Casino Cheats & Scams

Showing 150 of 402 entries.

• Card Marking · Professional

  Juice Marking

  Juice marking uses a specially formulated chemical solution that subtly alters the pigmentation on the back of playing cards. The marks are invisible to untrained eyes but readable by those who know what to look for. The “juice” is typically applied in small patterns or dots on the card back design. Different recipes exist for different card back colors (red vs. blue). Professional juice is extremely subtle and can be read from across a crowded room by a well-trained eye. The marks may correspond to card rank, suit, or both.

  Detection. Train surveillance staff to recognize juice marks by examining cards under various lighting conditions. Use the Spectrum Vision SV-1 or similar devices that cycle through different light frequencies (UV through IR) to detect chemical markings. Look for players who consistently look at card backs before making decisions. Players may squint or tilt their heads to catch the right light angle.

  Countermeasures. Use cards with complex back designs that make alterations more obvious. Frequently rotate decks (every 4-8 hours). Implement “riffle tests” where cards are riffled to check for visible marks. Train dealers to watch for players applying substances to cards. Use cards with intricate border patterns that reveal tampering.

  Target: Blackjack, Poker, Baccarat, Three Card Poker, any card game

• Card Marking · Intermediate to Professional

  Daub (On-the-Fly Marking)

  Daub is a special paste or chemical substance that a cheater applies to cards DURING active gameplay, eliminating the need to introduce a pre-marked deck. The player secretly transfers daub from a hidden container to their fingertip, then marks target cards (typically high-value cards) by touching the card backs. The marks become visible to the trained eye or through special filtered lenses. Daub can be concealed in rings, under fingernails, or in small containers hidden in pockets. The cheater must first identify which cards to mark, then maneuver them to an accessible position before applying the daub.

  Detection. Watch for players who: (1) Look at their cards to determine which to mark; (2) Slide or shuffle cards in hand to bring target cards to the top position; (3) Drag their index finger across the back of specific cards; (4) Show fingertip movements from slight wiggles to lengthy swipes across card backs; (5) Try to remove excess daub with opposite hand. Also watch for players leaving the table and going to restrooms or cars to dispose of daub containers.

  Countermeasures. The “sandwich cut” - cutting the deck into three sections and placing top and bottom sections inside a cut in the middle section. Frequent deck changes. Dealers should watch for unusual card handling. Seize restroom trash if a suspected cheater visits after play. Use Spectrum Vision SV-1 to confirm suspected markings.

  Target: Blackjack, Poker, Three Card Poker (especially games where players handle cards)

• Card Marking · Intermediate

  Juice Dust

  An advanced type of daub, juice dust is a powdered form of marking substance that can be applied to cards during play without dulling the card’s finish. Unlike traditional daub, juice dust works on both paper and 100% plastic playing cards. The cheater typically has the powder hidden on their person (in a pocket, ring, or other concealment) and applies it by touching card backs. The powder adheres to the card surface and creates a mark readable through special filtered lenses or by the trained naked eye.

  Detection. Same as daub detection - watch for unusual card handling and finger movements across card backs. Since juice dust doesn’t dull card finish, the “sticky card” test may not work. Use specialized detection equipment that can identify powder residue on card surfaces.

  Countermeasures. Frequent deck rotation. Use the sandwich cut technique. Monitor players for suspicious hand movements. Implement regular card inspection with detection devices. Watch for players who frequently touch their pockets or clothing before handling cards.

  Target: All card games, especially those using plastic cards

• Card Marking · Intermediate to Professional

  Block-Out Work

  Block-out work involves using ink of the same color as the card back to color in or alter small white areas of the back design. For example, a cheater might narrow the petals on a flower design, block out a small bird image, or fill in portions of the border pattern. The marks are subtle and require close inspection to detect. Different blocked-out areas correspond to different card ranks and suits. This technique requires skill and precision to avoid making marks that are obvious to casual observers.

  Detection. Riffle test - riffling the deck can make block-out marks more visible as the cards move. Examine cards under magnification. Compare suspected marked cards against fresh cards from the same deck. Look for inconsistencies in back design patterns. Train staff to recognize common block-out patterns.

  Countermeasures. Use cards with complex back designs featuring multiple colors and intricate patterns. Simple two-color designs are most vulnerable. Frequently change decks. Conduct visual inspections. Use cards with detailed border work where block-outs would be more obvious.

  Target: Poker, Blackjack, any game where marked cards can be read

• Card Marking · Intermediate

  Cut-Out Work

  Cut-out work involves using a sharp instrument (razor blade, needle, or other sharp tool) to scrape off small portions of the printed back design, revealing the white card stock underneath. This creates visible marks that can be read by the cheater. Different patterns of cut-outs correspond to different card values. For example, a cheater might scrape out a small dot in a specific location to indicate an ace, or create a short line to indicate a face card.

  Detection. Close visual inspection of card backs under good lighting. Magnification helps. Riffle testing can reveal cut-out marks as the cards move past each other. Look for white spots or lines that appear in consistent locations on specific card ranks. Compare cards against known fresh cards.

  Countermeasures. Use cards with complex, multi-layered back designs. Conduct regular deck inspections. Change decks frequently. Train dealers to notice if players are handling cards with sharp objects. Use plastic cards which are more resistant to cut-out work than paper cards.

  Target: Poker, Blackjack, any card game

• Card Marking · Professional

  Shade Work / Tint Work

  Shade work (also called tint work) involves lightly tinting or washing specific areas of the card back design with a diluted ink solution of a similar color to the card back. Rather than completely blocking out an area, the cheater applies a subtle wash that changes the shade slightly. For example, the head of a small angel figure on the card back might be tinted to indicate an ace, the left wing for a king, the right wing for a queen, etc. The two is typically left unmarked.

  Detection. Requires careful comparison of suspected cards against known clean cards. Magnification and good lighting essential. Look for subtle variations in color density on the back design. Riffle testing may reveal shade differences. Train staff to recognize that tint marks are much more subtle than block-out marks.

  Countermeasures. Use cards with back designs that have many small details - these are harder to mark subtly. Frequent deck changes. Visual inspection programs. Train surveillance to recognize players reading card backs.

  Target: Poker, Blackjack, Baccarat

• Card Marking · Professional

  Scroll Work

  Scroll work involves making extremely fine, intricate marks on card backs using precise instruments. The marks follow the scroll or line patterns already present in the card back design, making them blend in naturally. A skilled scroll worker can alter tiny curves, extend lines, or add small decorative elements that are virtually indistinguishable from the original printing. This is one of the most artistic and difficult marking techniques, requiring steady hands and significant practice.

  Detection. Extremely difficult to detect. Requires side-by-side comparison with fresh cards under magnification. Look for lines that appear slightly longer, thicker, or curved differently than the original design. The marks must be read close-up.

  Countermeasures. Use cards with minimal line work in the back design. Frequent deck replacement. Close visual inspection of decks in high-stakes games.

  Target: Poker, high-stakes private games

• Card Marking · Professional

  Scratch Work

  Scratch work involves using a sharp needle or similar instrument to scratch or etch fine lines into the card back design. Unlike cut-out work which removes larger printed areas, scratch work creates hair-thin lines that follow or extend existing design elements. The scratches may be visible when viewed at the correct angle in the right light. This technique requires exceptional precision and skill.

  Detection. Inspect cards under raking light (light at an angle) which makes scratches more visible. Magnification essential. Feel for raised edges along scratch lines. Riffle testing.

  Countermeasures. Use plastic cards which are more resistant to scratching. Laminated card surfaces. Regular deck changes. Visual inspections.

  Target: Poker, private games

• Card Marking · Intermediate to Professional

  Luminous Marking (Invisible Ink)

  Luminous marking uses special inks that are invisible to the naked eye under normal lighting but become visible when viewed through filtered lenses or special lighting conditions. Original systems used red-tinted lenses with greenish ink on red-backed cards. Modern systems use chemicals that respond to specific wavelengths of light, including UV and IR. The marks are applied to card backs before play, typically in patterns that indicate rank and suit. The cheater wears special contact lenses or glasses with the appropriate filter to read the marks.

  Detection. Use UV lights (black lights) to check for fluorescent markings - though modern luminous inks may not respond to UV. Use the Spectrum Vision SV-1 device which cycles through multiple light frequencies to detect various marking substances. Watch for players wearing tinted glasses or contact lenses unnecessarily. Modern clear IR-filtering contact lenses are virtually undetectable visually. Surveillance cameras with IR capabilities can sometimes detect luminous marks.

  Countermeasures. Use cards manufactured with security features that resist marking. Keep cards in secure storage until use. Never allow players to bring their own cards. Inspect cards under various light conditions. The Spectrum Vision SV-1 can detect most known luminous marking substances. Train staff to recognize that modern “clear” IR lenses are virtually undetectable by eye.

  Target: Poker, Blackjack, Baccarat, virtually all card games

• Card Marking / Electronic Aid · Professional

  Video-Luminous Marking

  Video-luminous cards use marks that cannot be seen by the human eye even through luminous filters. The marks can only be read by custom-designed electronic devices with special filters, with the information displayed on a TV monitor in another room to a confederate partner. The marks are typically applied to card edges or backs using specialized chemicals. The partner then signals or transmits card values to the player who needs to know. This system is nearly undetectable during gameplay since the marks are invisible to all human observers.

  Detection. Extremely difficult to detect through visual inspection alone since marks are invisible to human eyes. Watch for players with unusual electronic devices near the table. Monitor for signals between players and off-site locations. Check for radio transmissions. Examine cards with specialized electronic detection equipment. Watch for consistent “lucky” plays that suggest inside information.

  Countermeasures. Use new, sealed decks from reputable manufacturers. Maintain strict control over cards at all times. Electronic sweeps for unauthorized transmissions. Monitor for concealed cameras that might be reading marks. Restrict electronic devices in gaming areas.

  Target: Poker tournaments, high-stakes games, games with private viewing areas

• Card Marking · Amateur to Intermediate

  Edge Marking

  Edge marking involves making small marks on the edges of cards rather than the backs. These marks can be felt by the cheater’s fingers when riffling through the deck, or seen when cards are held at certain angles. Common techniques include small nicks, scratches, or color dots applied to one or more edges. Different positions and combinations of marks indicate different card values. This technique is often used in combination with other marking methods.

  Detection. Inspect card edges under magnification. Feel for irregularities on card edges. Look for small color marks or missing material on edges. Riffle cards and watch for marks that become visible during motion.

  Countermeasures. Use cards with colored edges (bee-style borders) that make edge marks more obvious. Regular deck changes. Visual edge inspection. Dealers should handle cards to feel for irregularities.

  Target: Poker, Blackjack, any game where the cheater handles the deck

• Card Marking · Amateur to Intermediate

  Pin Pricking / Blisters

  Pin pricking involves using a sharp pin or needle to create tiny raised bumps (called “blisters”) on the surface of the card. These bumps can be felt by the cheater’s fingertips and resemble Braille script. Different patterns and positions of blisters indicate different card values. This technique is completely invisible to the eye and can only be detected by touch. The cheater reads the marks while handling or dealing the cards.

  Detection. Feel cards for raised bumps or irregularities. Inspect under magnification for tiny pin holes. Riffle test - marked cards may create a different sound. Watch for dealers or players who excessively feel the cards.

  Countermeasures. Use thicker card stock that resists pin pricking. Regular deck changes. Train dealers to notice cards that feel different. Visual and tactile inspection of decks.

  Target: Poker, Blackjack, any card game

• Card Marking · Amateur

  Crimping and Bending

  Crimping involves intentionally bending or creasing specific cards so they can be identified by feel or sight. Common techniques include corner crimps (bending a corner up or down), center bends (creating a slight bow in the card), or edge curls. The crimped cards can be identified by the cheater during shuffling, dealing, or when cards lie on the table. In Blackjack, aces and ten-value cards are typically targeted. In Poker, the cheater might crimp cards they want to track.

  Detection. Examine cards for visible bends or creases. Feel for cards that don’t lie flat. Look for players who deliberately bend cards while looking at them. Watch for dealers who handle cards in a way that creates bends. Riffle test will often reveal crimped cards.

  Countermeasures. Use pre-shuffled decks from sealed packages. Train dealers to replace any bent or damaged cards immediately. Use cards designed to resist permanent bending (plastic cards). Inspect cards regularly.

  Target: Blackjack, Poker, Baccarat

• Card Marking · Amateur to Intermediate

  Corner Marking / Nail Nicking

  Corner marking (also called “nail nicking”) involves using a sharpened thumbnail or small blade to create small nicks or cuts on the corners or edges of cards. The cheater grows their nails long and strong enough to perforate coated card stock. Different patterns of nicks indicate different values - a nick on the top vs. side, two nicks together, a nick on the corner, etc. Advanced nicking involves “localizing” marks so they can be read whether the card is right-side up or upside down. The marks can also be made on poor cards to identify when opponents are bluffing.

  Detection. Inspect card corners and edges under magnification. Feel for rough edges or missing material. Look for cards with consistent patterns of damage on specific ranks. Riffle test to hear differences.

  Countermeasures. Use plastic cards which resist nicking. Regular deck changes. Inspect card edges. Watch for players with unusually long thumbnails. Train dealers to watch for cards being handled roughly at the edges.

  Target: Poker, private games

• Card Marking · Professional

  Flash Marking

  Flash is an inverted marking strategy that deceive those who know how to read standard luminous or juice marks. Instead of reading the darker marks left by the marking solution, the cheater reads the AREAS THAT WERE NOT MARKED. When using “juice for blue cards,” Flash creates lighter areas on blue-backed cards rather than darker ones. Most people trained to detect marking look for darker “shade” patterns, not lighter “flash” patterns. This technique is particularly effective for deceiving casino inspectors and surveillance personnel who have been trained to look for traditional dark marks.

  Detection. Train staff to look for BOTH darker AND lighter anomalies on card backs. Use multiple detection methods including different light frequencies. Compare suspected cards against fresh cards. The Spectrum Vision SV-1 can detect flash marks by cycling through different wavelengths.

  Countermeasures. Use cards with back designs that make both dark and light anomalies obvious. Regular inspection with multi-wavelength detection equipment. Frequent deck changes.

  Target: Poker, Blackjack, primarily blue-backed card games

• Card Marking / Electronic Aid · Professional

  Infrared (IR) Marked Cards with Contact Lenses

  This system combines cards marked with invisible infrared-reactive ink and special contact lenses that filter light to reveal the markings. The ink markings are completely invisible to the naked eye and undetectable by UV light. The contact lenses contain IR filters that make the markings visible to the wearer. Modern IR contact lenses are clear (not dark) and virtually undetectable - previous generations had a dark, “Orphan Annie” appearance. The cheater can read marked cards from normal playing distances without any visible equipment.

  Detection. Modern clear IR lenses are virtually impossible to detect visually. Watch for players who consistently make unusual plays suggesting card knowledge. Monitor for suspicious behavior patterns. Use IR-capable surveillance cameras to check for IR-reactive marks on cards. The Spectrum Vision SV-1 can detect IR-reactive marking substances. Look for players who seem to be reading card backs.

  Countermeasures. Secure storage of all card decks. Never allow outside cards. Use cards with anti-marking security features. Implement frequent deck changes. Electronic sweeps for IR activity. Use surveillance systems with IR detection capabilities. Train staff that modern IR lenses appear clear, not dark.

  Target: Poker, Blackjack, Baccarat, all card games

• Card Marking / Electronic Aid · Professional

  Barcode Marked Cards with Poker Analyzer

  Barcode marked cards have invisible barcodes printed on all four edges. These barcodes are undetectable to the naked eye and cannot be read with IR contact lenses or sunglasses. A “poker analyzer” device (disguised as a smartphone) with a built-in camera scans the barcodes, processes the information, and announces results via a hidden Bluetooth earpiece. The analyzer determines the winning hand, calculates odds, and can predict outcomes within 0.5 seconds. External cameras hidden in everyday objects (watches, buttons, car keys, power banks) can extend the scanning range from 30cm to over 5 meters.

  Detection. Watch for players who seem to have pre-knowledge of outcomes. Check for Bluetooth earpieces (may require electronic sweeps). Look for disguised electronic devices on or near the table. Inspect cards for barcode patterns under magnification with special lighting. Watch for players placing phones or devices at specific angles to the cards. Monitor for players who seem to be receiving information.

  Countermeasures. Strict no-electronics policy at tables. Electronic frequency sweeps. Inspect cards for edge markings. Require players to keep phones away from tables. Train staff to recognize common concealment devices (watches, power banks with cameras). Use secure, casino-controlled cards only. RF detection equipment.

  Target: Texas Hold’em Poker, Omaha, Baccarat, Blackjack

• Card Marking · Professional

  Light-Reflective Chemical Daubs

  This advanced marking technique uses chemicals that are only visible when exposed to a specific wavelength of invisible light. The cheater applies a light-reflective chemical daub to card backs during play, then uses contact lenses with a special light filter to view the markings. The contact lenses appear as normal reading glasses with clear lenses. The invisible light source bounces off the marked card back and is filtered by the lenses, making the mark visible to the cheater. This system is extremely difficult to detect because the marking chemical is invisible under normal and UV light.

  Detection. Use the Spectrum Vision SV-1 which cycles through multiple light frequencies including IR ranges. Watch for players wearing clear glasses that might have special filters. Look for players who seem to shine or direct light toward cards. Monitor for consistent winning patterns suggesting marked card knowledge.

  Countermeasures. Multi-frequency card inspection equipment. Frequent deck changes. Secure card storage. Electronic sweeps. Train staff on evolving marking chemical technology.

  Target: All card games

• Card Marking / Sleight of Hand Tool · Professional

  Card Punch / Embossing

  A card punch is a small tool that creates a tiny raised bump (hump) on the surface of a card, usually on the face side. The bump can be felt by a dealer’s fingers, allowing them to identify specific cards (typically aces and face cards) while dealing. When the dealer feels the bump, they can execute a second deal to keep the card for themselves or send it to a confederate. The punch creates a small but detectable physical deformation in the card.

  Detection. Feel cards for raised bumps or deformations. Visual inspection may show tiny indentations on the opposite side. Riffle test - punched cards create different sounds. Watch for dealers who excessively feel the cards while dealing.

  Countermeasures. Regular deck changes. Tactile inspection of cards. Train floor supervisors to watch for dealers who seem to be reading cards by touch. Use new decks from sealed packages.

  Target: Blackjack, Poker (primarily used by cheating dealers)

• Sleight of Hand · Professional

  Second Dealing (Dealing Seconds)

  Second dealing is a technique where the dealer pushes the top card slightly forward with their thumb, deals the SECOND card from the deck instead, while simultaneously returning the top card to its original position. This creates the illusion that the top card was dealt normally. The desired card remains on top for the dealer or their confederate. This technique requires precise timing and finger control. A skilled second dealer can execute this move repeatedly without detection. The move is often combined with culling (gathering desired cards to the top) to set up the deal.

  Detection. Listen for irregular dealing sounds. Watch for the top card being pushed forward and then retreating. Look for unusual thumb movements. A well-executed second deal is nearly impossible to detect visually. The top card may appear to “wiggle” slightly. Poorly executed second deals create a snapping sound or visible card movement.

  Countermeasures. Use dealing shoes which make second dealing extremely difficult. Require dealers to deal from shoes rather than by hand. Use automatic shufflers. Train surveillance to watch for suspicious dealing patterns. Deal from the bottom of the shoe when possible.

  Target: Poker, Blackjack, any dealt card game

• Sleight of Hand · Professional

  Bottom Dealing

  Bottom dealing involves dealing cards from the BOTTOM of the deck while creating the illusion that cards are being dealt from the top. The dealer holds the deck and uses their fingers to secretly pull the bottom card out and deal it, while the top card remains in place. This allows the dealer to maintain a “stock” of desired cards on top of the deck for themselves or a confederate. Unlike the second deal which only controls one card, bottom dealing allows control of an entire stack. Done fluidly, an accomplished mechanic can deal from the bottom in a way that truly appears normal.

  Detection. Listen for a snapping sound (poorly executed bottom deals). Watch for bottom cards wedging out to the side. Look for unusual finger positions under the deck. The deal may appear slightly different in rhythm. A well-executed bottom deal is extremely difficult to detect. Place 1-2 Jokers at the bottom of the deck - a bottom dealer will reveal themselves by dealing the Jokers.

