Two directions, two different problems
Payment fraud in gambling runs in both directions, and the controls are unrelated.
Money coming in is the classic problem: an instrument used without authority, funding an account. The loss arrives later as a chargeback: the disputed amount is taken back from the operator, and payment processors typically charge a dispute fee on top.
Money going out is the gambling-specific problem: a legitimate deposit followed by an attempt to extract the value to somewhere it does not belong. No instrument was stolen, so nothing looks wrong at the payment layer, and the control has to sit in the payout process.
Most operators build good controls on the first and weak ones on the second, because the first generates an invoice and the second does not.
Stolen instrument use
A card or bank account belonging to someone else, used to fund an account.
The objective is extraction, not play. The fraudster wants the deposit converted into a withdrawal to an instrument they control, and any gambling in between is cover.
Signals. Rapid deposit followed by a withdrawal request with minimal turnover. An instrument whose name does not match the account holder. Multiple instruments added in a short period, particularly after declines. Deposit amounts near the instrument's available limit. Billing address inconsistent with the account address. Device or connection characteristics shared with other accounts using different instruments.
The single strongest control is paying out to the instrument that funded the account, where the payment rails permit it. It removes the extraction route entirely for this typology. It is not always possible, customers legitimately want payouts elsewhere, and the exceptions need a verification step rather than a policy of convenience.
The second strongest is 3D Secure or its equivalent, which shifts liability for authenticated transactions under most card scheme rules: under Visa's rules, for example, a card-absent fraud dispute is invalid where the issuer authenticated the transaction through Visa Secure with EMV 3-D Secure. This is worth understanding precisely: authentication does not prevent fraud, it moves who pays for it, and an operator that has not implemented it is absorbing losses the scheme rules would otherwise place elsewhere. The shift is not universal for gambling. For US domestic transactions, Visa excludes the betting and online gambling merchant categories (MCCs 7995, 7801 and 7802) from that protection, so a fraud dispute stands whatever the authentication result.
Chargebacks and the friendly fraud problem
A chargeback is a card scheme dispute reversing a transaction. In gambling a common and costly form is friendly fraud, where the transaction was genuine and the cardholder disputes it anyway.
The sources are worth separating, because the right response differs completely.
The customer lost and regrets it. Not a payment problem. A responsible gambling signal, frequently a strong one, and the case should route accordingly rather than being defended purely as a dispute.
The customer did not recognise the descriptor. An operational problem with a cheap fix: a clear, recognisable payment descriptor and a transaction confirmation that names what will appear on the statement.
Someone else in the household used the card, including a minor. This is the serious one. If a minor gambled on an adult's card, the operator has an age verification failure, not a chargeback, and defending the dispute while ignoring that is the wrong order of priorities entirely.
The cardholder's card was genuinely compromised. Actual third-party fraud, and the chargeback is working as intended.
Organised abuse, where a customer disputes systematically, sometimes across several operators. Scheme rules now give merchants a tool against repeat first-party disputes: under Visa's Compelling Evidence 3.0 rules, a card-absent fraud dispute is invalid where the same card was used in two earlier transactions not reported as fraud, processed between 120 and 365 days before the dispute, the goods or services bought are described, and the device or IP address plus at least one other identifier, such as the customer's login ID, match. From 24 October 2026 those earlier transactions can have been made at one or more merchants, not only at the operator facing the dispute.
The commercial consequences of chargebacks extend past the amount. Scheme monitoring programmes impose penalties and remediation requirements above defined ratio thresholds. Visa's Acquirer Monitoring Program, for example, divides fraud reports plus disputes by settled card-not-present transactions and, since 1 April 2026, identifies a merchant in the Asia Pacific, Canada, Europe and US regions as excessive at a ratio of 1.5% or more with at least 1,500 fraud and dispute cases in a month, after which risk mitigation measures are required. A gambling merchant starts in a high-risk category, because Visa lists card-absent betting (MCC 7995) among its high-integrity risk merchant categories, and Visa may disqualify a high-integrity risk merchant whose dispute activity reaches a critical level, after which its acquirer must stop submitting its Visa transactions. The ratio is therefore a business-critical metric, not a fraud metric, and the fastest way to improve it is usually not better defence but fewer disputes: clearer descriptors, faster payouts, and better handling of the customers who were going to dispute out of regret.
Refund and reversal manipulation
Processes designed for legitimate correction, exploited.
