What "suspicious" means, precisely
A suspicious betting pattern is betting activity inconsistent with what the information available to the public would produce. That definition does a lot of work and is worth taking apart.
Inconsistent means the pattern deviates from the expected behaviour of that market, given the event, the competition and the historical baseline. Not merely large, not merely unusual, but inconsistent with what a rational market would do.
With the information available to the public is the operative clause. The concern is foreknowledge: someone betting as though they know something the market does not. That is what distinguishes integrity monitoring from ordinary trading. A sportsbook cares about sharp money because it loses to it; an integrity function cares about money that is sharp because the outcome was arranged.
Most betting that looks strange has an innocent explanation. The purpose of monitoring is to find the residue that does not.
International law draws the same line in two steps. The Council of Europe's Convention on the Manipulation of Sports Competitions (the Macolin Convention, 2014) defines irregular sports betting as betting "inconsistent with usual or anticipated patterns of the market in question", and keeps the word suspicious for betting which, "according to reliable and consistent evidence, appears to be linked to a manipulation" of the competition. An anomaly is irregular; it becomes suspicious only when evidence connects it to manipulation. The rest of this lesson is about making that journey carefully.
The signals
The recurring indicators, roughly in the order of weight this course gives them. Operator-side monitoring looks for the same things: IBIA, the operators' integrity association, lists unusual spikes in betting volume, surges in new account creation, clusters of activity in specific locations and accounts with a suspicious track record among the intelligence its members contribute.
Volume disproportionate to the event. Betting turnover on a fixture that far exceeds what its sporting significance would attract. A lower-league match, a qualifying round, a reserve fixture, taking money at a level associated with a televised top-flight game. This is the foundational signal because it is hard to explain and hard to hide.
Price movement without public cause. Odds shortening substantially on one outcome with no team news, no injury, no weather, no line-up change, and no obvious reason in the public domain. A market that moves because bettors know something.
Timing. Money arriving in a concentrated window shortly before the event, or immediately before an in-play occurrence, rather than distributed across the days a market is open. Late, concentrated, one-sided money is the signature of information rather than opinion.
Concentration on a specific occurrence. Unusual activity on a proposition market, a particular in-play interval, a specific player's outcome, or a scoreline, out of proportion to the match market. Fixing targets what one participant can control, and the betting follows.
Geographic origin. Money on a fixture in one country arriving from accounts in another with no obvious connection, particularly where that pattern repeats across fixtures in the same competition.
New or dormant accounts. Accounts opened shortly before the event, or long-inactive accounts suddenly active, betting large on one specific outcome.
Correlated accounts. Multiple accounts betting the same way at the same time on the same specific outcome, sharing devices, instruments, addresses or connection characteristics.
Outcome confirmation. The bet wins, and wins in a way that matches the specific occurrence bet on. This is the signal that converts a suspicious pattern into a probable one, and it is only available afterwards.
Repetition. The same accounts, the same competition, the same type of occurrence, across several events. A single anomaly is noise; a pattern is a case.
No single signal is sufficient. Volume alone is a big fixture or a promotional push. Price movement alone is sharp money or news you missed. Timing alone is a late team-news reaction. It is the combination, and the absence of an innocent explanation for the combination, that constitutes suspicion.
The innocent explanations, which are most of them
An integrity analyst who cannot list these fluently will over-report, and over-reporting damages both the operator's credibility and the people it names.
Undisclosed team news. Information about injury, selection or motivation that circulated among a group before it reached the public or the operator. Sharp but not fixing: the bettors knew something true, and the event was honest. It is not automatically innocent, though. If the bettors are insiders, using that information, or passing it on to others, for betting purposes can amount to misuse of inside information, and the Gambling Commission's Sports Betting Intelligence Unit receives reports of suspected misuse as betting integrity cases.
Sharp syndicate action. Professional bettors identifying a genuine pricing error and betting into it hard and fast. The market moves, the money is concentrated, and the outcome may well confirm. Because it produces the same market signals, it is the innocent explanation most easily mistaken for fixing.
Steam following. Other operators moving their price causes bettors and books to follow, producing correlated movement across the market with no information behind it at all.
Promotional or product effects. A boosted price, a featured market, an accumulator promotion, or a streaming placement drives volume onto a fixture for reasons entirely internal to the operator.
Arbitrage. A price discrepancy between operators produces concentrated money on one side at one book and the other side elsewhere, which looks like foreknowledge at either book in isolation.