  Countermeasures. Use dealing shoes. Use automatic shufflers. Require specific dealing procedures. Deal from the shoe rather than by hand. Train surveillance to watch for unusual dealing styles.

  Target: Poker, Blackjack, private games

• Sleight of Hand · Professional

  False Shuffle - Zarrow Shuffle

  The Zarrow shuffle (also called the “full-deck false shuffle”) is a technique that perfectly mimics a legitimate tabled riffle shuffle while actually maintaining the entire deck in its original order. Invented by Herb Zarrow in 1957, it is considered the most deceptive false shuffle ever created. The dealer appears to split the deck, riffle the two halves together, and square the deck - but the original order is completely preserved. The shuffle is undetectable to casual observers and even many experienced players. Multiple Zarrow shuffles can be performed in sequence while maintaining complete deck control.

  Detection. Extremely difficult to detect visually. Watch for dealers who are “too smooth” with their shuffles. Look for consistent dealing patterns after shuffling. Monitor win rates - players winning at statistically impossible rates may indicate false shuffling. Use automatic shufflers to eliminate the possibility entirely.

  Countermeasures. Use automatic shufflers. Require a “scarne cut” (cutting the deck after the shuffle in a way that cannot be false-cut). Have floor supervisors verify shuffling. Use procedures that require multiple shuffles from different people. Eliminate hand shuffling where possible.

  Target: Poker, Blackjack, any card game

• Sleight of Hand · Professional

  False Shuffle - Push-Through Shuffle

  The push-through shuffle is another false riffle shuffle that appears legitimate but maintains card order. Unlike the Zarrow, in this technique the cards ARE interweaved during the riffle, but blocks of cards are then secretly pushed through each other to restore the original order. The dealer can pause mid-shuffle to seemingly “prove” the cards are intermixed, then complete the move to restore the stack. Testing has shown that many observers actually find the push-through MORE convincing than the Zarrow because of this “proof” moment.

  Detection. Same as Zarrow detection - extremely difficult. Watch for the brief pause during shuffling. Monitor for dealers who seem to handle cards with unusual dexterity. Track dealing patterns after shuffles. Use automatic shufflers.

  Countermeasures. Same as Zarrow - automatic shufflers eliminate the threat. Require proper cutting procedures. Multi-person shuffle protocols.

  Target: Poker, Blackjack, any card game

• Sleight of Hand · Intermediate to Professional

  False Cut

  A false cut makes it appear that the deck has been cut (split and restacked) while actually preserving the original card order. There are many variations: two-stage, three-stage, four-stage cuts, performed with one hand, two hands, or three hands. The more stages, the more skilled the technique. The false cut is often used AFTER a false shuffle to further convince observers that the deck has been randomized. Since cutting is a normal procedure after shuffling, it draws no suspicion.

  Detection. Watch for cuts that appear overly complex or theatrical. Look for precise finger positions that might indicate a false cut. Monitor whether the same cards appear after cutting. Use the “scarne cut” procedure which prevents false cutting.

  Countermeasures. Implement the scarne cut (a specific cutting technique that cannot be false-cut). Require players to cut using specific procedures. Use automatic shufflers that eliminate the need for cutting. Have floor personnel oversee the cut.

  Target: All card games

• Sleight of Hand · Professional

  Card Palming

  Card palming is the technique of secretly holding a card (or multiple cards) in the palm of the hand, hidden from view. The palmist can then introduce the palmed card into play at an advantageous moment or remove a valuable card from the game. Palming requires specific hand positioning to make the card appear to disappear. Professional card mechanics can palm multiple cards simultaneously. The technique is used in conjunction with mucking (switching) to improve one’s hand.

  Detection. Watch for unnatural hand positions. Look for hands that seem stiff or held awkwardly. Monitor for cards that seem to appear or disappear unexpectedly. Watch for excessive hand movement under the table. Look for players who frequently touch their lap, pockets, or clothing.

  Countermeasures. Require players to keep hands visible at all times. No hands below the table. Use table designs that make palming more difficult. Train dealers to watch for suspicious hand movements. Good lighting at all tables.

  Target: Poker, Blackjack, private games

• Sleight of Hand · Professional

  Mucking (Card Switching)

  Mucking is the practice of secretly switching cards to improve one’s hand. A “hand mucker” specializes in hiding cards (using palming or concealment techniques) and then swapping them with cards from their hand or the table. In the 18th and 19th centuries, cheaters used elaborate mechanical holdout devices hidden under clothing or attached to the table. Modern muckers typically use sleight of hand. Common techniques include switching a hole card, replacing a folded hand with better cards, or introducing pre-hidden cards into play.

  Detection. Watch for players who seem to have too many or too few cards. Monitor for cards that appear different from the deck in use. Look for unusual hand movements under or near the table. Watch for players who touch their clothing, lap, or pockets during play. Check for players sitting close together who might pass cards.

  Countermeasures. Require all cards to remain on the table. No cards in laps or hands below table level. Use standard decks with distinct back designs. Count cards periodically. Good overhead surveillance angles. Train dealers to watch for card switching.

  Target: Poker (especially draw and stud variants), Blackjack

• Sleight of Hand · Professional

  Culling

  Culling is the technique of secretly gathering desired cards to specific positions in the deck (typically the top or bottom) while appearing to handle the cards normally. The cheater goes through the deck and maneuvers target cards to a controllable position through subtle finger movements. Once the desired cards are positioned, the cheater can then use false shuffling to maintain their position, followed by false dealing (second or bottom dealing) to deliver them where wanted. The Stevens cull is considered one of the most advanced techniques - it allows controlling any desired cards from a borrowed, shuffled deck without ever spreading the cards face up.

  Detection. Watch for players who seem overly focused on card handling. Look for subtle finger movements while spreading or handling cards. Monitor for cards that mysteriously end up in favorable positions. Watch for unusual card handling patterns.

  Countermeasures. Minimize opportunities for players to handle the deck. Use automatic shufflers. Have dealers handle all card movements. Use procedures that prevent unnecessary card touching.

  Target: Poker, Blackjack, any card game

• Sleight of Hand · Professional

  Stacking the Deck / Riffle Stacking

  Stacking the deck (also called “riffle stacking”) is the technique of placing cards into a predetermined, favorable order through what appears to be a normal riffle shuffle. The cheater uses precise control during the shuffling process to interleave specific cards in a predetermined sequence. This allows the cheater to set up winning hands for themselves or confederates. The technique requires exceptional skill - the cheater must control the exact position of multiple cards through a seemingly random shuffle. Combined with false cutting, a skilled stacker can deal winning hands at will.

  Detection. Monitor for statistically impossible winning patterns. Watch for dealers who seem to win or deal winning hands to specific players with unusual frequency. Review surveillance footage of shuffling. Compare actual shuffle technique to proper procedures.

  Countermeasures. Use automatic shufflers. Require specific shuffle procedures. Have multiple people verify shuffles. Use procedures that include stripping the deck. Randomly inspect shuffled decks.

  Target: Poker, Blackjack, any card game

• Sleight of Hand / Cheating Device · Intermediate

  Shiner (Mirror Device)

  A shiner (also called a “glim” or “light”) is a small concealed mirror used to see card faces that would otherwise be hidden. The cheater places the mirror in a position to reflect card values - hidden in the palm, behind a chip stack, inside a cigarette pack, attached to a coin, or even concealed in a toothpick. When dealing or handling cards, the mirror reflects the card indices to the cheater, allowing them to see cards they shouldn’t be able to see. Shiners have been made in countless forms, from simple flat mirrors to elaborate mechanical devices.

  Detection. Watch for players who position unusual objects near their cards. Look for reflective surfaces on the table. Monitor for players holding objects at odd angles. Check for mirrors concealed in chips, coins, or personal items. Watch for players who seem to know hidden card values.

  Countermeasures. Enforce clean table policies - only chips and cards on the table. No unnecessary objects near the playing area. Good overhead lighting eliminates shadows that help conceal shiners. Watch for players with unusual personal items.

  Target: Poker, private games

• Electronic Aid · Professional

  Poker Analyzer System (Complete Package)

  A complete poker analyzer system consists of four components: (1) Barcode-marked cards with invisible ink markings on all four edges; (2) A poker analyzer device disguised as a smartphone with built-in scanning camera; (3) A wireless Bluetooth earpiece to receive audio results; (4) An optional external camera hidden in everyday objects. The system works by: the camera scans the barcode-marked cards, the analyzer processes the data in under 0.5 seconds, and a computer-generated voice announces the winning hand to the earpiece. The analyzer can predict winners, calculate odds, and work across multiple poker variants. Modern systems look and function as regular smartphones to avoid suspicion.

  Detection. Electronic frequency sweeps for Bluetooth signals. Watch for players who place phones at precise angles to cards. Look for suspicious earpieces (modern ones are extremely small). Check for external cameras disguised as watches, power banks, buttons, or car keys. Monitor for players who seem to have impossible knowledge of outcomes. Inspect cards for edge barcode patterns under special lighting.

  Countermeasures. Strict no-electronics policy at tables. RF detection sweeps. Use casino-controlled, sealed decks only. Prohibit phones and devices at or near the table. Train staff to recognize analyzer devices (they look like regular phones but may have unusual camera placement).

  Target: Texas Hold’em, Omaha, Baccarat, Blackjack

• Electronic Aid · Professional

  Hidden Camera Card Scanning

  Modern hidden cameras for card cheating have become miniaturized and are concealed in everyday objects. Common concealments include: power banks, watches, buttons on shirts, car keys, lighters, cigarette packs, and t-shirts with pinhole cameras. These cameras capture images of cards as they are dealt or rest on the table, and transmit the images to a remote accomplice or AI system. In a 2024 French casino case, cheaters used modified smartphone cameras with mirrors to capture lateral footage while phones lay flat on the table. The images are transmitted via WiFi or cellular to an off-site location where an accomplice analyzes the footage.

  Detection. Watch for players placing electronic devices on the table. Check for unusual objects positioned to face cards. Electronic sweeps for WiFi/cellular transmissions. Look for clothing modifications (tiny holes, unusual buttons). Watch for players who seem to receive information from outside sources. Monitor for power banks or chargers placed at odd angles.

  Countermeasures. Strict no-device policy at tables. Electronic signal sweeps. Train staff to recognize common camera concealments. Watch for players who place objects strategically. Secure casino WiFi to prevent unauthorized transmissions. Use shielding in table designs to block signals.

  Target: Poker, Blackjack, Baccarat, any card game

• Electronic Aid · Professional

  Infrared Camera Systems

  Infrared camera systems are used to read cards marked with invisible IR-reactive ink. These cameras can be: (a) Hidden in everyday objects and pointed at marked cards; (b) Fixed in the environment (ceiling lamps, clocks, smoke detectors); (c) Built into the poker analyzer system as external scanning cameras. The IR camera captures images of the markings invisible to the human eye and transmits them to a processing unit. The system can read cards from distances ranging from 30cm to over 5 meters depending on the setup. Team-based operations often use ceiling-mounted IR cameras to scan the entire table.

  Detection. Electronic sweeps for IR signals. Watch for cameras disguised as ceiling fixtures or environmental objects. Check for IR light sources (may be visible through smartphone cameras). Inspect cards for IR-reactive markings. Monitor for coordinated team play suggesting shared information.

  Countermeasures. Control all environmental fixtures in gaming areas. Regular inspections of ceiling and fixtures. Use cards with anti-IR-marking security features. Electronic detection equipment. Monitor for unusual electronic activity.

  Target: Poker, Baccarat, any game using IR-marked cards

• Electronic Aid · Amateur to Intermediate

  Smartphone Card Counting Apps

  Various smartphone applications have been developed to assist in card counting and advantage play. These apps range from: (a) Card counting trainers that track the running count; (b) Apps that connect to smartwatches for stealth counting; (c) Apps that calculate optimal betting and playing decisions; (d) Baccarat side bet calculators that track deck depletion and calculate shifting probabilities. Many apps offer “stealth mode” where the screen appears black/off while the app continues running, with vibration alerts for favorable counts. Some newer apps integrate with hidden cameras to automatically detect cards.

  Detection. Watch for players using phones while playing. Look for players who tap their phone screens frequently (even with black screens). Monitor for Bluetooth connections to smartwatches. Check for earpieces connected to phones. Watch for players who place bets only at specific times suggesting count-based decisions.

  Countermeasures. Prohibit phone use at table games. No electronic devices at the table. RF sweeps for Bluetooth signals. Train dealers to ask players to put phones away. Watch for smartwatch use.

  Target: Blackjack, Baccarat

• Electronic Aid · Intermediate

  Smartwatch with Concealed Camera

  Smartwatches with built-in cameras (such as certain Samsung Gear models) can be used to secretly photograph or video cards during play. The watch is worn on the wrist in a natural position that can be angled toward cards. The cheater can capture images of their own cards, community cards, or even the dealer’s hole card. The footage can be transmitted to an accomplice or analyzed later. Some models can stream video in real-time. The camera lens is typically small and located on the watch rim or strap.

  Detection. Look for smartwatch cameras on the watch rim or strap. Watch for players angling their wrists toward cards. Check for excessive watch-adjusting. Monitor for players who seem to be looking at their watch frequently during play. Watch for large bets that correlate with favorable card situations.

  Countermeasures. Ban all smartwatches with cameras from the gaming floor. Post clear policies. Train staff to identify which smartwatch models have cameras. Ask players to remove smartwatches before playing. Include smartwatch prohibitions in house rules.

  Target: Poker, Blackjack, all card games

• Electronic Aid · Professional

  X-Ray Poker Table

  An X-ray poker table uses concealed X-ray technology to read cards that are face-down on the table surface. The table is modified with hidden X-ray sensors that can penetrate the card backs and reveal the face values. This technology allows the operator to see all hole cards and community cards before they are revealed. The information is typically transmitted to a remote location or displayed on a hidden screen. X-ray tables are custom-built and extremely expensive, often costing $100,000 or more. They are primarily used in underground or private games rather than licensed casinos.

  Detection. This is primarily a threat in underground/private games, not licensed casinos. In regulated environments, tables are standardized and inspected. Watch for custom-built or unusual tables in private game settings. Electronic sweeps for unusual radiation or signals.

  Countermeasures. Only use approved, standardized gaming tables. Inspect all gaming equipment. In licensed casinos, tables undergo rigorous certification. Be cautious of private games with custom equipment.

  Target: Underground poker games, private high-stakes games

• Electronic Aid · Professional

  Concealed Streaming Cameras with Remote Analysis

  This modern technique involves using a concealed camera at the table to stream the game to a remote accomplice who analyzes the video and provides guidance to the player. The camera may be hidden in a phone, clothing, or other objects. The accomplice watches the stream and uses their expertise to identify dealer cards, calculate odds, or spot opportunities. They communicate back to the player via a tiny hidden earpiece or vibration device. In a 2025 Sydney case, a couple used a concealed camera on a phone placed on the table, then later a pinhole camera in a t-shirt, to stream the game for analysis.

  Detection. Watch for electronic devices placed on the table. Check for clothing modifications. Electronic sweeps for WiFi/cellular transmissions. Look for miniature earpieces (some require magnets to remove). Monitor for players who seem to be receiving instructions. Watch for players making unusual plays that suggest outside guidance.

  Countermeasures. No-device policy at tables. Electronic signal sweeps. Secure WiFi networks. Train staff to recognize earpiece concealment. Watch for coordinated play patterns. Check for clothing modifications.

  Target: Blackjack, Poker, Mississippi Stud, Ultimate Texas Hold’em

• Electronic Aid · Professional

  AI-Assisted Computer Vision Cheating

  An emerging threat involves using AI-powered computer vision to automatically identify cards and transmit information to players. The system uses a hidden camera to capture the game, AI software to identify all card values in real-time, and automatically sends audio messages to the player’s earpiece with playing recommendations. This eliminates the need for a human accomplice. The AI can freeze frames, digitally enhance images, and identify cards even in suboptimal conditions. With streaming apps, the entire operation can run remotely.

  Detection. Same as other electronic device detection. Watch for players with unusual electronic setups. Electronic sweeps. Monitor for Bluetooth/cellular transmissions. Look for camera concealments. Watch for perfect play that suggests computational assistance.

  Countermeasures. Comprehensive electronic device prohibition. RF sweeps. Secure networks. AI-resistant table designs. Good lighting to prevent shadows that assist camera capture. Train staff on emerging technology threats.

  Target: All card games

• Dealer Collusion · Professional

  Dealer Flashing (Intentional Hole Card Exposure)

  Flashing occurs when a dealer intentionally exposes their hole card (or upcoming cards) to a confederate player. The dealer uses subtle techniques: pushing the top card slightly off the deck so the index is visible between fingers; lifting cards at an angle that reveals values; dealing from a position that exposes cards beneath those being dealt. The confederate (“takeoff man”) uses this information to make optimal bets and plays. A skilled flasher only needs to expose a sliver of the card’s edge for the confederate to identify the value. The flash can be directed to different players at the table to further conceal the action.

  Detection. Extremely difficult to detect from overhead surveillance. Look for dealer hand positions that might expose cards. Monitor for players making consistently optimal decisions that suggest card knowledge. Watch for dealer-player patterns where specific players win more often. Check for dealers who handle cards in unusual ways. Review footage for dealer hand positions that could expose card indices. Look for information bouncing - one player receives the flash and signals another.

  Countermeasures. Use electronic peeker devices (like Tech-Art peekers) that eliminate the need for dealers to manually check hole cards. Train dealers in proper card-handling procedures that prevent exposure. Use dealing shoes. Monitor dealer technique via surveillance. Rotate dealers frequently. Watch for dealers who develop relationships with specific players.

  Target: Blackjack, any game with hole cards

• Advantage Play / Dealer Exploitation · Intermediate

  Hole Carding / First Basing / Spooking

  Hole carding is the technique of trying to see the dealer’s hole card when they check for blackjack. “First basing” involves sitting in the first base position and peeking at the hole card when the dealer lifts it to check. “Spooking” involves a partner positioned away from the table (sometimes behind the dealer) who can see the hole card and signals the information to the player. “Front-loading” involves observing the hole card as it is slid under the upcard. These techniques take advantage of sloppy dealer technique in checking or placing hole cards.

  Detection. Watch for players sitting in specific positions who seem to make unusual plays. Monitor for players slouching or positioning themselves to see dealer cards. Look for signaling between players at different positions. Watch for betting patterns that correlate with suspected hole card information. Check for players standing behind the dealer.

  Countermeasures. Use electronic peeker devices (red/green light systems) instead of manual hole card checks. Train dealers in proper card placement and checking procedures. Use card readers that don’t require lifting cards. Position shoes and equipment to minimize exposure. Train dealers to shield hole cards effectively.

  Target: Blackjack

• Dealer Collusion · Intermediate to Professional

  Dealer-Player Signaling Systems

  This encompasses various covert communication methods between a dishonest dealer and confederate player(s). Signals can include: verbal cues disguised as casual conversation; physical gestures (touching face, adjusting chips, specific betting patterns); timing signals (delaying action, speed of deal); chip placement signals. The Tran Organization used wireless microphones and earpieces for communication. In the 2025 NBA poker scandal, conspirators used physical signals: touching a $1,000 chip meant a specific player had the best hand; touching black chips meant the “fish” had the best hand and insiders should fold.

  Detection. Watch for consistent patterns of communication between dealers and players. Look for unusual timing in dealing or betting. Monitor for repeated physical gestures that correlate with game events. Check for electronic devices (earpieces, microphones). Watch for dealers who seem to be communicating non-verbally. Review footage for patterns.

  Countermeasures. Rotate dealers frequently. Monitor dealer-player relationships. Watch for unusual familiarity. Electronic sweeps for listening devices. Train dealers to avoid establishing relationships with players. Enforce professional boundaries.

  Target: All card games

• Advantage Play / Card Exploitation · Professional

  Edge Sorting (Advantage Play / Cheating)

  Edge sorting exploits manufacturing defects in playing cards - specifically, the fact that many decks have slightly asymmetrical back patterns. When a card is rotated 180 degrees, the asymmetry makes it distinguishable from cards oriented the other way. The player asks the dealer to rotate certain cards (usually high-value cards like 7s, 8s, 9s) under the guise of superstition or luck rituals. After the shoe is played through, all high cards are oriented one way and low cards the other. An automatic shuffler preserves these orientations. The player can then identify whether face-down cards are high or low by their edge patterns, gaining a 5-6% edge.

