Fraud across the player lifecycle: what controls missed in peak demand

TL;DR: Fraud during the biggest event of the year moved across the player lifecycle as registration checks loosened, dormant accounts reactivated, and cash-out losses climbed despite stronger-looking dashboards, according to SEON. The finding shows why single-stage controls and siloed teams fail when fraud is orchestrated end to end across identity and payment signals.

Editorial analysis by NHI Mgmt Group, based on content published by SEON: “2026 World Cup Benchmarking Report”.

By the numbers:

• Registration volume more than doubled year over year globally, rising 121%.
• Latin America’s registration volume nearly quadrupled year over year, rising 278%.
• Dormant accounts drove 83% more of the identity-mismatch signal than during the baseline.

Key questions

Q: What breaks when fraud controls only cover onboarding and not the rest of the user journey?

A: Stage-limited controls let fraudsters pass a clean entry point and then shift abuse into payments, payouts, or cash-out where governance is weaker.

Q: Why do dormant accounts create higher fraud risk than active accounts?

A: Dormant accounts are attractive to fraudsters because long inactive relationships weaken routine oversight and make unauthorized activity less likely to be noticed quickly.

Q: How should security teams prioritise fraud controls when traffic spikes sharply?

A: Prioritise controls that preserve cross-stage correlation, not just low-friction onboarding.

Practitioner guidance

• Tighten reauthentication for dormant accounts Require fresh device, location, and behavioural checks when an account returns after extended inactivity, especially if the previous assurance state is stale.
• Correlate registration, login, bonus, and withdrawal signals Build one decision layer that can score the same user across onboarding, authentication, and cash-out rather than leaving each team to decide separately.
• Reassess friction settings during peak demand Review where registration controls were relaxed to protect conversion and measure whether those changes created a downstream opening for synthetic identities or credential stuffing.

Bottom line: The article shows that peak-event fraud succeeds when attackers move across the full lifecycle while individual controls only see fragments.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →