In short
- The threats: soft play, team play, chip dumping, multi-accounting, bots and real-time assistance. Each leaves different traces in hand histories, timing and devices.
- GLI-19 expects an operator to detect chip dumping, soft play and other collusion, and bots or software that give players an unfair advantage.
- The largest rooms publish what they find: partypoker closed 277 bot accounts in four months; GGPoker works with GTO Wizard against RTA; WPT Global lists recent bans.
- PokerEnginePro scores soft play, team play, bots, real-time assistance and multi-accounting with the evidence attached, and works alerts as cases with a second person on every decision.
On this page
The threats, one by one
Integrity threats in online poker fall into two families. Collusion is several players acting as one: sharing information, avoiding each other, or moving money between themselves. Assistance is one player who is not playing alone: a bot playing for them, or software telling them what to do while they play. Multi-accounting sits between the two — one person with several seats, which is collusion with oneself.
| Threat | What it is | What it leaves behind |
|---|---|---|
| Soft play | Players going easy on each other: not betting into a friend, folding strong hands to them. | Less aggression between a pair than against everyone else; strong hands folded to the same player. |
| Team play | Players working together against a third: sharing hole cards, raising in turn to squeeze others out. | A pair or group at the same tables more than chance explains; raising in turn against a third player. |
| Chip dumping | One player losing to another on purpose, to move money between accounts. | Money flowing one way between the same players, hand after hand. |
| Multi-accounting | One person behind several accounts, at the same table or in the same tournament. | Shared devices, networks, payment instruments or addresses. |
| Bots | Software playing in place of a person. | Steady, fast timing whatever the decision; very long sessions without breaks. |
| Real-time assistance (RTA) | A person playing with a solver or other tool advising them during the hand. | Slow decisions on trivial spots, steady long thinks on hard ones; play unusually close to solver output. |
What regulators and labs expect
GLI-19, Gaming Laboratories International's standard for interactive gaming systems, writes integrity into the operator's controls. Players must not occupy more than one position in a peer-to-peer game unless its rules allow it, and must be warned where bots or other unauthorised software can affect play. The operator must give players a way to report suspected cheating, collusion or bots, and must track each player's games and opponents.
Its monitoring section asks the operator to detect irregular patterns that point to collusion — naming chip dumping, soft play, best-hand play (only the partner with the best hand plays on) and chat collusion — and to detect and prevent bots or unauthorised software that predict outcomes, track cards, calculate probabilities or advise on strategy.
In Great Britain, cheating at gambling, or helping another person cheat, is a criminal offence under section 42 of the Gambling Act 2005, punishable by up to two years in prison on indictment — whether or not the cheat actually wins anything. Integrity work is not only good business; it produces evidence that may be needed. This is general information, not legal advice.[1][2]
How the big rooms respond
The largest rooms run dedicated integrity teams, and several publish what they find — both to deter cheats and to reassure honest players that confiscated money comes back to them.
| Room | When | What they published |
|---|---|---|
| partypoker | April 2019 | 277 bot accounts closed between 1 December 2018 and 31 March 2019, and $734,852.15 returned to affected players; a fraud team of former professional players behind most real-money closures; regular reports promised. |
| GGPoker and GTO Wizard | March 2025 | A partnership against real-time assistance: GTO Wizard's Fair Play Check shows whether a given spot was solved on GTO Wizard in a given window; 31 accounts already banned. |
| WPT Global | June 2025 | A public page of recently banned accounts; $166,885.07 seized between January and May 2025 and redistributed to affected players; an AI tool, a GTO Wizard partnership and a team of more than 50 people. |
Detection: signals, scores and evidence
No single hand proves collusion, and no single fast decision proves a bot. Detection works on patterns over many hands, and the quality of an integrity system shows in three things: which signals it reads, whether it explains its scores, and how few honest players it flags.
Hand histories are the main source for collusion. Comparing how a pair plays against each other with how each plays against everyone else exposes soft play; counting how often a group sits together, and how often its members raise in turn against a third player, exposes team play. Money flows between the same accounts expose chip dumping.
Timing is the main source for bots and real-time assistance. People take longer over hard decisions than easy ones; a bot often does not, and a player consulting a solver may take longest over decisions that should be trivial. Comparing decisions with solver output can add a stronger signal, but it needs licensed reference data.
Devices, networks and payments expose multi-accounting: the same device, the same connection, the same card or wallet, or the same address behind accounts that claim to be different people.
An alert an investigator cannot explain is an alert nobody can act on. Every score should come with the hands and numbers behind it.
From alert to decision
Detection only starts the work. An alert becomes a case; an investigator reviews the evidence — the hands, the timings, the shared identifiers — and reaches a decision: no action, a warning, a restriction, or closure with winnings confiscated. Each step needs a record that would stand up to a regulator's or a court's questions.