  Detection. Watch for players making unusual requests to rotate cards. Monitor for requests to use specific card brands or automatic shufflers. Look for players who seem to be studying card backs. Watch for high rollers making strange “superstitious” requests about card handling. Check if players ask for the same decks to be reused. Monitor betting patterns that correlate with card rotation knowledge.

  Countermeasures. Use cards with perfectly symmetrical back designs. Rotate (turn) cards during the shuffle process. Refuse player requests to manipulate card orientation. Use cards specifically designed to prevent edge sorting. Train dealers to politely decline requests to rotate cards. Implement procedures that randomize card orientation between shoes.

  Target: Baccarat (primary target), some Blackjack variants

• Electronic Aid / Team Play · Professional

  Earpiece Communication with Off-Site Analyst

  Modern cheating teams use miniature earpieces (some requiring magnets to remove) to receive instructions from an off-site accomplice who analyzes the game via concealed camera feed. The earpiece receives audio via Bluetooth or inductive coupling. The accomplice may be in a nearby vehicle, hotel room, or even another country using streaming technology. The earpieces are so small they are invisible to casual observation. Some models are designed to be inserted deep into the ear canal and can only be removed with a magnetic tool.

  Detection. Watch for players who seem to be listening intently or reacting to unheard instructions. Look for tiny wires or devices near the ear. Electronic sweeps for Bluetooth signals. Check for inductive loops worn around the neck. Watch for consistent eye movements suggesting someone is receiving audio instructions. Some earpieces may be visible as small dots in the ear canal.

  Countermeasures. Electronic signal sweeps. RF detection. Train staff to look for earpiece concealment. Watch for players who seem to be receiving information. Check for neck loops or other inductive equipment. Some detection devices can identify active earpieces.

  Target: All card games

• Past Posting · Amateur / Intermediate

  Scam #1: Classic Past Posting (Late Betting)

  The cheater places or adds chips to a winning number AFTER the ball has already dropped into the pocket and the outcome is known. Typically executed by a team of two or more: one player distracts the dealer (by asking a question, spilling a drink, or creating a commotion) while a second player quickly places chips on the winning number. In some variations, the cheater uses sleight of hand to slide a chip from a losing position to a nearby winning position. The most vulnerable moment is when the dealer has “tunnel vision” — their head is turned toward the wheel to identify the winning number, leaving the layout temporarily unwatched. Expert past-posters use misdirection and practice the move thousands of times to make it appear fluid and natural.

  Detection. Surveillance should watch for chips appearing on the layout after the ball has dropped. Review tape in slow-motion when suspicious wins occur. Watch for players who lean over the layout at the moment the ball drops. Dealer body language — if a dealer seems startled by a bet size they don’t remember — is a telltale sign. Floor supervisors should verify all large bets after each spin.

  Countermeasures. Train dealers to “walk the game” — move back from the layout toward the wheel as the ball drops so they can see both the wheel and layout simultaneously with peripheral vision. Implement clear “no more bets” procedures well before the ball drops. Wave off all bets before the ball reaches the deflectors. Use overhead cameras with full layout coverage. Modern bet-tracking software can flag bets added after the NMB call.

  Target: All roulette variants (American 00, European single-zero, French)

• Past Posting / Chip Capping · Professional

  Scam #2: The Savannah (a.k.a. Capper’s Dream)

  Pioneered by notorious casino cheat Richard Marcus, the Savannah is a brilliantly simple psychological con. The cheater places a legitimate bet on the Columns or Dozens consisting of two or more low-value chips (e.g., red $5 chips) on top of a single high-value chip (e.g., $500 or $1,000 chip) at the bottom of the stack. The chips are carefully angled so the dealer can only see the red chips from their normal standing position. If the bet WINS, the cheater alerts the dealer to the high-value chip underneath, feigning innocence — “Yes, I won!” — and insists the cameras be checked. Since the high-value chip was there from the start, surveillance confirms it was a legitimate bet, and the casino pays out at 2-to-1 on the full amount. If the bet LOSES, an accomplice creates a distraction (spilling a drink, asking a question, feigning an argument), and the cheater quickly pinches the high-value chip from the bottom of the stack, replacing it with another low-value chip, or simply snatching the whole stack away. If caught, the cheater plays drunk and apologetic, claiming an honest mistake.

  Detection. Watch for angled chip stacks where the bottom chip may be hidden. Be alert to players who seem overly eager to point out a “missed” high-value chip on wins. Monitor for the accompanying “drunk act” when losses occur. Look for coordinated team play with a distraction partner. Richard Marcus reportedly stole an estimated £30 million using this and related techniques over two decades.

  Countermeasures. Train dealers to STEP OUT OF THEIR BOX to view all bets from different angles — the ONLY way to see the bottom chip of an angled stack. Verify all multi-chip bets by checking the bottom denomination. Watch for consistent team patterns at the table. Never allow a player to remove their own losing bets before the dealer collects them.

  Target: Primarily American roulette; Columns and Dozens bets

• Past Posting / Collusion · Intermediate / Professional

  Scam #3: Top Hatting (Dealer-Assisted Past Posting)

  Top hatting requires the active collusion of a dishonest dealer. After the winning number is determined, the dealer secretly adds extra chips (the same color as the accomplice’s chips) to the player’s winning bet stack. Unlike player-executed past posting, the dealer’s action is far more difficult to detect because dealers are trusted personnel whose movements are not scrutinized as closely as players’. The dealer may palm an extra chip in their hand and release it onto the winning stack while appearing to perform normal payout procedures. Alternatively, the dealer may pay out more chips than the winning bet warrants, splitting the excess with the accomplice later. The term “top hatting” refers to placing a chip on top of an existing stack — like a hat on a head.

  Detection. Surveillance must count chips in winning stacks before and after dealer interaction. Compare expected payouts to actual payouts. Watch for dealers who consistently handle one player’s bets differently. Monitor dealer hand movements during payouts — any unnatural cupping or sliding motion should be flagged. Track dealer bankroll for unexplained shortages. Review player win rates by dealer for statistical anomalies.

  Countermeasures. Mandatory dual-verification of payouts for bets above a certain threshold. Random chip counts of dealer bankrolls. Rotate dealers frequently (every 20 minutes) to prevent long-term collusion relationships from forming. Install overhead cameras positioned to capture the exact moment of payout. Require floor supervisors to verify all high-value payouts. Implement strict “no player-dealer personal relationships” policies. Background checks and financial monitoring of dealers.

  Target: All roulette variants

• Past Posting · Professional

  Scam #4: The Late Stack Drop (a.k.a. Snap Slide)

  A single cheater or team member places a stack of chips onto the layout just as the ball drops into the winning number. The move is lightning-fast and relies on perfect timing. The cheater watches the ball’s final descent and, at the exact moment the dealer’s attention is on the wheel, slides a pre-prepared stack onto the winning number or adjacent area. In a sophisticated variation, the stack has the high-value chips offset at the bottom, so when the dealer notices the late stack and removes it, the offset high-value chips remain behind — creating a “legitimate” winning bet out of thin air. The dealer, seeing only the removal of the late stack, may not notice the hidden chips left behind.

  Detection. Review surveillance tape frame-by-frame when questionable wins occur. Look for hand movements toward the layout at the moment the ball drops. Check if the dealer’s body language suggests they noticed something unusual — a double-take at a stack, hesitation before paying. Modern AI-powered surveillance can detect motion on the layout after NMB has been called.

  Countermeasures. Train dealers to maintain visual contact with the layout at ALL times during the ball drop — never turn their back completely. The “wave off” procedure: dealers should physically wave their hand over the layout and announce “no more bets” well before the ball reaches the deflectors, then step back to observe both wheel and layout. High-definition cameras with motion-detection analytics covering every inch of the layout.

  Target: All roulette variants; most effective at busy tables

• Past Posting · Intermediate

  Scam #5: The Walter Mitty Shot (Ledge Stack Deception)

  A team of cheaters places a tall stack of chips with a slight overhang or “ledge” over the bottom chip. The bottom chip is a high-value denomination (e.g., $500), while the visible chips above are low-value (e.g., $5). If the bet LOSES, a team member distracts the dealer while the mechanic quickly swaps the entire stack for one composed entirely of low-value chips — effectively pinching the high-value chip. If the bet WINS, they draw attention to the “hidden” high-value chip and demand a full payout, claiming it was there all along. The deception relies on dealers failing to inspect the full stack before sweeping losing bets or before paying winning bets.

  Detection. Watch for unusually tall stacks with possible overhang. Monitor for players drawing attention to specific chips in a manner that seems rehearsed. Flag teams where one member consistently stands near the dealer and engages in distracting conversation.

  Countermeasures. Train dealers to always inspect the bottom chip of any stack before collecting or paying. Dealers should use two hands to lift stacks, allowing visual inspection of the bottom chip. No stack should be accepted or paid without the dealer seeing the base chip.

  Target: All roulette variants; works best with large chip stacks

• Past Posting / Sleight of Hand · Professional

  Scam #6: The Chip Flick Replacement

  A highly skilled mechanic sits at the bottom of the roulette table (the position closest to the columns/dozens area). When a winning number hits in the columns or dozens, the cheater uses a lightning-fast flick of the thumb to knock out the bottom low-value chip from a small stack of $15-$20 on the winning column/dozen. Simultaneously, a high-value chip ($100) is flicked across the apron to replace the displaced chip. The original low-value chip is flicked into the “salad” — the pile of losing chips being swept away — where it disappears among the debris. When the dealer comes to pay the column, the high-value chip is now on the bottom, resulting in a payout many times larger than the original bet warranted.

  Detection. Requires frame-by-frame surveillance review. Look for rapid hand movements near the columns/dozens area at the moment of ball drop. Check if a chip appears to “fly” across the apron. Monitor for players who consistently sit in the same position and make the same bet patterns.

  Countermeasures. Columns and dozens area is the MOST VULNERABLE zone on the layout — dealers must pay extra attention here. Position additional camera coverage focused specifically on this area. Train dealers to take note of bet sizes before spinning and to verify payouts match original bets.

  Target: American/European roulette; Columns and Dozen bets

• Ball Manipulation · Professional

  Scam #7: The Magnetic Roulette Ball (Remote-Controlled Ball)

  This sophisticated cheat involves replacing the casino’s standard roulette ball with a ball containing a magnetic core (often steel or ferromagnetic material). A confederate — either a dishonest dealer who introduces the ball into play, or a player who switches balls during a distraction — places the magnetic ball on the wheel. An accomplice concealed nearby operates a hidden electromagnet or radio-frequency device that can influence the ball’s trajectory as it slows. In one documented variation, a team used a powerful leg-mounted electromagnet (weighing approximately 25 pounds) hidden under baggy pants to pull the ball toward a target sector. The magnet’s polarity could be reversed or pulsed to either attract or repel the ball at critical moments. The scam can achieve approximately 90% accuracy in directing the ball to a target six-number range under ideal conditions.

  Detection. Casino bosses should carry small magnets and periodically test roulette balls for magnetic properties. Watch for balls that exhibit unnatural movement — sticking to the wheel, abrupt changes in trajectory, or unusual bouncing patterns. Monitor for dealers who handle balls suspiciously. Electronic magnetic field detectors can be installed near roulette wheels. Watch for players wearing unusually bulky clothing (to conceal large magnets).

  Countermeasures. Use only non-magnetic roulette balls (ivory, ceramic, or specific non-ferrous materials). Store balls in a secure, monitored location. Require dual-authorization for ball changes. Install magnetic field sensors at roulette tables. Train dealers to never accept a ball from a player — only from the pit boss. Implement ball inspection protocols using magnetic compasses before each shift. Rotate and inspect balls frequently.

  Target: All roulette variants; requires inside access to introduce the ball

• Ball Manipulation · Professional

  Scam #8: Ball Tripping (a.k.a. The Tripper Pin)

  Ball tripping is a mechanical method of prematurely dislodging the roulette ball from its track before it would naturally fall. The scam requires extensive preparation and inside access to the table. The perpetrators drill a tiny, almost invisible hole in the upper ball track (the outer rim where the ball spins). A small, spring-loaded pin is installed just below the surface of the track, connected by hidden wiring to a lever or button under the table’s edge. A dishonest dealer, trained to use the device, pushes the lever at the opportune moment — typically when the ball is passing over the prepared section of the track and the desired target numbers are positioned below. The pin pops up, bumps the ball out of the track, and causes it to fall prematurely onto the wheel head. With practice, the dealer can time the trip to direct the ball toward a target sector with surprising accuracy.

  Detection. Physical inspection of the ball track can reveal the tiny hole. Close examination of ball behavior — if the ball consistently drops from the same section of the track, this is a major red flag. Listen for the slight mechanical sound of the pin activating. Monitor dealers who seem unusually focused on the ball track or who have one hand positioned under the table edge during spins.

  Countermeasures. Regular physical inspection of all roulette wheels, particularly the ball track. Use black light or magnification to check for tampering. Restrict access to gaming equipment to authorized personnel only with dual-control procedures. Monitor maintenance logs for unauthorized access. Install vibration sensors that can detect mechanical interference. Train surveillance to spot balls dropping unnaturally from the track.

  Target: Physical roulette wheels; requires advance access to modify the table

• Ball Manipulation · Professional

  Scam #9: Compressed Air / Pneumatic Ball Disruption

  This method involves installing hidden nozzles or vents around the roulette wheel that can blast precise bursts of compressed air at the ball as it travels along the track or approaches the pockets. The air jets can either deflect the ball away from heavily-bet numbers or push it toward target numbers where confederates have placed bets. The system is controlled remotely via a handheld device or hidden foot pedal. Unlike magnetic methods, this technique leaves no magnetic signature and is harder to detect with standard anti-cheating tools. The air bursts must be carefully calibrated — too weak and they have no effect; too strong and the ball’s movement looks obviously unnatural. Some implementations use electrostatic repulsion rather than air, charging the ball and the target pocket with like charges to repel the ball from unwanted numbers.

  Detection. Listen for hissing sounds or air movement during spins. Watch for balls that suddenly accelerate, decelerate, or change direction in ways that defy gravity and momentum. Check for hidden vents, tubes, or nozzles around the wheel structure. Monitor for unusual wiring or electronic components near the wheel. Electrostatic field detectors can identify charged environments.

  Countermeasures. Regular physical inspection of all roulette equipment including the wheel housing, apron, and surrounding table structure. Seal all openings in the wheel assembly. Use balls with weight and material specifications that resist air current manipulation. Install vibration and air pressure sensors near roulette wheels. Restrict access to wheel maintenance areas.

  Target: Physical roulette wheels; requires pre-installation of equipment

• Ball Manipulation · Intermediate / Professional

  Scam #10: Ball Switching

  The cheater or a confederate dealer replaces the casino’s standard roulette ball with a specially modified ball. The modified ball may contain a magnetic core, electronic components, different weight distribution, or be made of a different material that interacts with the wheel differently (e.g., a softer material that bounces less, or a harder material that skips over certain frets). The switch typically occurs during a distraction — a player may knock their drink over, a confederate may engage the dealer in conversation, or a staged argument may draw attention. In some cases, a dishonest dealer simply palms the original ball and introduces the modified one during a normal ball change procedure, claiming the original was “damaged” or needed replacement. The switch is reversed before the end of the shift to avoid detection during routine inspections.

  Detection. Casinos should weigh and inspect every roulette ball daily — any weight discrepancy indicates a possible switch. Monitor ball behavior characteristics (bounce patterns, deceleration rate) for sudden changes. Watch for dealers who change balls unnecessarily or accept ball change requests from players. Check video footage of any ball changes for suspicious activity. Use a small magnet or compass to test balls periodically.

  Countermeasures. Strict chain-of-custody for all roulette balls. Only pit bosses or authorized supervisors may change balls. Log all ball changes with time, reason, and personnel involved. Store balls in a secure location with access controls. Weigh balls on a calibrated scale before and after each shift. Mark balls with invisible UV markings that are verified under black light. Never allow players to touch or handle roulette balls.

  Target: All physical roulette variants

• Ball Manipulation / Electronic Fraud · Professional (requires manufacturer-level access)

  Scam #11: Ultrasonic / Electrostatic Ball Repulsion (Live Dealer Online Roulette)

  A theoretical and allegedly observed method of manipulating outcomes in live dealer online roulette. According to whistleblower claims, some electronic roulette systems use balls made of piezoelectric ceramic material (such as Barium Titanate). Inter-digital transducers placed in each number pocket emit ultrasonic sound waves that polarize the ball’s surface with a negative charge. The target pockets are left neutral, while unwanted pockets are negatively charged, causing electrostatic repulsion that pushes the ball away from heavily-bet numbers. The system is allegedly managed by sophisticated software that tracks all bets in real-time and activates the appropriate pockets via IGBT transistors. While these claims remain unverified in regulated jurisdictions, they have circulated extensively in online gambling forums and whistleblower reports since the early 2020s.

  Detection. Watch for balls that exhibit unnatural behavior — being “sucked” into a pocket, violently pushed out of a pocket after nearly stopping, or sticking to a number “like a dart.” Analyze ball movement patterns statistically for anomalies. Independent forensic testing of balls and wheel components.

  Countermeasures. Regulators should mandate independent certification and regular physical inspection of all live dealer equipment. Use only balls and wheels from certified manufacturers with full material transparency. Require operators to publish independent RNG and physical testing reports. Install electromagnetic field monitoring around live dealer setups.

  Target: Live dealer online roulette; electronic/automated roulette wheels

• Sector Targeting · Intermediate / Professional

  Scam #12: Visual Ballistics (a.k.a. Eyeballing)

  Visual ballistics is a technique where the player uses their eyesight to predict the likely landing zone of the ball based on observable physics. The player identifies a reference point on the wheel — typically one of the vertical diamonds (deflectors) that the ball hits most frequently. They observe the ball’s speed and the moment it begins its noticeable deceleration. At a predetermined point (e.g., one revolution after the deceleration point), they note the number directly under the reference diamond. By comparing this “reference number” to the actual winning number over 60-100 spins, a pattern of consistent distance (e.g., “the ball lands 9 spaces away from the reference number”) emerges. Once the pattern is established, the player can predict a target sector for future spins and place bets accordingly. This technique does NOT involve electronic devices and is legal in many jurisdictions, though casinos may ban players who use it successfully.

  Detection. Look for players who focus intently on the wheel rather than the layout. Players who consistently bet the same wheel-position sector (rather than layout positions) may be using visual ballistics. Note players who arrive at the table but spend long periods watching without betting, then suddenly place concentrated bets on a specific sector. Statistical analysis may show a player winning at rates significantly above expected house edge.

  Countermeasures. Use wheels with unpredictable ball behavior (Starburst wheels with multiple deflectors). Vary ball types, sizes, and materials regularly. Alternate spin directions every spin. Train dealers to vary ball release speed and technique. Call “no more bets” earlier to reduce the time players have to make predictions. Use automated wheels that randomize spin characteristics.

  Target: All physical roulette variants; works best on wheels with consistent ball behavior

• Sector Targeting · Intermediate

  Scam #13: Dealer Signature Exploitation (a.k.a. Sector Slicing)

  Many roulette dealers develop unconscious, repetitive patterns in how they spin the wheel and release the ball. A dealer signature refers to the tendency of a particular dealer to spin the ball with consistent velocity, release it from the same position, and produce similar results spin after spin. For example, a dealer may consistently release the ball when the zero is at the 3 o’clock position, and the ball may consistently land approximately 24 pockets clockwise from the release point. Exploiting this requires the player to: (1) identify the dealer’s release point, (2) determine the average distance the ball travels from that release point, (3) calculate the target sector based on the release point of the current spin, and (4) place bets quickly before NMB is called. A player who can identify a dealer hitting a 12-pocket grouping more than one-third of the time can gain a significant mathematical edge over the house.

