Bet365 Poker Cheating Detection: Network + Operator Architecture

What counts as cheating on Bet365 Poker

Categorisation matters because each prohibited category routes through a different signal stack, has a different false-positive budget, and a different consequence path. The public terms of service across Bet365 Poker and the wider iPoker Network treat the following as bans:

Collusion and chip dumping carry the highest operator priority because they are the categories regulators care about — the UKGC and MGA both require licensees to demonstrate active anti-collusion measures, and unresolved cases generate regulatory complaints. Botting and RTA sit slightly below, both because the population scale is smaller and because the EV cost to honest players is more diffuse. Multi-accounting is the easiest to catch because the KYC and payment graph closes it cleanly. External HUDs trigger on client-side process detection. Ghosting is small-volume but spikes around iPoker's larger tournament series.

The network + operator detection model

The stack as visible from the outside has four signal layers split across two organisations. There are almost certainly internal layers that an external observer cannot see — heuristic scoring, AI-based risk models, hidden signals — but the four below are the ones whose effects are observable in account behaviour and ban patterns.

Layer 1: Behavioural fingerprinting (Playtech, network-side)

Client telemetry on input timing, mouse-path geometry on desktop, touch dwell and pressure on mobile, action-confirmation latency, idle behaviour between hands. Runs continuously, feeds a behavioural score per session. Joins on Playtech's internal player ID, which spans every iPoker skin — a fingerprint generated on Coral is visible at Bet365 and vice versa.

Layer 2: Statistical play-pattern analysis (Playtech, network-side)

Per-account distributional analysis on VPIP, PFR, 3-bet by position, fold-to-cbet by board texture, bet-sizing histograms, river aggression, all-in equity at showdown. Heavy compute, runs nightly or weekly. Reference distributions are network-wide, giving Playtech larger sample sizes than any single skin would afford.

Layer 3: Anti-collusion graph (Playtech, network-side)

Account graph joined by IP, device fingerprint, deposit method, KYC document, table co-occurrence, action correlations within hands. Catches multi-accounting and chip dumping primarily; bot farms appear as side-products when the farm runs under shared fingerprints.

Layer 4: Operator fraud + KYC + human review (Bet365)

Sportsbook-grade fraud machinery — payment-pattern anomalies, ID verification, source-of-funds checks at thresholds set by the UKGC and Bet365's licensed-jurisdiction list. Less poker-specific intelligence than Playtech's pipeline, but heavier identity and payment scrutiny than most pure poker operators run. Final ban decisions on mixed signals are taken here, often with input from Playtech's analysts.

The two tiers run on different cadences and feed different parts of the decision. Behavioural fingerprinting produces a high-frequency score that mostly sits under threshold. Play-pattern analysis runs offline and decays slowly. Graph analysis is event-driven by graph changes — new device, new payment instrument, new co-occurrence pattern. Operator fraud review fires on payment events, withdrawal thresholds, and any signal forwarded from Playtech for joint consideration.

Signal weights and observable failure modes

Exact weights are operator-internal. Relative weights can be inferred from the pattern of bans — what gets caught, in what order, with what time lag — well enough to be useful for both detection-system designers and the people building against them.

The pattern is consistent. The cheapest layers (L1 and L3) catch the cheapest implementations. The expensive layers (L2, requiring offline compute over weeks of data, and L4, requiring reviewer time) catch the more capable implementations later. The visible result is a long lag between a bot's first session and the eventual ban — typically two to nine months at iPoker, with a median around three to four months, anchored on when a triggering event (usually a large withdrawal) pulls the account into the review queue.

Action-timing fingerprints

The most-discussed and most-poorly-implemented signal in the stack. A naive bot emits actions at a fixed latency or with uniform noise around a mean. Both are immediately distinguishable from human play.

Human action-timing distributions are roughly log-normal in shape, with state-dependent location parameters and heavy right tails. A snap-fold of obvious garbage lands in 600–1200 ms. A routine c-bet on a clean board sits at 1.5–4 seconds. A boundary river decision can take 5–30 seconds, and the distribution has a separate distraction tail — 8–25 second pauses uncorrelated with game state, representing the human briefly attending to something else. The shape of this distribution is the fingerprint; matching only its mean or variance does not match the shape.

# Schematic: behaviourally-shaped action timing
# Conceptual, not the production implementation

def sample_action_delay(decision_difficulty, action_type, hand_state):
    """Return seconds-to-act drawn from a state-conditional log-normal."""
    # Difficulty in [0,1]: 0 = trivial fold, 1 = boundary call
    mu_base = {
        'fold_trivial':   math.log(0.9),
        'cbet_routine':   math.log(2.4),
        'check_routine':  math.log(1.6),
        'river_boundary': math.log(8.5),
        'all_in_decision':math.log(12.0),
    }[action_type]

    # Difficulty stretches mu logarithmically
    mu = mu_base + 0.7 * decision_difficulty

    # Sigma rises with difficulty — humans deliberate variably on hard spots
    sigma = 0.35 + 0.55 * decision_difficulty

    delay = random.lognormvariate(mu, sigma)

    # ~3% chance of distraction tail: 8–25s independent of difficulty
    if random.random() < 0.03:
        delay += random.uniform(8, 25)

    # Floor at a non-zero minimum; humans cannot react in < 250ms
    return max(0.25, delay)

The example is schematic. Production systems condition on more variables — stack depth, opponent action sequence, position, multiway versus heads-up, a per-session alertness parameter that drifts down to mimic fatigue. The point is that the correct behaviour is not "add noise" — it is "draw from a distribution whose shape matches the population, conditioned on game state."

