What "suspicious" means, precisely
A suspicious betting pattern is betting activity inconsistent with what the information available to the public would produce. That definition does a lot of work and is worth taking apart.
Inconsistent means the pattern deviates from the expected behaviour of that market, given the event, the competition and the historical baseline. Not merely large, not merely unusual, but inconsistent with what a rational market would do.
With the information available to the public is the operative clause. The concern is foreknowledge: someone betting as though they know something the market does not. That is what distinguishes integrity monitoring from ordinary trading. A sportsbook cares about sharp money because it loses to it; an integrity function cares about money that is sharp because the outcome was arranged.
Most betting that looks strange has an innocent explanation. The purpose of monitoring is to find the residue that does not.
The signals
The recurring indicators, roughly in order of how much weight practitioners give them.
Volume disproportionate to the event. Betting turnover on a fixture that far exceeds what its sporting significance would attract. A lower-league match, a qualifying round, a reserve fixture, taking money at a level associated with a televised top-flight game. This is the foundational signal because it is hard to explain and hard to hide.
Price movement without public cause. Odds shortening substantially on one outcome with no team news, no injury, no weather, no line-up change, and no obvious reason in the public domain. A market that moves because bettors know something.
Timing. Money arriving in a concentrated window shortly before the event, or immediately before an in-play occurrence, rather than distributed across the days a market is open. Late, concentrated, one-sided money is the signature of information rather than opinion.
Concentration on a specific occurrence. Unusual activity on a proposition market, a particular in-play interval, a specific player's outcome, or a scoreline, out of proportion to the match market. Fixing targets what one participant can control, and the betting follows.
Geographic origin. Money on a fixture in one country arriving from accounts in another with no obvious connection, particularly where that pattern repeats across fixtures in the same competition.
New or dormant accounts. Accounts opened shortly before the event, or long-inactive accounts suddenly active, betting large on one specific outcome.
Correlated accounts. Multiple accounts betting the same way at the same time on the same specific outcome, sharing devices, instruments, addresses or connection characteristics.
Outcome confirmation. The bet wins, and wins in a way that matches the specific occurrence bet on. This is the signal that converts a suspicious pattern into a probable one, and it is only available afterwards.
Repetition. The same accounts, the same competition, the same type of occurrence, across several events. A single anomaly is noise; a pattern is a case.
No single signal is sufficient. Volume alone is a big fixture or a promotional push. Price movement alone is sharp money or news you missed. Timing alone is a late team-news reaction. It is the combination, and the absence of an innocent explanation for the combination, that constitutes suspicion.
The innocent explanations, which are most of them
An integrity analyst who cannot list these fluently will over-report, and over-reporting damages both the operator's credibility and the people it names.
Undisclosed team news. Information about injury, selection or motivation that circulated among a group before it reached the public or the operator. Sharp but not corrupt: the bettors knew something true, and the event was honest.
Sharp syndicate action. Professional bettors identifying a genuine pricing error and betting into it hard and fast. The market moves, the money is concentrated, and the outcome may well confirm. This is the single most common cause of a pattern that superficially resembles fixing.
Steam following. Other operators moving their price causes bettors and books to follow, producing correlated movement across the market with no information behind it at all.
Promotional or product effects. A boosted price, a featured market, an accumulator promotion, or a streaming placement drives volume onto a fixture for reasons entirely internal to the operator.
Arbitrage. A price discrepancy between operators produces concentrated money on one side at one book and the other side elsewhere, which looks like foreknowledge at either book in isolation.
Local interest. A fixture that is minor globally and significant locally: a derby, a promotion decider, a cup tie with a famous club.
Whale activity. A single large customer whose ordinary stake distorts a thin market.
Data errors. A feed fault, a mis-set price, a settlement error, or a market left open after the event started.
The discipline is to test each pattern against this list before it goes anywhere. An alert that survives the list is worth reporting. One that does not has been explained, and the explanation belongs in the record.
Market-level versus account-level
Integrity analysis operates on two levels and the distinction matters for what can be concluded.
Market-level analysis looks at the aggregate: total volume, price trajectory, distribution of money across outcomes. It is what monitoring companies and integrity associations mostly do, and it can establish that a market behaved abnormally.
Account-level analysis looks at who bet: the accounts, their history, their linkage, their timing. Only the operator can do it, because only the operator has the accounts. It is what converts an abnormal market into a set of people worth asking about.
A market-level anomaly with no account-level explanation is a weak case. A market-level anomaly where the money came from a cluster of linked, newly opened accounts in a specific location that have done this before is a strong one. Account-level work is where operators add value nobody else can, and it is the work most operators under-resource.
Baselines: the thing you need before you can see anything
A pattern is only anomalous relative to something. The something is the baseline, and building it is most of the work.
By competition: what does a normal fixture in this league take, and how does its price typically move?
By market type: what proportion of a match's turnover normally goes on the result, the total, and each proposition?
By time: how is money normally distributed across the period a market is open?
By account cohort: how do accounts of a given age, value and history normally bet?
Without these, every busy fixture is an alert and every quiet one is a blind spot. With them, deviation is measurable and the measurement can be defended.
What in-play does to detection
In-play betting changed integrity monitoring in three ways.
It multiplied the target set. Every discrete occurrence within an event became a market, and therefore a potential target for spot fixing.
It compressed the timing signal. Money arriving in the seconds before a specific occurrence is both more incriminating and harder to distinguish from courtsiding or from a fast reaction to something visible.
It shifted the analytical unit from the match to the moment. A fixture can be entirely honest in result and manipulated in one interval, and monitoring that only examines the result market will not see it.
The practical consequence for operators is that in-play proposition markets on low-tier events are the highest-risk product they offer, and market design decisions, which markets to offer on which competitions, do more integrity work than any amount of after-the-fact monitoring. That is the subject of lesson four.
The confirmation trap
Outcome confirmation is powerful and it is also the signal most likely to produce a wrong conclusion.
A suspicious pattern followed by a confirming outcome feels conclusive. It is not. Sharp money on a genuine pricing error also wins; that is what makes it sharp. Foreknowledge of a legitimate injury also wins. A large bettor who happened to be right also wins.
The base rate matters here. If an operator flags a hundred suspicious patterns and half the bets win, that is roughly what betting produces, and the fifty winners are not thereby fifty fixed events. Confirmation raises the weight of a pattern; it does not by itself convert an anomaly into a finding about anyone.
This is the point at which the reminder from lesson one applies with full force. An unusual pattern is a hypothesis about a market. The people behind it are identifiable, and naming them on the strength of a winning bet has ended careers on evidence that did not support the conclusion.