  Detection. Watch for players who seem to time their bets based on the dealer’s ball release rather than placing bets early. Players who consistently bet on numbers in a specific wheel-sector relationship to the release number may be exploiting dealer signature. Statistical analysis of player win rates by dealer can reveal patterns. Players who request specific dealers or tables may be seeking known signatures.

  Countermeasures. Train dealers to alternate spin directions every spin (clockwise, then counter-clockwise ball release). Instruct dealers to vary ball release speed and avoid repetitive patterns. Require dealers to use alternating hands for ball release. Implement automatic wheel speed variation. Rotate dealers every 20 minutes. Use automated ball launchers that randomize release parameters. Call “no more bets” immediately after ball release to minimize prediction time.

  Target: All physical roulette variants; most effective with methodical, experienced dealers

• Sector Targeting · Professional

  Scam #14: Wheel Bias Exploitation (Clocking)

  No roulette wheel is perfectly balanced or manufactured. Over time, wheels develop mechanical biases — certain numbers or sectors hit more frequently than statistical probability would predict. Biases can result from: uneven wheel head weight distribution, worn or loose frets between pockets, a slightly bent spindle causing rotor wobble, worn ball track creating dominant drop zones, uneven floor leveling, pocket manufacturing imperfections, or accumulated dirt and residue affecting ball behavior. The “clocking” method involves recording thousands of spin results on a specific wheel to identify statistically significant biases. Professional teams typically collect at least 400 spins for preliminary analysis and 1,000+ spins for confirmation. If a number and its adjacent neighbors show hit rates significantly above the expected 1-in-38 (American) or 1-in-37 (European), the wheel may be biased. The team then bets exclusively on the biased numbers, gaining a mathematical edge that can exceed the house edge.

  Detection. Watch for players who record spin results on paper, smartphones, or hidden devices. Players who consistently bet the same small set of numbers (especially numbers adjacent on the wheel, not the layout) may have identified a bias. Teams of players all betting the same numbers simultaneously is a major red flag. Statistical monitoring software should flag wheels showing non-random result distributions.

  Countermeasures. Primary defense: Record and analyze all roulette results using software that flags statistical anomalies. Rotate wheels between tables regularly (at least weekly, with 1/8 turn). Move wheels to different pits. Maintain rigorous wheel maintenance schedules — level wheels, replace worn frets, resurface ball tracks. Use modern low-bias wheel designs (Starburst, Cammegh Mercury). Train dealers to vary spin parameters. Some casinos deliberately introduce subtle randomization elements.

  Target: All physical roulette variants; works on both American and European wheels

• Sector Targeting / Electronic Device · Professional

  Scam #15: Roulette Computer / Prediction Device

  A roulette computer is an electronic device that uses physics to predict where the ball will land. The user (or a confederate) clicks a hidden button each time the ball passes a reference point, and again when the wheel passes a reference point. The computer calculates the ball’s velocity, the wheel’s velocity, the rate of deceleration, and uses a physics model to predict the likely landing octant or sector. The prediction is communicated to the bettor via a concealed earpiece, vibrating device, or digital display. Modern roulette computers can be hidden in smartphones (using the camera to track ball and wheel motion), smartwatches, or custom hardware. The device gives the player a substantial edge — potentially 20-40% over the house. In most jurisdictions (including Nevada since 1985, and the UK), using ANY electronic device to predict roulette outcomes is illegal.

  Detection. Watch for players who seem to receive information just before placing bets — touching an ear, looking at a phone at the last second, or making bets with unusual confidence. Two-person teams where one watches the wheel intently and the other places bets may be using a computer. Players who consistently bet late but with high accuracy should be flagged. Watch for hidden button-pressing (toe-tapping, finger movements). Electronic sweeps can detect unauthorized transmission devices.

  Countermeasures. Nevada law (and most jurisdictions) makes possession OR use of any predictive device a felony. Train staff to spot the behavioral tells of device users. Conduct electronic sweeps of the gaming floor. Use automated wheels that close betting immediately after ball release. Install RF signal detectors. Prohibit electronic devices near gaming tables — require phones to be placed in pockets or lockers. Call “no more bets” as early as possible.

  Target: All physical roulette variants

• Sector Targeting / Electronic Device · Professional

  Scam #16: Laser Scanner Prediction System

  A sophisticated evolution of the roulette computer that uses a concealed laser scanner to measure the velocity and deceleration of the ball and wheel. The laser, typically hidden inside a mobile phone or small handheld device, projects an invisible beam that precisely tracks the ball’s position and speed as it travels around the track. The data is fed to an onboard microprocessor that calculates the ball’s likely landing zone using complex physics algorithms. Some systems also track wheel speed simultaneously. The prediction is relayed to the bettor via an earpiece or vibration signal. Early press reports of the 2004 Ritz Casino case incorrectly described a laser scanner; the actual device used timing clicks, not lasers. However, laser-based systems are technically feasible and have been developed. The laser method offers higher precision than manual timing but is also more detectable due to the electronic components involved.

  Detection. Watch for players holding phones or devices in an unusual orientation toward the wheel. Infrared detectors can identify active laser beams. RF scanning can detect transmission to earpieces. Two-person team formations where one person handles a device while another places bets. Players who seem to look at a device just before placing late bets.

  Countermeasures. Same as roulette computers — prohibit all electronic devices at or near gaming tables. Use RF and infrared detection sweeps. Call “no more bets” immediately after ball release to eliminate the prediction window. Use automated randomization features on wheels. Train staff to recognize team formations typical of electronic device users.

  Target: All physical roulette variants

• Wheel Gaffing · Professional

  Scam #17: Lead Bottoms / Weighted Pockets

  This method involves physically modifying the roulette wheel to create bias toward or away from specific numbers. The perpetrators construct molds shaped like the areas between the wheel’s frets (the numbered pockets). They then melt lead and pour it into these molds, creating weighted inserts that are placed under the wheel head between the chrome frets. The added weight makes certain sections of the wheel heavier, causing the wheel to settle with the weighted section slightly lower. Since the ball is more likely to come to rest in pockets that are physically lower (due to gravity), the weighted numbers hit more frequently. Alternatively, the cheaters may add weight to the OPPOSITE side of their betting numbers, causing the wheel to tilt away from heavily-bet areas and toward their target numbers. This modification requires inside access to the wheel, typically through a dishonest maintenance worker, dealer, or manager.

  Detection. Regular weighing of wheel heads to detect added mass. Physical inspection of the underside of the wheel head. Monitor spin results for statistical anomalies — weighted wheels will show persistent sector bias. Watch for dealers or maintenance personnel who spend unusual amounts of time around specific wheels. Listen for rattling sounds from loose inserts. Level the wheel on a precision surface — any tilt indicates possible tampering.

  Countermeasures. Keep all roulette wheels under lock and key when not in use. Maintain strict access logs for all wheel maintenance. Weigh wheels periodically on a calibrated scale. Use wheels with sealed, tamper-evident construction. Require dual authorization for any wheel maintenance or relocation. Install security cameras covering all wheel storage and maintenance areas. Perform statistical analysis of results to detect bias early.

  Target: Physical roulette wheels; requires access to wheel internals

• Wheel Gaffing · Professional

  Scam #18: Loosened Frets (a.k.a. Pocket Spacing Manipulation)

  The frets (also called separators or canoes) are the raised barriers between each numbered pocket on the roulette wheel. By selectively loosening or modifying specific frets, a cheater can alter how the ball behaves when it hits those pockets. A loosened or lowered fret allows the ball to bounce out more easily, making that pocket less likely to retain the ball. Conversely, tightening or raising frets on target numbers makes those pockets more “sticky” — the ball is more likely to settle there. This manipulation creates a subtle but exploitable bias. The modification is typically done by a dishonest maintenance worker or by a cheater with after-hours access to the gaming floor. The changes can be subtle enough to evade casual visual inspection but still produce a measurable statistical effect over thousands of spins.

  Detection. Physical inspection of all frets — check for loose, raised, or damaged separators. Test each fret with a probe or gauge to ensure consistent height and tightness. Monitor spin results for statistical bias. Listen for differences in the sound the ball makes when hitting different frets. Watch for maintenance personnel who work on wheels without proper authorization.

  Countermeasures. Use wheels with integrated fret designs that cannot be individually adjusted. Implement regular fret inspection protocols. Replace frets on a scheduled maintenance cycle. Use statistical monitoring software to detect bias patterns. Restrict physical access to wheels. Photograph/document fret condition after each maintenance session.

  Target: Physical roulette wheels with removable frets

• Wheel Gaffing · Professional

  Scam #19: Ball Track Contamination (Sticky Track / Residue Application)

  The ball track (the outer rim where the ball spins before dropping) is the most vulnerable part of a roulette wheel. Cheaters can apply substances to the track to alter ball behavior — a thin film of lubricant can make the ball travel faster and longer, while a sticky residue can cause premature slowing and dropping. More sophisticated methods involve creating a “dominant drop zone” by selectively roughening or smoothing sections of the track. Since the ball’s exit point from the track is a major determinant of where it lands, controlling this exit point gives the cheater a significant advantage. The substance application is typically done by a confederate with after-hours access or by a player who manages to touch the track during play (e.g., by “accidentally” reaching for a fallen chip).

  Detection. Regular cleaning and inspection of the ball track. Look for residue, discoloration, or texture differences on the track surface. Monitor ball behavior — if the ball consistently drops from the same section of the track, this indicates a possible dominant drop zone. Check for unusual substances during routine maintenance. Compare ball travel times around the track — significant variation suggests contamination.

  Countermeasures. Clean ball tracks daily with approved solvents. Rotate wheels to distribute wear evenly (1/8 turn weekly). Use ball track materials resistant to contamination. Train dealers to prevent players from touching the wheel or track for any reason. Perform ball travel timing tests — if the ball consistently slows faster or slower than normal, investigate. Resurface ball tracks on a regular maintenance schedule.

  Target: Physical roulette wheels; all variants

• Wheel Gaffing · Professional

  Scam #20: Spindle / Rotor Wobble Introduction

  The roulette wheel rotor spins on a central spindle mounted on precision bearings. If the spindle becomes slightly bent, the bearings wear unevenly, or the rotor becomes imbalanced, the wheel develops a wobble — a slight vertical or horizontal oscillation as it spins. This wobble creates predictable patterns: the ball is more likely to exit the track or settle in pockets when the wheel is at a particular point in its wobble cycle. Cheaters can introduce wobble by: (1) loosening the spindle mounting, (2) adding weight to one side of the rotor, (3) damaging the bearings, or (4) physically bending the spindle shaft. The wobble may be barely perceptible to the naked eye but still produce exploitable statistical bias. A player can observe the wobble by watching light reflections on the wheel head — if the reflection wobbles, the wheel is not true.

  Detection. Observe light reflections on the wheel head — wobbling reflections indicate rotor wobble. Listen for irregular sounds from the wheel mechanism. Place a precision level on the wheel head during maintenance. Use dial indicators to measure runout (wobble) of the rotor. Monitor spin results for sector bias patterns. Watch for dealers or maintenance staff who handle the wheel spindle area unnecessarily.

  Countermeasures. Regular maintenance of wheel spindles and bearings using precision tools. Replace bearings on a scheduled cycle. Check wheel level with precision instruments during every maintenance session. Use vibration analysis to detect bearing wear before it causes wobble. Train maintenance staff in proper wheel assembly procedures. Store spare wheels in a climate-controlled environment to prevent warping.

  Target: Physical roulette wheels

• Collusion · Intermediate

  Scam #21: Dealer-Signaled Past Posting

  In this scam, a dishonest dealer uses subtle signals to inform a confederate player when past-posting opportunities exist. The dealer may deliberately turn their back to the layout for an extended period while “examining” the winning number, use a specific phrase or tone of voice, position the dolly in a certain way, or use hand gestures that appear normal to observers but convey a specific meaning to the accomplice. When the signal is given, the player knows the dealer will not be watching the layout and can safely place a late bet. The dealer then “discovers” the late bet, removes it with an apology, but may accidentally-on-purpose leave a portion of it behind — or the player may have already gained useful information about which number to bet on the next spin.

  Detection. Review surveillance for dealer behavior patterns — consistent extended turns away from layout, unusual phrases, or repetitive gestures when specific players are present. Analyze player win rates by dealer for statistical anomalies. Monitor dealer-player interactions for familiarity or rapport beyond normal customer service. Watch for dealers who consistently handle certain players’ bets differently.

  Countermeasures. Strict dealer rotation (every 20 minutes). Prohibit dealers from engaging in personal conversation with players. Monitor dealer body positioning during spins — dealers must be trained to see both wheel and layout simultaneously. Use surveillance to review dealer behavior patterns. Implement confidential reporting systems for staff to report suspicious colleague behavior. Background checks and financial monitoring.

  Target: All roulette variants

• Collusion · Amateur / Intermediate

  Scam #22: Dealer Overpayment (Dirty Stacks)

  A dishonest dealer deliberately overpays a confederate player’s winning bets. The overpayment can take several forms: paying winning bets at incorrect higher odds (e.g., paying a split bet as if it were a straight-up bet), adding extra chips to the payout, paying losing bets as if they were winners, or creating “dirty stacks” — stacks of chips where a high-value chip is concealed under lower-value chips so the total payout appears correct but the actual value is inflated. The dealer may also deliberately miscalculate complex payouts in the player’s favor. These overpayments are typically small enough to avoid immediate detection but accumulate significantly over a shift. The dealer and player split the proceeds after the shift or through prearranged meeting points.

  Detection. Review surveillance of payouts frame-by-frame, especially for high-value bets. Compare actual payouts to mathematical expectations. Monitor dealer payout accuracy through random audits. Track player win rates by dealer. Watch for dealers who consistently make “errors” in the same player’s favor. Implement player tracking systems that flag statistically improbable win rates.

  Countermeasures. Mandatory verification of all payouts above a threshold by a floor supervisor. Electronic payout verification systems. Regular random audits of dealer payouts via surveillance review. Player rating system that flags unusual win patterns. Require immediate correction of ALL payout errors, no matter how small. Train dealers in payout accuracy as a core competency. Cross-train floor supervisors to verify complex payouts.

  Target: All roulette variants

• Collusion · Professional

  Scam #23: The “Hold” and “Sleight Release” (Dealer Controlled Outcomes)

  A skilled but dishonest dealer can subtly influence outcomes through two primary techniques: The Hold — the dealer waits to release the ball until the wheel has slowed to a specific speed, allowing them to better predict (or control) where the ball will land. By waiting for a specific number to pass under their hand before releasing, the dealer can bias outcomes toward a target sector. The Sleight Release — the dealer uses a subtle hand motion or finger pressure at the moment of release to influence the ball’s trajectory, speed, or spin axis. While no dealer can guarantee a specific number will hit, a skilled practitioner can bias results toward a sector with enough consistency to give a confederate a mathematical edge. These techniques require extensive practice and are nearly invisible to casual observation.

  Detection. Monitor dealer release timing — dealers who consistently wait for specific wheel positions before releasing the ball should be flagged. Watch for unusual hand motions at the moment of release. Analyze spin results for statistical bias toward specific sectors by dealer. Compare dealer spin characteristics to casino averages. Watch for dealers who refuse to spin when certain players are not present.

  Countermeasures. Train dealers to release the ball immediately upon picking it up, without delay. Use automated ball launchers that eliminate human release entirely. Implement spin analysis software that flags dealers with unusual statistical patterns. Require dealers to alternate spin directions every spin. Rotate dealers frequently. Use wheels with multiple deflectors that randomize ball behavior regardless of release technique.

  Target: Physical roulette; European single-zero wheels

• Collusion · Amateur / Intermediate

  Scam #24: Dealer-Assisted No-Call No-Pay

  In this scam, the dishonest dealer selectively enforces — or fails to enforce — game rules to benefit a confederate. For example, the dealer may fail to call “no more bets” and allow the accomplice to continue placing chips after the ball has dropped. Or the dealer may “accidentally” pay a bet that was clearly placed too late, claiming they didn’t see it in time. The dealer may also deliberately miscall the winning number, paying bets on a neighboring number where the confederate has chips. In another variation, the dealer fails to collect losing bets from the confederate, allowing them to play the same chips again on the next spin. These abuses rely on the dealer’s authority over the game and the difficulty of proving intent.

  Detection. Review surveillance for dealers who inconsistently enforce “no more bets” rules. Watch for dealers who consistently fail to collect chips from specific players. Monitor for miscalled winning numbers — compare dealer calls to actual results. Track which players are allowed to make late bets. Review dealer performance for unexplained patterns favoring specific players.

  Countermeasures. Clear, standardized “no more bets” procedures with physical gestures (waving hand over layout) and verbal announcements. Train dealers that ALL rules must be enforced consistently with ALL players, without exception. Surveillance audit of dealer adherence to procedures. Implement a “no exceptions” policy for late bets — once NMB is called, no bets are accepted regardless of circumstances. Require floor supervisor presence for any rule interpretation disputes.

  Target: All roulette variants

• Electronic Device · Professional

  Scam #25: Shoe-Based Computer (Eudaemons-Style Device)

  A fully functional microcomputer concealed within a modified shoe, capable of predicting roulette outcomes in real-time. The system uses a microprocessor (typically a low-power CMOS chip) running custom prediction software written in machine code. The user clicks toe-operated switches to input timing data — one click when the ball passes a reference point, another when the wheel passes a reference point. The computer calculates ball velocity, wheel velocity, deceleration rates, and uses a physics model to predict the most likely landing octant (one of eight sectors of the wheel). The prediction is communicated to the bettor via solenoid vibrations on the ankle, chest, or sole — different vibration patterns indicate different predicted octants. A two-person team configuration is typical: one person inputs data while the other receives predictions and places bets. The device achieves approximately 20-44% player advantage over the house.

  Detection. Watch for players who repeatedly tap their foot in a rhythmic pattern during spins. Look for teams of two where one watches the wheel intently and the other places bets based on signals. Check for slightly bulky footwear or unusual walking gait (device adds ~1 lb per shoe). Electronic sweeps can detect the microprocessor and transmission signals. Watch for players who seem to receive information just before placing bets — touching an ankle, shifting weight, or other subtle reactions to vibration signals.

  Countermeasures. Electronic sweeps of the gaming floor. Prohibit electronic devices of any kind at or near gaming tables. Train staff to recognize the behavioral signatures of wearable computer users (rhythmic toe-tapping, team formations). Call “no more bets” immediately after ball release. Use automated ball launchers. The Nevada Device Law (1985) makes possession of any predictive device a felony. Modern metal detectors and RF scanners can identify concealed electronics.

  Target: Physical roulette wheels; Las Vegas and major casino destinations

• Electronic Device · Amateur / Intermediate

  Scam #26: Smartphone/App-Based Prediction System

  Modern smartphones have made roulette prediction accessible to a much wider audience. Specialized apps use the phone’s camera to track the ball and wheel in real-time, applying computer vision algorithms to calculate velocities and predict landing zones. The user simply holds the phone in a natural position, points the camera at the wheel, and the app does the rest — processing video frames, identifying the ball, tracking its position, and outputting a prediction through the phone’s audio (earpiece) or vibration. Some apps claim to use machine learning and neural networks trained on thousands of spin videos to improve accuracy. Because smartphones are ubiquitous in casinos, these apps are particularly difficult to detect — the user appears to be a normal player casually checking their phone. The apps can be distributed through underground forums or encrypted messaging platforms.

  Detection. Watch for players who hold their phone oriented toward the wheel during spins. Monitor for players who check their phone immediately before placing late bets. Check if players have betting apps installed (requires consent or legal authority in most jurisdictions). Watch for players wearing wireless earpieces connected to their phone. Electronic sweeps can detect active app usage and data transmission.

  Countermeasures. Strict “no phones at the table” policy — require all players to keep phones in pockets or designated areas during play. Prohibit wireless earpieces on the gaming floor. Use electronic sweeps to detect active device usage. Call “no more bets” immediately after ball release. Train dealers to politely ask players to put away phones if brought out during play. Consider Faraday cage elements around gaming pits to block signals.