False-positive budget and review pipeline

The primary constraint on the whole stack is false-positive cost. Bet365 and Playtech cannot afford to ban a measurable fraction of legitimately winning players. Every false positive risks a regulatory complaint, a chargeback dispute, a forum post, a churned customer. The thresholds are tuned conservatively, which means signals do not directly cause bans; they cause review-queue placement.

The visible stages from outside, in order:

1. Quiet flag. The account moves into a higher-scrutiny bucket. No visible change to the player. Telemetry continues.
2. Soft restriction. Withdrawal limits drop. KYC re-verification requested. Bonus eligibility quietly removed. Some players notice; most do not.
3. Structured interview. Bet365 support requests "clarifying information" about play style, schedule, and software in use. The interview is logged. Answers are matched against the play-pattern model.
4. Confiscation and closure. Winnings voided, balance held pending investigation, account closed. The investigation period extends from weeks to months depending on jurisdiction. UK customers have the recourse of the Independent Betting Adjudication Service (IBAS) which lengthens the timeline further.

The cycle from first quiet flag to confiscation typically runs 14 days to 9 months, anchored on review-queue capacity and triggering events — most often a withdrawal larger than the account's running average. The longest cycles we have seen are accounts that ran quietly for over a year, withdrew their first meaningful sum, and were reviewed within two weeks of the withdrawal. The mathematical signal was already present months earlier; the human review was queued only when the money moved.

Anti-detection as adversarial classification

The standard mistake among bot builders is to treat detection as a feature checklist — add latency noise, vary touch coordinates, randomise schedule. This is the wrong frame. Detection is an adversarial classifier: the operator builds a model that separates bot behaviour from human behaviour, and the bot's task is to produce a behaviour distribution the classifier cannot separate from the human distribution while preserving EV.

The formal literature on this dates to Dalvi et al. (2004), Adversarial Classification, and Lowd & Meek (2005), Adversarial Learning. The structure is identical: an attacker (here, the bot) chooses an action that maximises expected utility under a classifier whose decision boundary the attacker can probe but not fully observe. The modern adversarial-ML lineage (Goodfellow et al. 2014 onward) extends this with neural-network classifiers, gradient-based attacks, and the certified-robustness literature.

Three operational consequences fall out of the formal frame, with one extension specific to the iPoker context:

The decision boundary is non-stationary

Operators retrain their detection models as new bot signatures appear. Behaviour that survived in 2024 may not survive in 2026. Any long-running implementation needs continuous behavioural-shape adjustment, not a fixed configuration.

Population baseline is the reference, not "looking human"

The classifier separates the bot's distribution from the population distribution, not from an abstract human ideal. If the NL50 6-max iPoker population has a specific bet-sizing histogram with a long tail at small overbet sizes, the bot's bet-sizing histogram needs to match that specific shape. "More human" is not the goal; "indistinguishable from population" is.

EV vs detection is the right optimisation target

Pure-GTO output maximises EV under fixed opponents. Behaviourally-shaped output gives up some EV in exchange for a lower detection score. The right optimum is not zero detection — it is the EV-maximising point under a budgeted detection probability over the account's expected lifetime.

iPoker-specific: stacked-classifier optimisation

The detection topology on Bet365 Poker is two classifiers — Playtech's network-side play-pattern model and Bet365's operator-side fraud model — with different feature sets and different decision boundaries. Optimising for either alone can degrade the other. The right formal extension is multi-classifier adversarial selection: minimise max-classifier risk under an EV constraint. The literature thins out fast past single-classifier settings.

This frame explains an apparent paradox in field reports: pure-GTO bots tend to be banned faster than weaker bots with overlaid human-shaped noise. The GTO bot wins more per hand but spends less time on the platform before the classifier separates it, so total lifetime profit is lower. The EV optimisation that ignores detection is the wrong optimisation.

References and related work

Selected sources on the above topics. Names and identifiers provided; arXiv IDs are stable, Science DOIs persistent.

• Brown & Sandholm, 2019. Superhuman AI for multiplayer poker. Science 365 (Pluribus). The reference result for 6-max NLH at superhuman level.
• Moravčík et al., 2017. DeepStack: Expert-level artificial intelligence in heads-up no-limit poker. Science 356. arXiv:1701.01724.
• Brown & Sandholm, 2017. Safe and nested subgame solving for imperfect-information games. NeurIPS (Libratus core technique).
• Dalvi, Domingos, Mausam, Sanghai & Verma, 2004. Adversarial Classification. KDD. The foundational paper on the adversarial-classifier framing.
• Lowd & Meek, 2005. Adversarial Learning. KDD. Probing the decision boundary of a deployed classifier.
• Heinrich & Silver, 2016. Deep Reinforcement Learning from Self-Play in Imperfect-Information Games. NIPS DRL workshop. arXiv:1603.01121.

The companion notes on this site cover the broader picture: why "Bet365 Poker hacks" do not exist and the homepage's overview of what we mean by "poker bot" in 2026. The FAQ answers specific implementation questions that come up regularly in the chat.