounts off the same table, or close a self-excluded player's new account. The same detection covers iGaming and gaming platforms. The free tier covers 5,000 identifications, one time, and paid plans start from 79 USD a month, with chat and email support on every plan.

Sources

1. UK Gambling Commission: LCCP 3.9.1 Identification of individual customers, remote
2. UK Gambling Commission: Sanction for 888 UK Limited (August 2025)
3. UK Gambling Commission: £10m fine for online operator Platinum Gaming Limited (October 2025)
4. UK Gambling Commission: LCCP 3.5.3 Self-exclusion, remote SR code
5. DraftKings: Terms of Use
6. FanDuel: Faceoff rules: Multiple Accounts
7. iGaming Business: New York bill would ban sportsbooks from limiting winning bettors (October 2025)
8. The Guardian: UK consumers warned over offers of money to open betting accounts in their names (January 2025)
9. PokerStrategy: Poker Basics: Chip Dumping