  Target: Physical roulette wheels; any casino that allows phones near the gaming floor

• Electronic Device · Professional

  Scam #27: Hidden Camera / Remote Computer Team

  A two or three-person team uses a concealed camera to stream video of the roulette wheel to a remote accomplice who runs prediction software on a powerful computer. The camera can be hidden in a mobile phone, a button on clothing, a wristwatch, eyeglasses, or a pen. The video feed is transmitted via WiFi, cellular data, or a local wireless connection to the remote operator, who analyzes the spin in real-time using sophisticated prediction algorithms. The prediction is then relayed back to the bettor at the table via a concealed earpiece, vibrating device, or text message. The remote computer can be much more powerful than a wearable device, enabling more accurate predictions. The team structure separates the data collection (camera operator) from the betting (player), making it harder to detect because the person placing bets has no visible electronic device.

  Detection. Watch for team formations — one person focusing on the wheel while another places bets. Look for players wearing glasses, watches, or clothing with unusual features that could conceal cameras. Electronic sweeps for hidden transmission devices. Monitor for players who seem to receive audio information (touching ear, nodding, sudden betting confidence). Check for wireless signals in the gaming area. Watch for players who position themselves at specific angles to the wheel (to give the camera the best view).

  Countermeasures. Prohibit all electronic devices and recording equipment on the gaming floor. Use RF spectrum analyzers to detect unauthorized transmissions. Implement cellular/WiFi jamming in gaming areas (where legally permitted). Call “no more bets” immediately after ball release. Train staff to identify team play patterns. Use directional antennas to detect wireless signals originating from the gaming floor.

  Target: Physical roulette wheels; especially effective in busy casinos where electronic devices are common

• Electronic Device · Intermediate

  Scam #28: Micro-Earpiece Signal Reception

  This technique focuses on the communication link in electronic cheating systems rather than the prediction method itself. The cheater wears a nearly invisible micro-earpiece (sometimes called a “spy earpiece” or “invisible earpiece”) that receives audio signals from an accomplice. The earpiece can be as small as a grain of rice, fits deep inside the ear canal, and is typically flesh-colored or transparent. It receives signals via Bluetooth, inductive loop (a wire hidden around the neck or in clothing), or direct RF transmission. The accomplice may be running a roulette computer, analyzing surveillance feeds, or simply observing the game from a distance and providing guidance. Because the earpiece is invisible to casual observation, detection is extremely difficult. Some cheaters use tiny vibrating devices instead of audio to avoid any chance of sound being overheard.

  Detection. Watch for players who touch or adjust their ear frequently. Look for the slight wire of an inductive loop around the neck (may be hidden under clothing). Some micro-earpieces can be detected by their RF emissions. Infrared cameras can sometimes detect the heat signature of an active device in the ear canal. Watch for players who seem to be having a one-sided conversation or who react to unheard stimuli. Electronic sweeps using specialized equipment can detect active Bluetooth or RF transmissions.

  Countermeasures. Use RF detection equipment sensitive enough to identify micro-transmission devices. Infrared scanning can detect body heat anomalies near the ear. Train staff to watch for behavioral indicators (ear-touching, one-sided conversation patterns). Prohibit hoodies, high collars, and other clothing that could conceal neck loops. Consider requiring players to show their ears clearly (difficult to enforce for cultural/privacy reasons). The most effective countermeasure is eliminating the prediction window by calling NMB immediately after ball release.

  Target: All roulette variants; any situation where external information provides an advantage

• Chip Theft · Amateur / Intermediate

  Scam #29: Chip Snatching (a.k.a. Pinching from the Layout)

  The cheater uses sleight of hand to steal chips directly from the roulette layout — either from other players’ bets or from the casino’s bank. The thief typically works in a team: one or more accomplices create a distraction (asking the dealer a question, dropping something, feigning an argument) while the mechanic quickly palms chips from the layout. The stolen chips are then passed to another team member who cashes them out at a different location or table. This is most commonly attempted during busy periods when the dealer has many bets to process and surveillance has numerous tables to monitor. The thief may also target a player’s personal chip stack on the apron (the rim of the table) while the player is distracted watching the wheel.

  Detection. Watch for rapid hand movements near other players’ bets or the dealer’s bank. Monitor for coordinated team behavior — multiple players suddenly engaging the dealer simultaneously. Review player complaints about missing chips (many go unreported). Watch for players who position themselves to reach across the layout unnecessarily. Track chip counts after each spin to identify shortages.

  Countermeasures. Train dealers to never turn their back on the layout and to keep their body square to the table at all times. Position surveillance cameras to cover all angles of the layout. Encourage players to report missing chips immediately. Train dealers to watch for hands reaching across the layout. Maintain tight spacing between tables to make escape more difficult. Use chip tray designs that make snatching more difficult.

  Target: All roulette variants; any table with high chip volume

• Chip Theft / Organized Ring · Intermediate

  Scam #30: The Restroom Roulette Scam (Color-Up Theft Ring)

  A large organized crime ring targets multiple casinos across state lines using a coordinated chip theft and color-up scheme. The operation works as follows: Step 1 — Player A enters a busy, low-limit roulette table and buys in for $1 chips (the lowest denomination). Step 2 — Other team members join the table and create distractions (spilling drinks, engaging the dealer in conversation, blocking surveillance angles). Step 3 — Player A quickly pockets as many $1 chips as possible from the layout and the dealer’s chip tray. Step 4 — Player A exits the table and meets Player B in a restroom or other non-surveilled area, transferring the stolen chips. Step 5 — Player B returns to a DIFFERENT roulette table (or the same table at a different time), buys in at a HIGHER denomination (e.g., $25 chips), and uses the stolen $1 chips mixed with the new higher-value chips. Step 6 — When cashing out, the $1 chips are valued at the higher buy-in rate, effectively “coloring up” stolen low-value chips into high-value cash. The ring operates across multiple states, hitting dozens of casinos with low individual loss amounts that avoid triggering major investigations.

  Detection. Watch for players who buy in at low denominations but spend minimal time betting before pocketing chips. Monitor for team formations where multiple players join a table simultaneously and create distractions. Track chip inventory shortages at low-limit tables. Watch for players who cash out at higher denominations than they bought in for. Cross-reference surveillance across multiple properties for repeating faces. Monitor cash cage transactions for unusual color-up patterns.

  Countermeasures. Strict chip inventory controls — count chips at the beginning and end of each dealer’s shift. Track buy-in and cash-out amounts for discrepancies. Use RFID-enabled chips that can be traced and have different identifiers by denomination and table. Coordinate with neighboring casinos through shared databases of known cheaters. Require ID for all chip purchases and cash-outs above a threshold. Monitor restroom and non-gaming areas for chip transfers. Use color-specific chip designs that make mixing denominations obvious.

  Target: Low-limit American roulette tables; multi-state operations

• Sleight of Hand / Past Posting · Professional

  Scam #31: Chip Capping on Winning Bets

  After the ball has landed on a winning number, the cheater uses sleight of hand to add additional chips to their existing winning bet. Unlike classic past posting (placing a new bet on a number where there was no bet), chip capping increases the value of a bet that was already placed before the spin. The cheater may palm additional chips and drop them onto their winning stack while the dealer’s attention is on the wheel. Alternatively, the cheater may use a “kick” technique — resting their hand on the layout with a chip hidden underneath, then using an imperceptible thumb snap to slide the chip across the baize onto the winning bet. The move is covered by a partner leaning over the table to “get a better look” at the result, blocking the dealer’s and cameras’ view of the capping action.

  Detection. Surveillance must count chips on winning bets BEFORE the dealer approaches to pay. Any increase in chip count is immediate evidence of cheating. Review tape in slow-motion around the moment of ball drop. Look for hand movements over winning bets. Watch for players who lean over the layout or reach toward the wheel at the critical moment. Modern bet-tracking software can identify capping attempts by comparing pre-spin and post-spin chip counts.

  Countermeasures. Train dealers to case the layout (memorize all bets) before spinning the ball. Dealers should remember bet sizes by position. Use overhead cameras with chip-recognition capability. Implement the “wave off” procedure — dealers wave their hand over the layout as NMB is called, establishing a clear visual barrier. Dealers should step back to a position where they can see both wheel and layout after waving off. Train dealers to question any bet that seems larger than they remember.

  Target: All roulette variants; most effective at busy tables

• Sleight of Hand · Professional

  Scam #32: Losing Bet Pinching (a.k.a. The Pinch)

  The opposite of chip capping — instead of adding chips to a winning bet, the cheater REMOVES chips from a LOSING bet before the dealer collects it. This reduces the player’s loss on unfavorable outcomes. The technique requires the same sleight-of-hand skill as capping: the cheater palms high-value chips from the bottom of a losing stack while a partner creates a distraction. The remaining low-value chips are left for the dealer to collect. If the dealer notices the discrepancy and questions it, the cheater plays innocent — “Oh, I was just rearranging my chips” — or launches into a pre-rehearsed drunk act. Richard Marcus famously used this technique as part of his Savannah move, combining it with chip capping on wins to create a system where he cheated when he lost but not when he won — making surveillance review of winning bets appear completely legitimate.

  Detection. Same as chip capping — count chips before and after dealer interaction. Watch for hand movements near losing bets at the moment of collection. Monitor for the “drunk act” — players who suddenly become incoherent or apologetic when questioned about chip discrepancies. Review surveillance tape for rapid hand movements during the take-and-pay procedure.

  Countermeasures. Train dealers to verify bet sizes before spinning and to notice any discrepancies during collection. Dealers should use two hands to lift stacks, allowing visual inspection of the bottom chip. The “clap out” procedure — dealers flash their empty palms to the cameras before and after handling chips — creates a visual record of hand contents. Never allow players to remove or adjust their own chips after the ball has dropped.

  Target: All roulette variants

• Chip Theft · Intermediate / Professional

  Scam #33: The Coordinated Distraction Theft (Team Snatch)

  An organized team of 3-5 players executes a coordinated theft of chips from a roulette table. Each team member has a specific role: The Spotter — identifies a vulnerable table with a distracted dealer and valuable chips. The Mechanic — the skilled thief who actually steals the chips using sleight of hand. The Blocker — positions themselves to shield the mechanic’s actions from the dealer and cameras. The Distractor — engages the dealer with questions, complaints, or staged incidents. The Runner — receives stolen chips and immediately exits the area to cash out or transfer to another team. The team may hit multiple tables in a single session, maximizing their take before casino security can respond. The operation is planned and rehearsed like a military operation, with escape routes and contingency plans.

  Detection. Watch for groups of players who arrive together but pretend not to know each other. Monitor for coordinated body positioning that creates blind spots. Track chip inventory discrepancies across multiple tables in short timeframes. Review surveillance for recurring faces across different tables and shifts. Watch for players who leave immediately after a distraction incident without collecting their own bets.

  Countermeasures. Train dealers to recognize coordinated distraction patterns — multiple simultaneous questions, staged arguments, or “accidents.” Position surveillance cameras to eliminate blind spots. Use PTZ (pan-tilt-zoom) cameras to track suspicious groups across the gaming floor. Implement chip inventory tracking by table and shift. Share intelligence with neighboring properties about organized theft rings. Train floor supervisors to watch for team formations.

  Target: High-volume roulette tables; peak casino hours; properties with known weak surveillance coverage

• RNG Hacking · Professional

  SCAM #1: Russian Slot Machine PRNG Reverse-Engineering Hack

  A criminal organization based in St. Petersburg, Russia, acquired Aristocrat Mark VI and Novomatic slot machines (after Russian casino gambling was banned in 2009) and systematically reverse-engineered their Pseudo-Random Number Generators (PRNGs). By dismantling the machines and analyzing the source code, they cracked the mathematical algorithms governing outcomes. Operatives in target casinos would use smartphones to record approximately two dozen spins and transmit the footage to St. Petersburg. The technical team would analyze the video to determine the machine’s internal state based on their knowledge of the PRNG algorithm. They would then calculate precisely when a winning spin would occur and transmit timing markers to a custom app on the operative’s phone. The phone would vibrate approximately 0.25 seconds before the operative should press the spin button, accounting for human reaction time. This attack did not require any physical modification to the machine.

  Detection. Watch for players who: (1) spend extended time recording slot machine spins with smartphones, (2) receive phone notifications/vibrations before pressing spin, (3) consistently win at statistically improbable rates, (4) cash out small amounts every ~20 minutes to avoid scrutiny, (5) target specific older machine models exclusively. Monitor for daily hold percentage variances of 50-400% on targeted machines. Surveillance video analysis showing rapid cash-out button flashing at unusual times may also indicate exploitation.

  Countermeasures. Replace vulnerable older machine models with newer 64-bit RNG systems. Deploy quantum random number generators (QRNGs) that use true physical randomness rather than pseudo-random algorithms. Implement continuous entropy seeding from multiple independent sources (thermal noise, atmospheric data). Monitor floor for players exhibiting recording behaviors. Use facial recognition to identify known cheaters and share intelligence across properties.

  Target: Aristocrat Mark VI cabinets, Novomatic machines — primarily older-model slots in casinos across the United States, Europe, and South America

• RNG Hacking · Professional

  SCAM #2: Keno/Lottery RNG Prediction (Ron Harris Method)

  Ron Harris, a Nevada Gaming Control Board (NGCB) computer technician, used his privileged access to confidential source code to reverse-engineer the PRNG algorithms used in electronic keno games and slot machines. For keno, he developed a predictive algorithm that could determine which numbers the game’s PRNG would select in advance based on the machine’s internal clock state. For slot machines, he reprogrammed EPROM chips during routine NGCB inspections, embedding hidden “backdoor” code that would trigger jackpots when specific coin insertion sequences were performed. His method exploited the deterministic nature of early PRNGs, which used machine time as their primary seed value. Harris could predict keno outcomes down to the exact second, giving his accomplice an effectively guaranteed winning ticket.

  Detection. Review system logs for unauthorized code modifications. Monitor for players who consistently select unusual number patterns that win at impossible statistical rates. Cross-reference large jackpot wins against employee access logs. Audit all firmware updates and EPROM chip changes for unauthorized modifications. Check for modified diagnostic software on regulator equipment.

  Countermeasures. Implement strict separation of duties for regulatory personnel with source code access. Require all firmware modifications to be performed by two authorized personnel simultaneously (two-person integrity). Use cryptographically signed firmware that cannot be altered without detection. Deploy hardware security modules (HSMs) for RNG seed generation. Conduct regular independent audits of regulatory equipment. Implement real-time monitoring of all EPROM chip verifications.

  Target: Electronic keno machines, Universal Distributing slot machines, IGT Player’s Edge Plus video poker machines — primarily in Nevada casinos and at Bally’s Park Place in Atlantic City

• RNG Hacking · Professional

  SCAM #3: Alex (Novomatic) PRNG Extortion Scheme

  An individual identifying himself as “Alex” claimed to have reverse-engineered the PRNG algorithms in Aristocrat and Novomatic slot machines. Unlike the Russian hackers who exploited machines directly, Alex attempted to monetize his discovery through extortion. He contacted Aristocrat with a “proof” of his ability to predict outcomes, demanding payment in exchange for silence. When the company refused, he demonstrated his capability by having operatives win significant amounts from vulnerable machines. Alex’s method relied on identifying that some slot manufacturers based their PRNGs on algorithms that were at least 36 years old and in the public domain, making them vulnerable to reverse-engineering by anyone with sufficient mathematical expertise and computing resources.

  Detection. Similar to the Russian PRNG hack — monitor for players recording spins, receiving phone notifications before betting, and winning at statistically improbable rates. Track unusual betting patterns where players only engage specific machine models. Monitor for coordinated team activity across multiple properties.

  Countermeasures. Use proprietary, non-public-domain PRNG algorithms. Regularly rotate RNG algorithms and seed sources. Implement continuous reseeding with hardware-based entropy sources. Require certified independent testing labs (like GLI or BMM) to validate RNG implementation before deployment. Maintain strict control over source code and prevent public-domain algorithm usage.

  Target: Novomatic and Aristocrat slot machines with vulnerable PRNG implementations

• RNG Hacking / Advantage Play · Intermediate

  SCAM #4: Must-Hit-By Progressive Statistical Exploitation

  While not a hack in the traditional sense, this exploit takes advantage of the mathematical certainty built into “must-hit-by” progressive jackpot systems. These progressives are programmed to pay out at or before a specific dollar threshold (e.g., a $500 jackpot that must hit by $500). Advantage players monitor multiple machines and identify those where the progressive meter is within a small percentage (typically under 10%) of the must-hit-by threshold. At this point, the statistical probability of hitting the jackpot on each spin becomes high enough that the expected value of play shifts in the player’s favor. Teams of advantage players systematically scan casino floors, share information in online forums and chat groups, and camp at machines approaching their thresholds. Some organized teams rotate shifts to maintain control over favorable machines 24/7.

  Detection. Look for players who: (1) walk the floor scanning machines without playing, (2) only play machines with very high progressive meters, (3) work in teams that hold positions on multiple machines, (4) abandon machines immediately after the progressive hits, (5) share information via mobile devices about machine states. Monitor for unusual concentrations of play on specific machines approaching must-hit thresholds. Track players who consistently win progressives at above-average rates.

  Countermeasures. Use weighted RNG selection for the must-hit trigger point rather than uniform distribution — program machines to be more likely to hit closer to the maximum threshold. Implement dynamic game states that reset when players cash out. Reduce the visibility of progressive meter values. Train floor staff to recognize advantage play patterns and politely discourage camping behaviors. Consider removing or modifying must-hit-by progressives that are frequently targeted.

  Target: Slot machines with “must-hit-by” or “must-award-by” progressive jackpots (e.g., G+ Deluxe machines, certain AGS, Konami, and Konami games)

• Firmware Hacking · Professional

  SCAM #5: EPROM Chip Reprogramming (Dennis Nikrasch Method)

  Dennis Nikrasch, a former locksmith with Chicago mob connections, developed one of the most sophisticated slot machine cheating operations in history. His method involved physically accessing slot machines, opening the main door, turning off power, removing the motherboard, and connecting his own computer to the board’s main bus (the connection between the motherboard and slot machine components). This allowed him to reprogram the EPROM (Erasable Programmable Read-Only Memory) chips without physically removing them. Critically, his modified firmware included a corrected checksum to pass verification tests. The reprogrammed machines would then produce winning outcomes on command or at predetermined intervals. Nikrasch used a team of “blockers” to stand between him and surveillance cameras during the brief window when he accessed the machine. He also defeated door alarm systems by working quickly within the alarm response window.

  Detection. Review system event logs for the telltale sequence: “illegal door open; power off; power on; door closed; jackpot.” Monitor for players who only hit jackpots after maintenance-like activity. Track large jackpot payouts against machine access logs. Watch for groups with coordinated blocking behaviors around machines. Audit EPROM chip checksums against manufacturer master copies regularly. Monitor for unauthorized motherboard access.

  Countermeasures. Lock motherboards in separate tamper-evident metal enclosures within the main cabinet. Implement real-time door-open alerts with immediate surveillance response (no grace period). Use encrypted EPROM chips with digital signature verification that cannot be replicated without manufacturer keys. Require two-person teams for all maintenance access. Install independent power monitors that log all power interruptions. Perform random firmware audits comparing chips to master copies.

  Target: Computer-based slot machines across Las Vegas and other Nevada casinos, including Wheel of Fortune machines and Megabucks progressive slots

• Firmware Hacking · Professional

  SCAM #6: Ron Harris EPROM Backdoor Injection

  Ron Harris exploited his position as a Nevada Gaming Control Board technician to manipulate the very equipment used to audit slot machines. He rigged the NGCB’s field laptop computers — instead of legitimately reading EPROM chips and comparing them to manufacturer master software, the laptops were reprogrammed to automatically overwrite new cheating code onto the chips during routine inspections. Harris embedded hidden code that altered machine firmware during these authorized testing sessions. The modified machines would pay out jackpots when specific coin insertion sequences were performed (e.g., three coins, then two, then two, one, three, and five). This was particularly insidious because the cheating was perpetrated by the regulators themselves, leaving no suspicious activity in the logs — the modifications appeared as legitimate regulatory inspections.

  Detection. Cross-reference all jackpot payouts against regulatory inspection records. Look for patterns where jackpots occur shortly after NGCB inspections. Verify that inspection laptop software has not been tampered with by running independent verification against known-clean copies. Monitor for unusual coin insertion patterns immediately preceding jackpots. Audit the chain of custody for all regulatory equipment.