Two principles keep that work fair. A restriction should protect the room immediately, before the investigation ends, by stopping real-money play. And no single person should be able to close an account and take its balance: the decision that moves money needs a second person. Where winnings are confiscated, the large rooms return them to the players who lost them, as partypoker and WPT Global have described.[3][5]
How PokerEnginePro detects it
PokerEnginePro's integrity suite scores each threat from what the platform already records, and explains every score by its components with the evidence attached. Each hand keeps every player's decision times alongside its events, so timing can be analysed hand by hand.
A monitor runs every 15 minutes and raises each alert once. Its thresholds and weights are Compliance business settings, and the platform's own values are the loosest allowed: an operator can make detection stricter, never weaker.
- Soft play, per pair: less aggression heads-up with each other than with others; strong hands folded to each other.
- Team play, per pair and group: how often they play together, raising in turn against a third player, and money flowing one way, measured in big blinds.
- Bots: steady, fast timing; timing that ignores how hard the decision is; marathon sessions.
- Real-time assistance, by timing: slow trivial decisions and steady long hard ones.
- Multi-accounting: clusters of accounts sharing a device, device traits, an IP address or network, a payment instrument, a wallet or a verified address — kept only as keyed hashes, for a year.
How PokerEnginePro works the cases
Alerts land on the back office's Integrity page with their evidence. An investigator opens a case, adds notes and links the evidence, and decides. A restriction stops the player's real money at once — deposits, withdrawals and real-money seats — while the case continues.
Closing an account and confiscating its winnings is a ledger adjustment, booked once and never overdrawn, and it needs a second holder of the integrity permission to approve it. Lifting a restriction needs a second person too. Every step is audited, in an audit log that is hash-chained so it cannot be rewritten. Risk, Compliance and the auditor can read integrity cases; Risk and Compliance can act on them.
The suite sits beside the anti-money-laundering rules that already watch for chip dumping — one player losing to the same other player, hand after hand, with the hands attached — and for unusual stakes and rapid in-and-out. When an investigation needs to see the cards, Risk can see hole cards for settled hands only, and every look is audited.
Prevention: rules that close the doors first
The cheapest case is the one that never happens. PokerEnginePro seats no bots and no spectators at real-money tables, enforced in the lobby, the table, tournaments and the gateway; its own bots exist for development and play-money tables only, and where a market forbids bots altogether, its players never meet one, play money included. A spectator's stream never carries a hidden card, and real-money tournament tables can be watched only on a delay.
The player's client sends a random device identifier and a digest of device traits for multi-account checks, and tells players what it collects and why in a fair-play notice. Verified identities, geolocation and sanctions screening — the checks that make a second account harder to open in the first place — run before real money.
Detection that compares decisions with solver output needs licensed reference data, so it is not built in; the timing signals work without it.
Questions
What is the difference between collusion and chip dumping?
Chip dumping is one form of collusion: one player losing to another on purpose to move money between them. Collusion also covers soft play, sharing hole cards and raising in turn to squeeze out a third player.
How do poker rooms detect real-time assistance?
Mostly from timing and from how closely decisions match solver output. GGPoker works with GTO Wizard, whose Fair Play Check shows whether a spot was solved on GTO Wizard during a given window.[4]
What does GLI-19 require on collusion and bots?
That the operator detect irregular patterns pointing to collusion — including chip dumping, soft play, best-hand play and chat collusion — and detect and prevent bots or unauthorised software, and that players can report suspected cheating.[1]
Can an operator change PokerEnginePro's detection thresholds?
Yes, as Compliance business settings — but only to make detection stricter. The platform's own values are the loosest allowed.
Who approves closing an account for cheating on PokerEnginePro?
Two people. The confiscation is a ledger adjustment that a second holder of the integrity permission must approve, and every step is audited.
Method and sources
Facts about other companies, regulators and markets come from the sources listed, each checked on the date shown. Facts about PokerEnginePro describe the platform itself. This guide is general information, not legal advice. Spotted something out of date? Tell us and we will correct it.
- [1]GLI-19: Standards for Interactive Gaming Systems, version 3.0 — Gaming Laboratories International, checked 7 October 2026
- [2]Gambling Act 2005, section 42: cheating — legislation.gov.uk, checked 7 October 2026
- [3]partypoker closes 277 bot accounts, returns $734,852 to players in four-month period — PokerNews, checked 7 October 2026
- [4]GGPoker and GTO Wizard team up to keep poker fair — PokerNews, checked 7 October 2026
- [5]WPT Global shares first-ever cheating report — pokerfuse, checked 7 October 2026
partypoker, GGPoker, GTO Wizard and WPT Global are trademarks of their respective owners. PokerEnginePro is not affiliated with, sponsored by or endorsed by any of them; facts about them come from the public sources listed.