Local interest. A fixture that is minor globally and significant locally: a derby, a promotion decider, a cup tie with a famous club.
Whale activity. A single large customer whose ordinary stake distorts a thin market.
Data errors. A feed fault, a mis-set price, a settlement error, or a market left open after the event started.
The discipline is to test each pattern against this list before it goes anywhere. An alert that survives the list is worth reporting. One that does not has been explained, and the explanation belongs in the record. The test does not raise the legal threshold for reporting. In Great Britain, licence condition 15.1.2 requires betting licensees to give the Gambling Commission, as soon as reasonably practicable, any information they know or suspect relates to an offence under the Gambling Act 2005, cheating included, and to pass information about suspected breaches of a sport's betting rules to that sport's governing body where it is one listed in the Act. Integrity information goes to the Commission's Sports Betting Intelligence Unit.
Market-level versus account-level
Integrity analysis operates on two levels and the distinction matters for what can be concluded.
Market-level analysis looks at the aggregate: total volume, price trajectory, distribution of money across outcomes. It is what the sports data companies that watch global odds for sports bodies mostly do, identifying discrepancies between actual and expected odds, and it can establish that a market behaved abnormally.
Account-level analysis looks at who bet: the accounts, their history, their linkage, their timing. Only the operator holds the accounts, so the work starts there. Operator associations pool it: when an IBIA member raises an alert, other members cross-check their own data and IBIA analysts carry out customer-level analysis, and UNODC notes that third-party account-level monitoring services can aggregate such data across multiple operators. It is what converts an abnormal market into a set of people worth asking about.
A market-level anomaly with no account-level explanation is a weak case. A market-level anomaly where the money came from a cluster of linked, newly opened accounts in a specific location that have done this before is a strong one. Account-level work is where operators add value nobody else can, and it is the work most easily under-resourced.
Baselines: the thing you need before you can see anything
A pattern is only anomalous relative to something. The something is the baseline, and building it is most of the work.
By competition: what does a normal fixture in this league take, and how does its price typically move?
By market type: what proportion of a match's turnover normally goes on the result, the total, and each proposition?
By time: how is money normally distributed across the period a market is open?
By account cohort: how do accounts of a given age, value and history normally bet?
Without these, every busy fixture is an alert and every quiet one is a blind spot. With them, deviation is measurable and the measurement can be defended.
What in-play does to detection
In-play betting changed integrity monitoring in three ways.
It multiplied the target set. Every discrete occurrence within an event became a market, and therefore a potential target for spot fixing.
It compressed the timing signal. Money arriving in the seconds before a specific occurrence is both more incriminating and harder to distinguish from courtsiding or from a fast reaction to something visible.
It shifted the analytical unit from the match to the moment. A fixture can be entirely honest in result and manipulated in one interval, and monitoring that only examines the result market will not see it.
The practical consequence for operators is that in-play proposition markets on low-tier events are among the highest-risk products they offer. The Independent Review of Integrity in Tennis made the point in its 2018 interim report: the sale of official live scoring data had made tens of thousands of matches available for betting, on a wide range of contingencies, at levels of the sport where the risk of integrity breaches is likely greatest. Market design decisions, which markets to offer on which competitions, do more integrity work than any amount of after-the-fact monitoring. That is the subject of lesson four.
The confirmation trap
Outcome confirmation is powerful and it is also the signal most likely to produce a wrong conclusion.
A suspicious pattern followed by a confirming outcome feels conclusive. It is not. Sharp money on a genuine pricing error also wins; that is what makes it sharp. Foreknowledge of a legitimate injury also wins. A large bettor who happened to be right also wins.
The base rate matters here. If an operator flags a hundred patterns on outcomes priced at roughly a fifty per cent chance and about half the bets win, that is what honest betting at those prices produces, and the fifty winners are not thereby fifty fixed events. Confirmation raises the weight of a pattern; it does not by itself convert an anomaly into a finding about anyone. The Court of Arbitration for Sport has put the evidential standard plainly: to conclude that a match was fixed, "the analytical information needs to be supported by other, different and external elements pointing in the same direction".
This is the point at which the reminder from lesson one applies with full force. An unusual pattern is a hypothesis about a market. The people behind it are identifiable, and naming them on the strength of a winning bet can end careers on evidence that does not support the conclusion.