  Countermeasures. Require all regulatory inspection software to be independently verified before each use. Implement code-signing on all diagnostic tools. Maintain complete audit trails of every chip inspection with timestamps and personnel identification. Use write-protected boot media for diagnostic systems that cannot be permanently modified. Require independent second-party verification of all inspections. Perform surprise firmware audits using equipment not accessible to regular inspectors.

  Target: Primarily Universal Distributing slot machines and IGT Player’s Edge Plus video poker machines in Northern Nevada casinos (Fitzgerald’s Reno, Crystal Bay Club Lake Tahoe)

• Firmware Hacking · Professional

  SCAM #7: Firmware Bug Exploitation (Flashing)

  Criminal organizations purchase legitimate slot machines (often from jurisdictions where gambling has been banned or from liquidation sales) and systematically reverse-engineer the firmware to identify bugs and vulnerabilities. They develop modified firmware that increases payout percentages, forces jackpot outcomes under certain conditions, or creates hidden backdoors. The modified firmware is then written (“flashed”) onto replacement EPROM chips using specialized programmers. Accomplices infiltrate target casinos and swap the legitimate chips with the modified ones, typically during periods of low supervision. Some operations sell the bug firmware to other criminals. Modern variants may exploit firmware update mechanisms over network connections if the slot machine is connected to a casino management system.

  Detection. Regularly audit EPROM chip checksums and digital signatures against manufacturer-certified master copies. Monitor for unusual door-open events, especially outside scheduled maintenance windows. Use tamper-evident seals on chip access points. Track machines that show statistically anomalous payout patterns. Implement real-time hold percentage monitoring with alerts for significant deviations. Watch for individuals who loiter near machines without playing or who appear to have technical expertise beyond normal patron behavior.

  Countermeasures. Use encrypted, digitally-signed firmware that verifies authenticity on every boot cycle. Implement hardware security modules (HSMs) in slot machines to prevent unauthorized firmware execution. Require secure boot processes that verify firmware integrity before loading. Use tamper-resistant chip packaging that destroys data upon unauthorized access. Perform unannounced firmware audits. Maintain strict inventory control over all gaming hardware. Network-connected machines should verify firmware signatures against a central server.

  Target: Any slot machine model where cheaters have obtained identical hardware for reverse-engineering — historically Gaminator, Mega Jack, Novomatic, Igrosoft, and other popular machine lines

• EMP/EMF Attack · Intermediate

  SCAM #8: EMP Slot Machine Jamming

  Handheld Electromagnetic Pulse (EMP) jamming devices emit high-frequency electromagnetic waves capable of disrupting a slot machine’s internal circuitry. These devices can interfere with pulse-based communication systems used by bill acceptors, coin mechanisms, and credit systems. The EMP pulse mimics the high/low voltage transitions that these systems use to register events, tricking the machine into thinking legitimate credits have been inserted. Modern EMP jammers can be concealed in phones, cigarette packs, or other everyday items. The attacker activates the device near the machine, causing it to malfunction or register phantom credits. Some devices are powerful enough to disrupt the machine’s CPU, causing it to enter an error state that may result in unintended payouts or reset to default configurations with different payout percentages.

  Detection. Monitor for players who: (1) hold unusual objects near the machine before playing, (2) experience abnormally high credit balances without corresponding cash insertions, (3) trigger repeated machine errors or malfunctions, (4) target older machines with known pulse-based vulnerabilities. Install electromagnetic interference (EMI) detection equipment near the slot floor. Monitor for unusual RF emissions in the gaming area. Track machines that enter error states with unusual frequency. Watch for patrons who seem to be testing machines rather than playing normally.

  Countermeasures. Upgrade all peripheral systems from pulse to serial communication (RS232) which uses structured digital data that cannot be easily faked by EMP pulses. Install Faraday cage shielding around critical machine components. Use EMP-hardened electronics in gaming machines. Implement electromagnetic interference monitoring systems on the casino floor. Design machines with robust error handling that does not result in payouts during EMF events. Regularly audit machine credit-to-cash ratios for anomalies.

  Target: Slot machines with pulse-based peripheral systems (bill acceptors, coin acceptors, ticket printers) that have not been upgraded to serial communication protocols

• EMP/EMF Attack · Amateur / Intermediate

  SCAM #9: EMF Coin Acceptor/Bill Validator Disruption

  A more targeted variant of EMP jamming, this attack focuses specifically on the coin acceptor or bill validator pulse lines. Electromagnetic fields induced near these components can create false signals that register as valid coin or bill insertions. The attack exploits the fact that pulse-based validation systems simply detect a transition from high to low voltage without any authentication or verification of the signal source. An EMF device placed near the coin slot or bill acceptor can generate pulses that are indistinguishable from legitimate inputs. In some cases, attackers have used modified disposable cameras (with their flash capacitors repurposed) to generate the electromagnetic pulse. The attack can be performed in seconds and the device concealed immediately.

  Detection. Monitor for rapid credit accumulation without visible cash insertion. Track bill validator and coin acceptor error rates for unusual spikes. Watch for players who position their hands or objects unusually near the coin slot or bill acceptor. Compare machine cash box contents against electronic credit records. Install EMF sensors near vulnerable machine components. Review surveillance footage of players who consistently win on the same machine models.

  Countermeasures. Replace all pulse-based acceptors with serial communication (RS232/USB) systems that require structured data packets with authentication. Install EMF shielding around acceptor components. Implement redundant validation that cross-references physical sensor data with electronic records. Use encrypted communication between acceptors and the main CPU. Monitor for electromagnetic anomalies with dedicated sensors. Perform regular reconciliation of physical cash against electronic records.

  Target: Slot machines with pulse-based coin acceptors and bill validators, especially older models and machines in less regulated jurisdictions

• Smartphone App Exploit · Professional

  SCAM #10: PRNG State Prediction via Video Analysis (Russian Method)

  This is the smartphone-enabled component of the broader Russian PRNG hack (Scam #1). Operatives use smartphones to record approximately 24 spins on a target machine, capturing the exact timing and outcomes of each spin. This footage is uploaded to a technical team in St. Petersburg (or another remote location) who analyze the video against their database of PRNG behavior for that specific machine model. Using knowledge of the reverse-engineered algorithm and the observed outcomes, they calculate the machine’s current PRNG state and determine precisely when the next winning outcome will occur. The timing data is transmitted back to a custom app installed on the operative’s phone, which vibrates 0.25 seconds before the optimal spin button press — accounting for average human reaction time. The entire operation appears as a normal player using their phone between spins.

  Detection. Watch for players who: (1) hold their phone aimed at the slot machine screen while spinning, (2) appear to be waiting for phone notifications before pressing spin, (3) consistently win at rates far exceeding expected probabilities, (4) only play specific older machine models, (5) leave and return to the same machine after a period away, (6) cash out small amounts frequently. Monitor surveillance for coordinated team behaviors. Track hold percentages on vulnerable machine models across properties.

  Countermeasures. Replace vulnerable 32-bit machine models with modern 64-bit systems. Deploy true random number generators (TRNGs) using quantum or thermal noise sources that cannot be predicted algorithmically. Restrict phone usage near gaming machines or implement RF shielding in machine cabinets. Use facial recognition to identify known cheaters. Share intelligence across casino properties and with industry groups like the World Game Protection Conference. Monitor for players who exhibit the specific behavior pattern of recording spins.

  Target: Aristocrat Mark VI and Novomatic slot machines in casinos worldwide, particularly in the United States (Missouri, Illinois, California), Europe, and South America

• Smartphone App Exploit / Network Attack · Professional

  SCAM #11: Wireless Earpiece Surveillance System Exploitation (Crown Casino Method)

  In this sophisticated hybrid attack, a high-rolling player (“whale”) gains unauthorized access to the casino’s own CCTV surveillance system with the help of an insider accomplice. The accomplice, positioned remotely, watches the live high-definition CCTV feed from the premium gaming rooms and zooms in on other players’ cards in real time. This information is relayed to the player at the table through a concealed wireless earpiece, telling them exactly which plays to make. While this specific case targeted card games rather than slots, the same principle can be applied to electronic gaming: an insider could relay information about linked progressive triggers, bonus game states, or other time-sensitive gaming data to a player. The attack weaponizes the casino’s own security infrastructure against it.

  Detection. Implement wireless transmission detection (RF scanning) in all gaming areas, especially premium rooms. Monitor for players who: (1) seem to make decisions with unusual confidence or knowledge, (2) touch their ear or head frequently, (3) appear to be receiving instructions, (4) win at statistically impossible rates in games involving hidden information. Review access logs for the surveillance system for unauthorized access or unusual viewing patterns. Monitor network traffic for unauthorized remote connections to CCTV systems.

  Countermeasures. Install RF signal detection equipment in all gaming areas to detect wireless transmissions. Restrict surveillance system access to authorized personnel with multi-factor authentication. Implement network segmentation to isolate CCTV systems from other casino networks. Monitor all surveillance system access in real-time. Require justification for all pan/zoom operations on high-stakes gaming cameras. Conduct regular security audits of surveillance infrastructure. Perform background checks on all surveillance staff. Implement principle of least privilege for all surveillance access.

  Target: High-stakes gaming rooms, premium gaming areas with advanced CCTV surveillance, electronic table games with screen-visible information, linked progressive systems where timing information could provide advantage

• RFID Fraud · Intermediate / Professional

  SCAM #12: RFID Casino Chip Cloning & Signal Exploitation

  Modern high-value casino chips contain embedded RFID tags for authentication and tracking. Criminals can potentially clone these RFID signals using specialized equipment such as Proxmark3 devices, Arduino boards with RC522 card reader antennas, or similar RFID reading/writing tools. The attack involves: (1) reading the unique RFID identifier from a legitimate chip, (2) programming a blank RFID tag with the copied identifier, (3) creating a counterfeit chip with the cloned RFID signature. In a casino context, counterfeiters could introduce these cloned chips into play at table games and later cash them out at the cage. Alternatively, if someone could exploit a software bug to credit chip values to an account using cloned RFID signals, they could essentially “conjure” money. More sophisticated attacks might involve intercepting RFID communications between chips and table readers (RFID skimming).

  Detection. Implement RFID authentication systems that verify more than just the UID — check encrypted digital signatures on each chip. Monitor for chips that fail secondary authentication. Track chip movement patterns for anomalies. Watch for individuals carrying RFID reading equipment (though modern devices can be very small and concealed). Compare chip weights and physical characteristics against manufacturer specifications. Use multi-layer chip verification at cashier cages. Monitor for chips that appear in circulation without proper purchase records.

  Countermeasures. Use high-frequency RFID with encryption (not just simple UID matching). Implement mutual authentication between chips and readers (both verify each other). Use phase-jitter modulation (PJM) technology that supports high-speed reading of stacked chips. Deploy redundant security features — holograms, UV markings, micro-printing, and unique edge patterns in addition to RFID. Maintain real-time chip inventory tracking. Regularly rotate chip designs and update RFID encryption keys. Perform penetration testing on RFID infrastructure. Train cage staff to identify subtle irregularities in chip appearance and weight.

  Target: RFID-enabled casino chips, particularly high-denomination chips at table games and cashier cages. Also applies to RFID-enabled player cards and cashless wagering systems

• RFID Fraud · Intermediate

  SCAM #13: RFID Signal Jamming & Interception

  Attackers use RF jamming devices to disrupt communications between RFID-enabled chips and casino readers. This can be used to: (1) prevent chip authentication systems from working, allowing counterfeit chips to pass undetected during system outages, (2) intercept (skim) RFID communications to gather data for later cloning, (3) create denial-of-service conditions that force cashiers to bypass electronic verification. Skimming attacks involve placing a concealed RFID reader near where chips are handled (at gaming tables, in chip trays, near cage windows) to capture the RFID signatures of passing chips. The captured data can be used to create cloned chips or to build a database of valid chip IDs for future exploitation.

  Detection. Install RF spectrum analyzers to monitor for unusual jamming signals in the RFID frequency bands (typically 13.56 MHz for HF RFID). Monitor chip authentication failure rates — sudden spikes may indicate jamming. Watch for patrons who position bags, coats, or other items unusually near chip trays or cage windows. Implement redundant authentication that fails securely (denies access rather than grants it during interference). Track authentication attempts and failures in real-time.

  Countermeasures. Use frequency-hopping RFID systems that resist jamming. Implement encrypted communication between chips and readers that cannot be intercepted for cloning. Design systems to fail securely — any authentication interruption should trigger manual verification procedures, not bypass. Use physical shielding on chip trays and reading stations to limit RF exposure. Monitor the RF spectrum in gaming areas. Deploy anti-skimming hardware that detects unauthorized readers. Use RFID tags with rolling code or challenge-response authentication that makes replay attacks impossible.

  Target: RFID-enabled chip systems at gaming tables, cashier cages, chip redemption kiosks, and automated chip sorting equipment

• Network Attack · Professional

  SCAM #14: Casino Management System (CMS) Intrusion

  Casino Management Systems connect slot machines to central servers for player tracking, accounting, configuration management, and progressive jackpot control. Attackers who gain access to the CMS network can potentially: (1) alter slot machine payout percentages remotely, (2) manipulate progressive jackpot triggers, (3) access player account data and transaction histories, (4) interfere with financial reporting to hide theft, (5) deploy malware to slot machines across the network. Common attack vectors include exploiting vulnerabilities in vendor-controlled remote access systems (the FBI specifically warned about this in 2023), using compromised credentials from phishing attacks, or exploiting unpatched software vulnerabilities in the CMS platform itself. Once inside the network, attackers may move laterally from less secure systems (like digital signage or hotel management) to the critical gaming network.

  Detection. Implement network traffic monitoring to detect unusual patterns or unauthorized access attempts. Monitor for remote access sessions outside normal maintenance windows. Track all configuration changes to slot machines with alerts for unauthorized modifications. Use SIEM (Security Information and Event Management) systems to correlate logs across gaming infrastructure. Watch for unusual data flows between gaming and non-gaming networks. Monitor for machines reporting payout percentages that deviate from configured values. Implement IDS/IPS systems on gaming networks.

  Countermeasures. Strictly segment gaming networks from general casino IT infrastructure (hotel, restaurant, retail systems should never connect to gaming networks). Implement zero-trust architecture for all gaming network access. Require multi-factor authentication for all CMS access. Use encrypted VPN tunnels for all remote maintenance access with session recording. Regularly patch and update CMS software. Conduct penetration testing of gaming networks. Implement principle of least privilege for all network accounts. Monitor all network traffic with gaming-specific anomaly detection. Maintain offline backups of all critical gaming configurations.

  Target: All slot machines connected to the casino management system, server-based gaming (SBG) terminals, player tracking systems, progressive jackpot networks, financial reporting systems

• Network Attack · Professional

  SCAM #15: Ransomware Attack on Gaming Operations (Scattered Spider Method)

  The Scattered Spider / ALPHV attack on MGM Resorts in September 2023 demonstrated how ransomware can directly impact slot machine operations. The attack began with social engineering (vishing) to obtain credentials, escalated to full network access, and culminated in ransomware deployment across approximately 100 ESXi hypervisors hosting thousands of virtual machines. This shut down critical systems including slot machines (which displayed error messages), ATMs, digital room keys, reservation systems, and websites. While the primary motive was data theft extortion rather than direct slot cheating, the same attack vector could be used to manipulate gaming systems if attackers gained sufficient access. A sophisticated attacker with CMS access could theoretically alter progressive jackpot configurations, change payout percentages, or create phantom player accounts to launder money.

  Detection. Monitor for unusual administrative activity, especially credential changes and privilege escalations. Implement endpoint detection and response (EDR) on all gaming infrastructure. Use network segmentation monitoring to detect lateral movement. Watch for mass encryption events or unusual file access patterns. Monitor for unexpected system shutdowns or error states across multiple machines. Track all remote access sessions. Implement behavioral analytics to detect compromised accounts.

  Countermeasures. Implement comprehensive zero-trust security architecture. Require hardware-based MFA (not SMS-based) for all administrative access. Conduct regular social engineering awareness training for all staff, especially IT help desk personnel. Implement privileged access management (PAM) solutions. Maintain air-gapped backups of critical systems. Use network micro-segmentation to contain breaches. Perform regular tabletop exercises for ransomware scenarios. Establish incident response plans specifically for gaming system compromises. Coordinate with law enforcement and industry threat-sharing groups.

  Target: All casino digital infrastructure — slot machines, CMS servers, player tracking systems, financial systems, hotel operations, ATMs, online gaming platforms

• Network Attack · Professional

  SCAM #16: Server-Based Gaming (SBG) Manipulation

  Server-based gaming systems centralize game logic on remote servers rather than individual slot machines, with terminals acting primarily as display and input devices. This architecture introduces new attack vectors: (1) man-in-the-middle attacks that intercept and modify communications between terminals and game servers, (2) packet injection that sends false outcome commands to terminals, (3) server compromise that allows direct manipulation of game outcomes, (4) latency exploitation where attackers predict outcomes based on network timing. If communications between the terminal and server are not properly encrypted and authenticated, an attacker on the same network could potentially intercept and modify game data in transit. More sophisticated attacks might target the game server directly to alter the RNG seed values or payout tables for specific terminals or during specific time windows.

  Detection. Monitor network traffic between gaming terminals and servers for unusual patterns, unauthorized devices, or unexpected data flows. Implement deep packet inspection for gaming protocols. Watch for latency anomalies that could indicate man-in-the-middle positioning. Monitor game outcome distributions for statistical anomalies. Track configuration changes on game servers. Use network access control (NAC) to prevent unauthorized devices from connecting to gaming networks. Audit encryption implementation on all gaming communications.

  Countermeasures. Use end-to-end encryption (TLS 1.3 or equivalent) for all terminal-server communications. Implement mutual authentication between terminals and servers. Use dedicated, isolated networks for gaming traffic. Deploy hardware security modules (HSMs) on game servers for RNG operations. Regularly audit server configurations against approved baselines. Implement real-time game integrity monitoring that compares actual outcomes against expected statistical distributions. Use code-signing on all game software. Perform regular penetration testing of gaming network infrastructure.

  Target: Server-based gaming terminals, video lottery terminals (VLTs), Class II gaming systems, any slot architecture where game logic executes on a central server

• Social Engineering · Intermediate

  SCAM #17: Pretexting as Gaming Technician/Maintenance Worker

  Social engineers pose as authorized slot machine technicians, gaming regulator inspectors, or vendor maintenance personnel to gain physical access to slot machines. Using convincing uniforms, forged credentials, fake work orders, and technical jargon, they persuade casino staff to grant them unsupervised access to gaming machines. Once inside the machine, they can: (1) install malware via USB ports, (2) swap EPROM chips with modified versions, (3) install wireless communication devices for remote access, (4) photograph internal components for later reverse-engineering, (5) plant keystroke loggers or network taps. The attack exploits the trust relationship between casinos and their vendors/inspectors, and the complexity of casino operations where staff may not personally know all legitimate technicians.

  Detection. Verify the identity of all maintenance personnel through a centralized authentication system. Watch for “technicians” who: (1) arrive without scheduled appointments, (2) refuse to provide identification or become defensive when questioned, (3) work unusually quickly or focus on machines that don’t need maintenance, (4) carry equipment that doesn’t match their stated purpose, (5) ask staff to look away or not log their visit. Monitor all machine access in real-time. Implement surveillance review of all maintenance activities. Train floor staff to recognize and report suspicious technician behavior.

  Countermeasures. Require all vendor personnel to be pre-registered and verified through a centralized system. Issue photo ID badges that can be electronically verified. Require escorts for all non-casino technicians. Implement real-time maintenance scheduling that floor staff can verify. Use tamper-evident seals on all access points that are inspected after any maintenance visit. Log all machine access with personnel identification, timestamps, and purpose. Conduct regular audits of maintenance records. Train staff to never feel pressured to bypass verification procedures regardless of apparent urgency.

