Fictional scenario. Synthetic data. Your notes stay on this browser; do not enter real customer information.
A welcome bonus is a contract with a stranger: deposit this, we add that, play it through and the balance is yours. It is priced on the assumption that each stranger is one person who might stay. A bonus ring breaks the assumption rather than the contract. Forty accounts, forty bonuses, one person, and each account does precisely what the terms require and nothing more.
OWASP files the mechanism under OAT-019, Account Creation: bulk creation of accounts to obtain something given once per account. The cash-out at the end sits under OAT-012. Between the two is what an operator actually sees: a set of accounts that are not quite the same and not quite different.
What the scheme needs.
From the operator's side, four things.
An offer worth more than the cost of an account. If the bonus is EUR 50 and an account takes four minutes, the arithmetic is obvious. A referral reward paid to the referrer doubles it.
Onboarding that checks a document rather than a person. A ring needs forty identities that pass; it does not need forty people. Synthetic identity and KYC covers where those identities come from, at the level a defender needs.
Wagering terms that can be met by playing to a plan. Lagoon Casino, our fictional operator, has a play-through requirement like everyone else, and a ring treats it as an instruction rather than an invitation.
A withdrawal route. The money has to leave, and part six of this series is about where it goes.
What it looks like in your data.
A synthetic illustration at Lagoon, one fortnight of registrations.
- 40 new accounts in nine days share two device references between them. Lagoon's baseline is roughly one device per account.
- 31 of the 40 were registered through a single referral code, belonging to an account registered three weeks earlier.
- Every account claimed the welcome bonus within four minutes of registration. Honest new players claim it in a distribution with a long tail; some never do.
- Deposits are identical: the minimum that unlocks the maximum bonus.
- Play is identical in shape: one game, wagering stops at 100.4 per cent of the required turnover, median session 38 minutes.
- Withdrawal requests arrive within 48 hours of the turnover being met, to six bank account references among 40 accounts.
- E-mail addresses are of one mould at example.com. Names and documents are all different.
- Registration IPs fall in 203.0.113.0/24 on 29 accounts.
What a ring shares is not identity. It is behaviour and infrastructure: device, referral, timing, the shape of play, the destination of the money. The identities are the one thing the ring has made sure are different.
What else looks like this.
A household. Two or three people on one device and one connection, each with a real account. The behaviour differs between them, and the withdrawals go to different accounts.
An affiliate who is good at their job. A streamer sends a hundred sign-ups in a night, all with the same referral code and the same first game. The devices are a hundred different devices, and the play afterwards looks like a hundred people. Affiliate traffic quality is about the case where it does not.
Bonus hunters who are one person each. Someone who plays every operator's offer once, to the terms, and leaves. Unwelcome, perhaps, but one account, one person, one bonus. The remedy is the terms, not the fraud desk.
The ring is distinguished from all three by the combination: shared device, shared referral, shared withdrawal destination, identical play. Any one is a lead. Three together is a finding, and link analysis is the method for getting from one to the other without over-reaching.
Where it is usually caught.
At withdrawal, most often. The six bank references among forty accounts are visible the moment the money asks to leave, and withdrawal review is where most rings meet a human for the first time. This is late: the bonus has been granted, the play-through completed, and whether the operator can decline to pay under its own terms is a question for its compliance team and counsel.
The earlier catch is at registration, on device and referral concentration, and it is cheaper because nothing has been granted yet. The cost of a false positive is a real new customer asked for an extra step on day one. Price it against a bonus paid to a ring.
The earliest catch is in the offer design and the referral terms, which is not the fraud desk's decision but is the fraud desk's data to bring to the people who make it.
A desk card.
- Count accounts per device reference per week, and accounts per referral code.
- Watch time-to-bonus-claim. A spike at the fast end is a question.
- Compare wagering to the requirement. Stopping at the line is a shape.
- At withdrawal, count distinct bank references per group of linked accounts.
- Write each link as a lead, and name the number of leads it takes to call it a ring.
Read next.
One welcome bonus, forty welcomes. is the full article. Try the case Bonus multi-accounting at Lagoon, or the Volume 01 case Promo abuse at a smaller scale. Look up multi-accounting. Part six is mule cash-out, where the money goes last.
Edited 6 November 2026. Primary references are listed above; fictional scenarios are not claims about Antifrog customers or operating experience.
Fictional learning material. Any numerical examples are synthetic. Use only authorised, appropriately minimised records for workplace exercises; do not upload customer information to this learning site.