Reverse withdrawal is the gambling-specific case and it sits awkwardly across three disciplines. A customer cancels a pending withdrawal to keep playing. As a fraud control it is a route to recycle funds; as a responsible gambling signal it is one of the cleanest markers available; and as a product feature it exists because customers asked for it. Britain banned it for all remote operators from 31 October 2021, the Commission noting that its use had long been recognised as an indicator of harm, and New Jersey's Division of Gaming Enforcement prohibits operators from soliciting or incentivising the reversal of a pending withdrawal. Where it exists, the operator should be treating its use as a risk signal rather than a service.
Refund requests framed as goodwill, particularly repeated ones, are frequently an attempt to extract a deposit without playing, and sometimes a responsible gambling disclosure in disguise.
Duplicate or failed transaction claims where a customer asserts a deposit did not arrive. Usually genuine and resolvable from the logs, occasionally systematic.
Payout redirection
Changing withdrawal details to divert funds. Overlaps heavily with account takeover and is covered there, but two payment-specific points matter.
The change is the event, not the withdrawal. Alerting on a payout instrument change is earlier and cleaner than alerting on the withdrawal it enables.
Notify the old details, not just the new ones. A change notification sent only to the updated contact details reaches the attacker. This is a one-line configuration that defeats the standard attack sequence and is frequently wrong.
Money mules
An account used to receive and forward funds on behalf of someone else. The account holder may be knowing, coerced, or entirely unaware of what they are participating in.
Muling matters to a fraud function for a specific reason: the account is legitimate. The identity is real, verification passed properly, and there is nothing wrong at the onboarding layer. The signal is entirely behavioural.
Signals. Deposits from multiple unrelated third parties. Rapid pass-through with minimal play. Payouts to instruments unrelated to the account holder. Sudden activity on a previously quiet account. A young account holder with transaction volumes inconsistent with any plausible income.
The recruitment dimension is worth knowing. Mule recruitment targets young people through social media with offers framed as easy money: according to the National Crime Agency, around six in ten mules are under 30, most are recruited between the ages of 17 and 24, and young recruits are often unaware of the consequences of what they are doing. That has two consequences for handling: the case is a financial crime matter requiring the reporting route rather than a commercial recovery, and the person in front of you may be a victim of recruitment as well as a participant.
Where fraud controls meet the payments business
Fraud is one input into a payment stack that is also being optimised for conversion and cost, and the trade-offs are explicit.
Authentication friction costs deposits. Every step loses some proportion of transactions to abandonment and timeout. Exemption logic, applied correctly where the rules permit, recovers some of that, and applying it incorrectly produces declines. Under the EU's strong customer authentication rules, for example, payment service providers may skip authentication for remote payments of up to €30 within cumulative limits, or for transactions their real-time risk analysis rates as low risk.
Declines are not free. A declined legitimate deposit is a customer who may not try again. Decline rate by method, by issuer and by amount band is a fraud metric as much as a payments one, and the pattern in it frequently reveals a rule doing more harm than good.
Method mix changes the risk profile. Open banking and bank transfer carry no chargeback exposure, which removes an entire loss category and moves a defrauded customer's recourse to their own bank instead: in the UK, for example, victims of authorised push payment scams made by Faster Payments are covered by a reimbursement requirement, with the sending and receiving payment firms splitting the cost 50:50. Cards carry the exposure and the consumer protection, and in Britain only debit cards are in play, because gambling with credit cards has been banned since 14 April 2020. Crypto carries neither, plus provenance questions.
Payout speed is a fraud control and a retention feature simultaneously. Fast payouts reduce reverse withdrawals and improve satisfaction; they also shorten the window in which a fraudulent extraction can be stopped. The resolution is risk-based payout release, fast for low-risk profiles and held for review on the signals above, rather than a single speed for everyone.
Measuring it honestly
Four figures describe a payments fraud function, and most operators report the first only.
Fraud loss, including chargebacks paid, fees and write-offs.
Chargeback ratio, against the scheme thresholds, with the friendly-fraud proportion broken out, because the two have different remedies.
False decline cost. Legitimate deposits declined, multiplied by the value of the customers behind them. This is the invisible half again, and it is estimable: sample declines, verify a subset manually, and extrapolate.
Friction cost. Deposit success rate by method and by authentication path, and the abandonment at each step.
An operator holding all four can make a defensible decision about where to set a rule. One holding only the first will tighten controls indefinitely, because every tightening improves the only number it looks at.