  Target: Slot machines on the gaming floor, particularly in areas with lower supervision or during off-peak hours when fewer staff are present

• Social Engineering / Insider Threat · Professional

  SCAM #18: Insider-Assisted Surveillance System Compromise

  A dishonest casino employee with access to surveillance systems provides unauthorized access to criminal accomplices. This can take many forms: (1) sharing login credentials for CCTV systems, (2) configuring remote access for external viewing, (3) physically installing unauthorized network devices to provide backdoor access, (4) manipulating camera angles or disabling cameras during criminal activity, (5) providing information about surveillance blind spots or security schedules. In the Crown Casino case, a VIP staff member allegedly provided the access needed for the high-roller to exploit the CCTV system. Similar insider threats exist in slot departments where employees with CMS access could alter machine configurations, clear error logs, or override security settings. The attack is particularly dangerous because it bypasses all external security measures through legitimate access channels.

  Detection. Monitor all surveillance system access with user identification, timestamps, and actions performed. Alert on unusual access patterns (after hours, from unusual locations, excessive pan/zoom on gaming areas). Monitor network connections for unauthorized remote access. Track all CMS configuration changes. Watch for employees with access to both gaming and surveillance systems who exhibit unusual behavior. Implement dual-authorization for sensitive surveillance functions. Conduct regular access reviews to ensure permissions match job roles.

  Countermeasures. Implement strict separation of duties between gaming operations, surveillance, and IT departments. Require dual-authorization for all sensitive system access. Use privileged access management (PAM) with session recording for all administrative accounts. Disable remote access to surveillance systems except through secure, monitored channels. Conduct thorough background checks on all employees with access to sensitive systems. Implement behavioral analytics to detect unusual access patterns. Rotate staff assignments to prevent long-term unsupervised access. Maintain strict access logs with regular auditing.

  Target: Slot machine areas, high-limit gaming rooms, cashier cages, count rooms — anywhere surveillance coverage provides tactical advantage or where CMS access enables machine manipulation

• Social Engineering · Intermediate

  SCAM #19: Help Desk Vishing (Voice Phishing) Attack

  Attackers research casino employees on LinkedIn and other social media to gather information about their roles, responsibilities, and relationships. They then call the casino IT help desk posing as the employee, using the gathered information to establish credibility. The attacker claims to be locked out of their account or having technical difficulties and persuades the help desk to reset passwords, disable multi-factor authentication, or provide new credentials. Once credentials are obtained, the attackers gain access to internal systems and can move laterally through the network, eventually reaching gaming systems. Scattered Spider perfected this technique — their members are fluent English speakers who research their targets thoroughly before calling. Modern variants may use AI-generated voice synthesis to perfectly impersonate the target employee’s voice using just a few seconds of audio from public sources.

  Detection. Monitor help desk calls for unusual patterns: requests for MFA bypass, password resets from unusual locations, callers who have detailed knowledge but seem rushed or claim urgency. Implement callback verification to a known number before processing sensitive requests. Track all credential resets with user identification and authorization verification. Monitor for login attempts from unusual locations or devices after help desk interactions. Alert on privilege escalation requests.

  Countermeasures. Implement strict identity verification procedures for all help desk requests involving credentials or access changes. Require in-person verification for sensitive requests when possible. Use hardware tokens or biometric authentication that cannot be reset over the phone. Train help desk staff specifically on vishing techniques and to never feel pressured to bypass procedures. Record all help desk calls for quality assurance and investigation. Implement “out-of-band” verification that requires confirmation through a separate communication channel. Limit help desk authority — require supervisor approval for MFA bypass or privilege changes.

  Target: Casino IT infrastructure, eventually leading to gaming systems, CMS, player databases, and financial systems

• Near-Miss Programming Exploitation · Professional

  SCAM #20: Near-Miss Programming Frequency Exploitation

  Slot machine manufacturers are permitted in many jurisdictions to program near-miss outcomes (where jackpot symbols appear just above or below the payline) to occur up to 12 times more frequently than they would naturally. While this is a legal design feature intended to increase player engagement, advantage players and cheating teams have studied the specific near-miss patterns of different machine models to extract information about the machine’s internal state. By analyzing the frequency and pattern of near-misses, sophisticated players may gain insight into when a machine is “due” for a genuine payout. Some cheats use electronic devices to record and analyze near-miss patterns across multiple machines, building statistical models that predict favorable playing windows. The exploitation leverages the gap between the psychological design intent and the statistical information leaked by the programmed patterns.

  Detection. Monitor for players who: (1) observe machines extensively without playing, taking notes or recording, (2) only play specific machine models known for near-miss programming, (3) appear to use electronic devices to track outcomes, (4) play in short, concentrated bursts after extended observation. Review surveillance for coordinated teams monitoring multiple machines. Analyze player win/loss patterns for correlation with near-miss frequencies.

  Countermeasures. Limit the near-miss multiplier to the minimum necessary for player engagement. Use cryptographically secure RNGs that don’t leak state information through near-miss patterns. Vary near-miss programming parameters across machine instances so patterns cannot be generalized. Monitor for players who appear to be systematically recording outcomes. Educate surveillance staff about this exploitation method. Implement real-time player behavior analytics. Consider reducing near-miss frequency to levels where exploitation becomes statistically impractical.

  Target: Reel-based slot machines in jurisdictions where near-miss programming is permitted (Nevada, Ontario, and many other jurisdictions explicitly allow manufactured near-misses)

• Near-Miss Programming Exploitation · Intermediate

  SCAM #21: Persistence Game State Exploitation (Abandoned Credit/Token Harvesting)

  Many modern slot machines use “persistence” mechanics where game states accumulate over multiple plays and are stored on the machine between sessions. Examples include: (1) accumulated stamps or tokens that trigger bonus games when thresholds are reached, (2) partially completed bonus features that remain active, (3) multiplier banks that persist between plays, (4) collected symbols that progress toward a guaranteed feature. Advantage players (“vultures”) monitor these machines and only play when previous players have left the machine in a favorable state — close to bonus triggers, with accumulated credits, or near completion of persistent features. This is not illegal but exploits the machine’s design. More concerning is when teams use electronic devices to track machine states across large numbers of machines, or when insiders manipulate the stored state data on the CMS to create favorable conditions for accomplices.

  Detection. Monitor for players who: (1) walk the floor checking many machines without playing, (2) only sit down at machines where the display shows accumulated features or high progressive meters, (3) play briefly and cash out immediately after a feature triggers, (4) work in teams to monitor and hold positions on multiple machines. Track which players consistently find machines in favorable states. Watch for coordination between a player who leaves a machine and another who immediately takes it over. Monitor CMS data for unusual state modifications.

  Countermeasures. Reset all persistent game states when players cash out (though this may conflict with regulatory requirements in some jurisdictions). Reduce the visibility of accumulated features from a distance. Use dynamic game states that decay over time when not in play. Train floor staff to recognize advantage play patterns and manage machine availability. Implement systems that “lock” machines after cash-out until state data is verified. Consider removing or redesigning persistence features that are frequently exploited. Monitor for teams coordinating machine takeovers.

  Target: Slot machines with persistence mechanics: Green Stamps-style games, Ultimate-X video poker, must-hit-by progressives, accumulator bonus games, and any machine where game state carries over between plays

• Mystery Progressive Scam · Intermediate

  SCAM #22: Mystery Progressive Timing Exploitation

  Mystery progressive jackpots (also called “must-hit-by” or “must-award” jackpots) are designed to trigger randomly within a defined range, with the progressive meter visible to players. Organized teams systematically monitor multiple machines to identify those with meters approaching the maximum threshold. Using electronic tools (spreadsheets, custom apps, or even automated monitoring systems), they calculate the expected value of playing each machine based on the current meter position, bet requirements, and historical hit frequency. Teams coordinate to occupy the most favorable machines and may use signaling systems to alert members when a machine becomes available or when a meter reaches the threshold. The exploitation is highly organized — some teams maintain databases of thousands of machines across dozens of properties, tracking meter positions in real-time. The most sophisticated operations use custom software that interfaces with casino websites or mobile apps to remotely monitor progressive levels.

  Detection. Look for organized teams that: (1) systematically scan machine banks, (2) use mobile devices to track and share information about machine states, (3) occupy machines in coordinated patterns, (4) immediately cash out and leave when a progressive hits, (5) rotate positions to maintain 24/7 coverage of favorable machines. Monitor for unusually high progressive win rates at specific properties. Track the same player accounts winning multiple progressives. Watch for social media or messaging app usage indicating coordination. Analyze progressive hit data for patterns suggesting systematic exploitation.

  Countermeasures. Use weighted RNG algorithms that make progressives more likely to hit at lower meter positions (reducing the advantage at high thresholds). Hide progressive meter values or make them visible only during active play. Reset progressive meters to randomized positions after each hit rather than fixed starting points. Implement “mystery” thresholds that are not displayed to players. Limit bet sizes on must-hit-by machines to reduce the rate at which advantage players can extract value. Train slot floor staff to manage machine availability and politely discourage camping behaviors. Share progressive hit data across properties to identify systematic exploitation patterns.

  Target: All slot machines with mystery, must-hit-by, or must-award progressive jackpots — particularly AGS, Konami, and G+ Deluxe machines with visible progressive meters

• Mystery Progressive Scam / Network Attack · Professional

  SCAM #23: Linked Progressive Network State Manipulation

  Linked progressive jackpots connect multiple machines (sometimes across multiple properties) to a common prize pool. The progressive controller determines when jackpots hit and communicates this to all connected machines. Sophisticated attackers may attempt to: (1) intercept communications between machines and the progressive controller to identify when a jackpot is scheduled, (2) manipulate the network to cause jackpot triggers at favorable times, (3) exploit race conditions in the progressive system where rapid play across multiple machines can create timing vulnerabilities, (4) use insider access to the progressive controller to alter jackpot trigger thresholds. In some historical cases, attackers have found ways to force a progressive controller into an error state that triggers a jackpot payout. The networked nature of these systems means a vulnerability in the progressive controller can affect all connected machines simultaneously.

  Detection. Monitor progressive controller logs for unusual activity, errors, or unauthorized access. Track jackpot hit timing for statistical anomalies. Watch for coordinated rapid play across multiple linked machines by the same player or team. Monitor network traffic on progressive controller networks for unauthorized devices or unusual data flows. Review all progressive controller access with personnel identification. Implement alerts for progressive controller error states.

  Countermeasures. Isolate progressive controller networks from all other casino networks. Use encrypted, authenticated communications between the controller and all connected machines. Implement redundant monitoring on progressive controllers that alerts to any anomalies. Use hardware security modules for all progressive RNG operations. Require dual-authorization for any progressive controller configuration changes. Perform regular security audits of progressive network infrastructure. Maintain offline backups of progressive system configurations. Implement real-time progressive integrity monitoring.

  Target: Wide-area progressive (WAP) networks, linked progressive systems, Megabucks and similar multi-property jackpot networks

• USB/Physical Port Exploitation · Intermediate / Professional

  SCAM #24: USB Port Firmware Injection

  Many slot machines and gaming peripherals (card shufflers, bill acceptors, ticket printers) include USB ports intended for maintenance, firmware updates, or peripheral connection. Attackers who gain physical access can connect USB devices that: (1) install malware or rootkits on the machine’s operating system, (2) overwrite firmware with modified versions, (3) extract sensitive data including configuration files and RNG algorithms, (4) install remote access backdoors for later network-based exploitation. At the Black Hat 2023 conference, IOActive researchers demonstrated compromising a DeckMate 2 card shuffler by connecting a Raspberry Pi to its USB port, allowing them to view the exact order of cards via the shuffler’s internal camera. The researchers noted that malicious actors could execute the same attack using a device as small as a standard USB flash drive. The attack exploited hard-coded passwords that were identical across all devices.

  Detection. Physically inspect all gaming devices for unauthorized USB connections or devices. Monitor for USB port usage outside scheduled maintenance windows. Use USB port access logging where technically feasible. Watch for individuals who connect devices to machines. Implement surveillance cameras focused on machine access panels. Check for unusual machine behavior after maintenance activities. Audit firmware checksums regularly. Monitor for unauthorized remote access that might follow a USB-based initial compromise.

  Countermeasures. Physically disable or seal all USB ports that are not actively needed for operations. For required maintenance ports, use lockable covers that require specific authorization to access. Implement USB device whitelisting that only accepts pre-authorized devices. Require digital signature verification for all firmware updates. Use secure boot mechanisms that prevent unauthorized code execution. Install tamper-evident seals on all access points. Implement port-level monitoring that alerts when devices are connected. Train maintenance staff on proper procedures and to report any unusual port access requests.

  Target: Slot machines with accessible USB ports, electronic card shufflers, bill validators, ticket printers, player tracking terminals, and any gaming device with exposed data ports

• USB/Physical Port Exploitation · Amateur / Intermediate

  SCAM #25: BadUSB / HID Attack on Gaming Systems

  BadUSB is an attack where a modified USB device (like a flash drive or cable) emulates a Human Interface Device (HID) such as a keyboard when plugged into a computer. The device automatically “types” pre-programmed commands that can: (1) open command prompts or terminals, (2) download and execute malware, (3) create new user accounts with administrative privileges, (4) disable security software, (5) exfiltrate data, (6) establish persistent remote access. When applied to gaming systems with accessible USB ports, an attacker could plug in a malicious USB device for just a few seconds, installing a backdoor that provides ongoing remote access. The attack is particularly dangerous because it requires no technical skill from the person plugging in the device — they simply need physical access. Modern BadUSB devices can be disguised as ordinary flash drives, phone charging cables, or even novelty items.

  Detection. Monitor for unauthorized USB device connections. Implement endpoint detection that alerts when new HID devices are connected. Watch for unusual keyboard activity or command prompt windows appearing. Check for unauthorized user accounts or privilege escalations. Monitor for security software being disabled. Review system logs for unusual command execution. Train staff to never plug in unknown USB devices. Implement surveillance monitoring of all areas with gaming system access.

  Countermeasures. Disable all unnecessary USB ports through BIOS settings, physical removal, or epoxy filling. For required ports, use USB port locks that require special keys. Deploy endpoint protection that blocks unauthorized HID devices. Implement application whitelisting that prevents unauthorized software execution. Require multi-factor authentication for all administrative access. Use group policy to prevent automatic execution of USB-connected devices. Train all staff rigorously on the dangers of unknown USB devices. Conduct regular penetration testing that includes BadUSB attack scenarios.

  Target: Slot machines, player tracking servers, CMS workstations, cashier terminals, count room computers, surveillance workstations — any gaming-related system with exposed USB ports

• IoT / Wireless Attack · Professional

  SCAM #26: Bluetooth/Wi-Fi Slot Machine Remote Access

  Some modern slot machines and gaming peripherals include wireless connectivity for maintenance monitoring, player tracking, or remote management. Attackers can exploit these wireless interfaces to: (1) connect to unsecured Bluetooth management interfaces, (2) intercept wireless communications between machines and central servers, (3) use fake cellular base stations to hijack machines with cellular modems, (4) exploit weak or default Wi-Fi passwords on gaming networks. The IOActive DeckMate 2 research demonstrated that some devices with cellular modems could potentially be attacked without physical access — by planting a fake cellular base station nearby, tricking the device into connecting, and using that access to carry out the same exploits as the USB attack. Similar vulnerabilities could exist in slot machines with wireless connectivity if the wireless interface is not properly secured.

  Detection. Implement wireless spectrum monitoring in gaming areas to detect unauthorized Bluetooth or Wi-Fi connections. Monitor for rogue access points or cellular base stations near gaming areas. Track all wireless device connections to gaming infrastructure. Watch for individuals with equipment that could be used for wireless attacks (though modern tools are highly concealable). Implement network access control that blocks unauthorized wireless devices. Monitor for unusual network traffic patterns on wireless gaming networks.

  Countermeasures. Disable all wireless interfaces on gaming devices unless absolutely required. For necessary wireless connections, use strong encryption (WPA3 for Wi-Fi, Bluetooth LE Secure Connections) and mutual authentication. Implement wireless intrusion detection systems (WIDS) in gaming areas. Use dedicated, isolated wireless networks for gaming that do not connect to general casino Wi-Fi. Physically inspect devices to ensure wireless interfaces are disabled when not needed. Perform wireless penetration testing regularly. Monitor for unauthorized wireless devices in gaming areas. Use cellular firewalls for devices with cellular modems.

  Target: Slot machines or gaming devices with Bluetooth, Wi-Fi, or cellular connectivity; server-based gaming terminals; wireless player tracking systems; mobile gaming devices

• IoT / Wireless Attack · Professional

  SCAM #27: IoT Device Pivot Attack

  Casinos increasingly deploy Internet of Things (IoT) devices — smart thermostats, connected lighting, digital signage, environmental sensors, smart fish tanks, and more — often on the same network as critical gaming systems. Attackers exploit vulnerabilities in these often poorly secured IoT devices to gain an initial foothold, then “pivot” laterally through the network to reach gaming systems. In the famous 2017 incident, hackers breached a North American casino’s network through an internet-connected fish tank thermometer, ultimately extracting 10 GB of high-roller customer data. A similar attack targeting gaming systems could potentially reach slot machines, CMS servers, or progressive controllers. IoT devices often have weak default passwords, unpatched firmware, and no encryption — making them ideal entry points.

  Detection. Monitor network traffic from IoT devices for unusual patterns or connections to unexpected destinations. Implement network segmentation monitoring that alerts when devices communicate across segments. Track all network connections and data flows. Use device fingerprinting to identify IoT devices and monitor their behavior. Watch for unusual login attempts from IoT device IP ranges. Monitor for large data transfers from unexpected sources. Implement intrusion detection systems with IoT-specific signatures.

  Countermeasures. Strictly segment all IoT devices onto isolated networks with no connectivity to gaming systems. Implement zero-trust network architecture. Use dedicated VLANs for different device categories with firewall rules preventing cross-segment communication. Change all default IoT device passwords. Regularly update IoT firmware. Remove unnecessary internet connectivity from IoT devices. Use network access control (NAC) to enforce device compliance. Conduct regular vulnerability scanning of all IoT devices. Maintain an accurate inventory of all connected devices. Perform penetration testing that specifically includes IoT pivot scenarios.

  Target: Any casino network where IoT devices share infrastructure with gaming systems; potential targets include CMS, slot machines, player databases, progressive controllers, and financial systems

• TITO/Ticket Fraud · Intermediate

  SCAM #28: TITO Ticket Counterfeiting & Replication

  Ticket-In, Ticket-Out (TITO) systems replaced coin hoppers with printed vouchers that players use to cash out and move between machines. Criminals attempt to: (1) counterfeit TITO tickets by replicating barcodes/QR codes and security features, (2) use ticket printer vulnerabilities to generate duplicate tickets, (3) exploit race conditions where tickets are cashed multiple times at different locations before the central system updates, (4) intercept tickets from the printer output and replace them with lower-value counterfeits while keeping the original. Modern TITO systems use encrypted validation codes and centralized databases to prevent counterfeiting, but vulnerabilities in implementation — especially in older systems or improperly configured installations — can be exploited. Some attacks target the ticket printer itself, using electronic devices to trigger unauthorized ticket printing.

  Detection. Monitor for duplicate ticket redemption attempts. Track ticket validation patterns for anomalies. Watch for individuals who test multiple tickets at redemption machines or attempt to cash tickets with damaged or suspicious appearance. Compare ticket printer output counts against system records. Monitor for unusual electromagnetic activity near ticket printers. Implement real-time ticket validation that marks tickets as redeemed immediately. Watch for individuals who appear to be monitoring or interfering with ticket printer output.

  Countermeasures. Use encrypted ticket validation codes that cannot be replicated. Implement real-time centralized ticket validation that marks tickets as redeemed immediately upon cashing. Use tamper-evident ticket stock with embedded security features (watermarks, UV-reactive elements, micro-printing). Secure all ticket printers against unauthorized access. Monitor ticket inventory and reconcile against system records. Use multi-layer barcode/QR code systems with redundancy. Implement duplicate detection that flags and investigates all duplicate redemption attempts. Train cage staff to identify suspicious tickets.

  Target: TITO-enabled slot machines, ticket redemption kiosks, cashier cages that process TITO tickets

• Hybrid Electronic-Physical Attack · Intermediate

  SCAM #29: Light Wand / Optical Sensor Blind Attack

  Tommy Glenn Carmichael invented the “light wand” after slot machine manufacturers added optical sensors to track coin payouts from hoppers. The device consists of a miniature light bulb (from a camera) connected to a small battery pack, all concealed to fit up the payout chute. When inserted into the machine and activated, the intense light blinds the optical sensor that counts coins being dispensed. The machine continues to pay out coins but “sees” nothing, allowing the cheater to empty the entire hopper. The device is small enough to be concealed in a hand and used in seconds. Carmichael also developed the “monkey paw” — a flexible metal rod with piano wire that could trip the microswitch controlling the hopper directly. These devices represent the transition from purely mechanical cheating to exploiting electronic sensor systems.

  Detection. Watch for players who: (1) insert their hand or an object up the payout chute, (2) trigger payouts that seem disproportionate to their credit balance, (3) win jackpots while appearing to manipulate the machine, (4) target specific older machine models known to have optical sensors. Monitor coin hopper counts against electronic records. Track machines that show large discrepancies between recorded payouts and actual coin dispenses. Review surveillance of players who win large amounts on coin-based machines.

  Countermeasures. Replace optical coin sensors with multiple redundant counting mechanisms. Use non-optical sensors (weight-based, electromagnetic) that cannot be blinded by light. Implement secure payout chute designs that prevent insertion of foreign objects. Use ticket-based (TITO) systems that eliminate coin hoppers entirely. Install sensors that detect light anomalies in the payout area. Regularly audit payout accuracy. Remove all coin-based machines from the floor.

  Target: Slot machines with optical coin counting sensors — primarily IGT and other manufacturers’ machines from the early 1990s through early 2000s

• Hybrid Electronic-Physical Attack · Amateur / Intermediate

  SCAM #30: Top-Bottom Joint / Circuit Completion Attack

  The top-bottom joint is one of the oldest slot cheating devices, consisting of two parts: a “top” (a metal rod bent into a hook or “q” shape) and a “bottom” (a long wire, typically guitar string). The bottom wire is inserted through the coin chute up to the circuit board, making contact with the hopper control circuit. The top piece is inserted into the coin slot. Together, they complete an electrical circuit that triggers the coin hopper to dispense continuously. This attack exploits the machine’s own electrical systems by providing an alternate path for electricity to flow, effectively “hot-wiring” the hopper. Variants were developed for different machine models, with approximately 50 different wire configurations created to match specific machine internals. The device worked because early electronic slot machines had inadequate circuit protection.

  Detection. Monitor for players inserting objects into multiple machine openings simultaneously. Watch for unusual hand positioning around the machine. Track players who win large numbers of coins without visible play. Monitor hopper depletion rates. Look for players carrying guitar string or wire. Review surveillance of players who seem to be manipulating rather than playing the machine.

  Countermeasures. Redesign machine internals to isolate hopper control circuits from external access. Add circuit protection (fuses, circuit breakers) that prevent unauthorized circuit completion. Use tamper-resistant coin chute designs. Implement hopper sensors that detect unusual dispensing patterns. Replace vulnerable electromechanical systems with modern electronic controls. Remove all vulnerable legacy machines from operation.

  Target: Early electronic slot machines (1970s-1980s) with electromechanical hoppers and insufficient circuit isolation — Bally, IGT, and other manufacturers

• Online/Cashless Fraud · Intermediate

  SCAM #31: Online Slot Botting & Automated Play Fraud

  Attackers deploy automated software (bots) to play online slot machines without human intervention. These bots can: (1) play continuously 24/7 across multiple accounts and platforms, (2) exploit welcome bonuses and promotional offers through rapid automated play, (3) arbitrage differences in progressive jackpot values across online casinos, (4) systematically hunt for must-hit-by progressive opportunities across hundreds of online machines simultaneously, (5) use machine learning to optimize betting patterns. The most sophisticated bots use computer vision to “read” slot machine displays, simulate human-like clicking patterns to avoid detection, and can operate hundreds of accounts through proxy networks. Betting bots come in several varieties: scraping bots (gather odds data), arbitrage bots (exploit price differences), iceberg bots (place many small bets to avoid detection), and AI-powered bots that learn optimal strategies.

  Detection. Monitor for inhuman play patterns: perfectly consistent timing between spins, no pauses for breaks, play at statistically impossible speeds. Use device fingerprinting to identify virtual machines, emulators, and automation tools. Track IP addresses for data center proxies or VPNs. Look for multiple accounts from the same device or IP range. Monitor for play that never varies from optimal mathematical strategy. Use behavioral biometrics to distinguish human from automated mouse/keyboard patterns. Implement velocity checks on account creation and betting activity.

  Countermeasures. Implement CAPTCHA challenges at random intervals during play. Use device fingerprinting to detect and block emulators and virtual machines. Deploy behavioral biometrics that analyze mouse movements, typing patterns, and interaction timing. Require real-time video verification for high-value withdrawals. Use IP reputation scoring to block data center proxies and known VPN endpoints. Implement velocity rules that flag inhuman play speeds. Use machine learning models trained to identify bot behavior. Require identity verification (KYC) before bonus eligibility. Limit the number of bonus claims per payment method or device.

  Target: Online slot machines, virtual casinos, social casino games with real-money prizes, sweepstakes casinos, any internet-based slot gaming platform

• Online/Cashless Fraud · Amateur / Intermediate

  SCAM #32: Bonus Abuse & Multi-Account Fraud

  Online casinos offer signup bonuses, free spins, and promotional credits to attract new players. Bonus abuse involves systematically exploiting these promotions through: (1) creating multiple accounts using fake or stolen identities to claim the same bonus repeatedly, (2) using synthetic identities (combining real and fake information) to pass Know Your Customer (KYC) checks, (3) coordinating teams that share bonus exploitation strategies across platforms, (4) using stolen credit cards to fund accounts and claim deposit-match bonuses before chargebacks, (5) colluding in multiplayer games to guarantee bonus wagering requirements are met. The fraud is often automated with bot networks that create accounts, complete verification steps using AI-generated or stolen identity documents, and execute the bonus play strategy. Losses from bonus abuse are estimated at approximately 15% of total revenue for some operators.

  Detection. Monitor for multiple accounts from the same IP address, device fingerprint, or payment method. Use identity verification with liveness detection to prevent document spoofing. Track betting patterns that exist only to meet wagering requirements with minimal risk. Look for accounts that are created, claim bonuses, and are never used again. Monitor for rapid coordinated account creation across platforms. Use link analysis to identify connections between accounts. Watch for unusual deposit/withdrawal patterns (frequent small deposits followed by immediate withdrawals after bonus completion).

  Countermeasures. Implement robust identity verification with document verification, biometric matching, and liveness detection. Use device fingerprinting to link multiple accounts. Limit bonus eligibility to one per payment method, device, and identity. Implement wagering requirements with game restrictions that prevent low-risk bonus clearing. Use machine learning to identify patterns characteristic of bonus abuse. Share intelligence about known bonus abusers across operator networks (through services like IBIA). Delay bonus crediting until identity verification is complete. Implement progressive bonus unlocking that requires sustained play.

  Target: Online casino welcome bonuses, deposit match promotions, free spin offers, no-deposit bonuses, loyalty program rewards, referral bonuses

• Player-Player Collusion · Intermediate to Professional

  Scam #1: Poker Collusion Ring (Information Sharing)

  Two or more players at the same table secretly share information about their hole cards through pre-arranged signaling systems or covert electronic communication. The colluders work together to extract maximum value from non-colluding players by always having superior information about hand strengths. Signals may include hand positions, chip placement, verbal codes, foot tapping, or electronic devices. In advanced rings, players may use messaging apps on hidden phones to relay exact hole card information in real-time.

  Detection. Monitor for unusual betting patterns between specific players; excessive folding to each other’s bets; illogical folds when one player should call; consistent timing patterns; players always avoiding action against each other; unusual win rates when heads-up against each other; surveillance review of hand signals; correlation of players frequently joining and leaving tables together.

  Countermeasures. Train dealers and floor staff to recognize soft play patterns; implement table change policies that separate suspected colluders; use surveillance to monitor for signals; online: algorithmic detection of correlated play patterns, IP tracking, device fingerprinting; encourage player reporting; regular review of hand histories for statistical anomalies.

  Target: Poker (Texas Hold’em, Omaha, Stud), live and online

• Player-Player Collusion · Amateur to Intermediate

  Scam #2: Chip Dumping

  A player intentionally loses chips to a confederate at the table, usually by making obviously poor plays that transfer value. In tournaments, a large stack may deliberately lose chips to keep a short-stacked partner alive, ensuring both players cash. In cash games, chip dumping facilitates money laundering or settles debts outside the game. Methods include making huge calls with no hand and folding on the river, or building large pots and then folding to small bets.

  Detection. Look for illogical bet sizing and folds at key moments; one player consistently losing large pots to the same opponent; making terrible calls then folding to small river bets; two players frequently finding themselves in big pots together; unusual folding patterns when no logical reason exists; consistent chip transfers in one direction.

  Countermeasures. Online poker sites use algorithms to flag accounts with unusual loss patterns to specific opponents; live tournament directors should investigate when reported; train floor staff to recognize dumping patterns; disqualification and confiscation of winnings when confirmed; in serious cases, referral to gaming commission or law enforcement.

  Target: Poker tournaments and cash games, live and online

• Player-Player Collusion · Amateur

  Scam #3: Soft Playing

  Two or more players who know each other deliberately play less aggressively against one another than they would against other opponents. This includes checking down strong hands heads-up when either would have bet against a stranger, or failing to raise with premium hands when a partner is in the pot. The effect is that colluders preserve each other’s chip stacks while freely attacking non-colluding players. Unlike overt chip dumping, soft playing is subtle and harder to prove.

  Detection. Statistical analysis of aggression frequency between specific player pairs; checking strong hands down against each other consistently; avoiding standard value bets when only a partner remains; folding equity when action is between colluders but not against others; unusual checking patterns on all streets; verbal cues or visible familiarity between players.

  Countermeasures. Seat randomization in tournaments; separate players who know each other when possible; online: algorithmic detection of reduced aggression between specific accounts; player reporting systems; clear rules stating poker is an individual game; penalties from warnings to disqualification.

  Target: Poker (all variants), live and online

• Player-Player Collusion · Intermediate to Professional

  Scam #4: Hand Signaling Systems (Live Collusion)

  A team of colluders uses a pre-arranged system of physical signals to communicate hole card information. Common signals include chip placement positions, finger positions on cards, how cards are peeked, scratching patterns, posture changes, and foot tapping under the table. Advanced teams use elaborate codes: one finger on a cigarette means “I have a strong hand,” two fingers means “fold.” The signals are designed to be subtle enough to evade casual observation but clear to trained team members.

  Detection. Surveillance camera review focusing on non-verbal communication between players; observing unusual consistency in how specific players handle cards or chips; noticing repeated patterns when certain players are at the same table; reviewing footage for synchronized movements; training dealers to watch for suspicious non-verbal communication.

  Countermeasures. Multi-angle surveillance coverage of all tables; dealer training to recognize common signaling systems; pit bosses actively monitoring player interaction; strict rules against excessive non-verbal communication; separating players who appear to be communicating; using automatic shufflers to reduce opportunities for signaling.

  Target: Poker, blackjack (team play), baccarat

• Player-Player Collusion · Professional

  Scam #5: The Baccarat “Nine-Nine” Collusion Scam

  In baccarat, players seated together may engage in covert information sharing about their hands to gain an edge on side bets or to coordinate betting. In some Asian variants, players handle cards, creating opportunities for team members to signal card values through subtle gestures. A more sophisticated version involves players using hidden cameras to photograph fanned cards, then reviewing images to track card sequences through controlled shuffles.

  Detection. Watch for players consistently betting together in patterns; unusual coordination between players at the same table; repeated restroom breaks by the same player during play; suspicious phone use at the table; betting patterns that align too perfectly with outcomes; players who always seem to know when to bet player vs. banker.

  Countermeasures. Limit card handling in squeeze games to single players; monitor restroom patterns; enforce no-phone policies at baccarat tables; rotate dealers and supervisors frequently; use continuous shuffling machines; track betting patterns for statistical anomalies.

  Target: Baccarat (Punto Banco, Macau-style squeeze games)

• Player-Player Collusion (Electronic) · Intermediate to Professional

  Scam #6: Poker Collusion via External Communication (Live)

  Players at the same or adjacent tables use hidden mobile phones, earpieces, or messaging apps to share real-time hole card information. One player may text their hole cards to a confederate who advises on optimal play, or two players at the same table may communicate through concealed Bluetooth earpieces. A more sophisticated variant involves a “coach” outside the cardroom providing real-time advice based on a hidden camera feed or direct communication.

  Detection. Watch for players frequently looking at phones during hands; earpieces or unusual bulges near ears; players making uncharacteristically perfect decisions; timing delays suggesting external consultation; suspicious behavior in restrooms (where coordination may occur); unusual betting patterns consistent with additional information.

  Countermeasures. Strict no-phone policies at the table; requiring phones to be placed in phone boxes or face-down on the rail; pat-downs or visual inspections for earpieces in high-stakes games; EMF detectors to identify active electronic devices; surveillance monitoring of restroom areas; clear rules banning electronic devices during hands with penalties for violations.

  Target: Poker (all variants), high-stakes cash games

• Dealer-Player Collusion · Professional

  Scam #7: False Shuffle (Dealer Controlled Slug)

  A corrupt dealer uses sleight-of-hand techniques to create the appearance of shuffling while actually preserving a pre-arranged sequence of cards (a “slug”) in the deck. The dealer may use various false shuffle techniques: the “riffle flash” (appearing to riffle but not actually interweaving cards), the “push-through” (pushing cards through without mixing), or the “overhand false” (maintaining card order while appearing to mix). The colluding player then knows the sequence of cards that will be dealt and bets accordingly. This was the signature technique of the Tran Organization.

  Detection. Surveillance review of dealer shuffling technique; unusually high win rates by specific players at specific dealers’ tables; betting patterns that align too precisely with outcomes; players who only play at certain dealers’ tables; dealer hand movements that don’t match proper shuffling procedure; statistical analysis of shuffle randomness.

  Countermeasures. Mandatory dealer training on proper shuffle procedures; regular evaluation and testing of dealer shuffles; use of automatic shuffling machines; multi-angle surveillance specifically monitoring shuffle technique; rotating dealers frequently; separating known associates; analyzing player win rates by dealer to identify anomalies; pit bosses actively observing shuffles.

  Target: Blackjack, baccarat, Pai Gow

• Dealer-Player Collusion · Intermediate to Professional

  Scam #8: Dealer Hole Card Peeking (Flash)

  A corrupt dealer intentionally exposes the hole card to a confederate player while appearing to check for blackjack or during the deal. The dealer may lift the corner too high, angle the card toward a specific seat, or use a controlled dealing motion that flashes the card value. In exchange for a share of winnings, the dealer provides this inside information that gives the player a massive mathematical edge. The player may also signal other team members at the table.

  Detection. Review surveillance for dealers who consistently expose hole cards; analyze win rates of players at specific dealers’ tables; watch for players who suddenly make perfect playing decisions; unusual deviations from basic strategy that align with hole card knowledge; players who appear to be looking at the dealer’s cards during the deal or blackjack check.

  Countermeasures. Use of hole card readers/scanners instead of manual peeking; dealer training on proper card handling; surveillance review of dealer technique; pit boss observation; player awareness of which dealers are most likely to flash cards; proper table layout ensuring hole cards are protected from all angles.

  Target: Blackjack, Three Card Poker, Caribbean Stud, other hole-card games

• Dealer-Player Collusion · Professional

  Scam #9: Dealer-Player Card Sequencing (Baccarat)

  In baccarat, a corrupt dealer may agree to skip shuffling a section of the deck after cards are fanned and shown to players. The player uses a hidden camera (often a smartphone) to photograph the fanned cards, then excuses themselves to the restroom to review the images. Since a portion of the deck retains its original order, the player only needs to recognize the sequence pattern when those cards reappear, allowing them to predict outcomes and place massive bets accordingly.

  Detection. Monitor for players taking frequent restroom breaks during play; observe if specific players always play at certain dealers’ tables; watch for phone use during card fanning; unusually large bets that correlate with specific card sequences; analyze shuffle procedures to verify completeness; track players who seem to know outcomes before cards are revealed.

  Countermeasures. Ensure complete shuffling of all cards every time; train dealers never to skip portions of the shuffle; monitor player restroom patterns; enforce no-phone policies during card fanning; use automatic shufflers; rotate dealers regularly; separate known associates; review surveillance of suspected dealers’ shuffles.

  Target: Baccarat

• Dealer-Player Collusion · Intermediate

  Scam #10: Dealer Overpayment / Shorting Opponents

  A corrupt dealer intentionally overpays a confederate player on winning hands while short-paying non-colluding opponents on their wins. The dealer may pay at incorrect odds, add extra chips to payouts, or “forget” to collect losing bets from the partner. This can be done subtly by miscounting chips, using chip manipulation techniques, or exploiting busy periods when pit supervision is minimal. The partner typically tips the dealer generously to share profits.

  Detection. Regular audit of dealer payout accuracy; surveillance review of payouts to specific players; unusual tipping patterns; consistent overpayment by specific dealers to specific players; player win rates significantly above expected at particular dealers’ tables; complaints from other players about being shorted.

  Countermeasures. Mandatory payout verification procedures; regular audits of dealer accuracy; surveillance monitoring of payouts; mandatory immediate correction of all payout errors by floor supervisors; separating known associates; rotating dealers; player complaint tracking; analyzing dealer accuracy statistics.

  Target: Blackjack, baccarat, all table games

• Dealer-Player Collusion · Intermediate to Professional

  Scam #11: Bet Capping / Past Posting with Dealer Cooperation

  A corrupt dealer allows a confederate player to add chips to a winning bet after the outcome is known (past posting/capping), or remove chips from a losing bet (pinching). The dealer either ignores the move, actively covers for it through misdirection, or deliberately looks away at the critical moment. This can also involve the dealer falsely claiming a bet was placed before the outcome when it was actually posted late. Without dealer cooperation, these moves carry high risk of detection.

  Detection. Surveillance review of betting actions around outcome determination; dealer inattention during critical moments; consistent tolerance of suspicious betting behavior by specific dealers; unusually high win rates for specific players; analysis of bet timing relative to game outcome.

  Countermeasures. Train dealers to never look away from the layout during critical moments; mandatory procedure of announcing “no more bets” clearly; pit boss vigilance; surveillance monitoring of betting patterns; clear policies that dealers must not correct their own mistakes without floor approval; regular review of dealer game protection practices.

  Target: Blackjack, all table games

• Team Play · Professional

  Scam #12: Big Player Team System (MIT-Style)

  A coordinated team of players uses a “spotter” at the table who counts cards and signals a “Big Player” (BP) to join when the count is favorable. The spotter plays minimum bets while maintaining the count, then uses covert signals (hand on neck, chip placement, posture changes) to indicate when the count is positive. The BP then sits down and places large bets, knowing the deck is favorable. This system reduces the BP’s exposure time and makes betting patterns less suspicious since the BP only plays positive counts. Variations include the Controller (who verifies the count) and the Gorilla (a non-counter who follows signals).

  Detection. Watch for players who enter and leave tables frequently; players who only play a few hands then leave; coordinated movement between tables; non-verbal signals between players; unusually high win rates for players who selectively join games; players who seem to know when to join without watching the game.

  Countermeasures. “No mid-shoe entry” policies; track player movement between tables; surveillance monitoring of table entry/exit patterns; train staff to recognize common signals; limit table hopping; analyze win rates of players who frequently change tables; use continuous shufflers to nullify card counting.

  Target: Blackjack

• Team Play · Professional

  Scam #13: Gorilla BP System

  A variation of the Big Player system where the BP (“Gorilla”) is deliberately NOT a card counter. The Gorilla is typically a high-energy, seemingly intoxicated player who makes all betting and playing decisions based entirely on signals from a spotter at the table. The Gorilla’s cover is that of a wealthy, impulsive gambler whose erratic bets are attributed to alcohol or personality rather than system play. This allows teams to deploy BPs who require minimal training and can adopt convincing covers. The spotter must think faster than the Gorilla plays, making this a demanding role.

  Detection. Same as Big Player detection, plus: players who appear intoxicated but make perfect playing decisions; players who pause noticeably before certain decisions (waiting for signals); players who never look at cards in a way that suggests counting; unusually good play from seemingly casual gamblers; consistent pairing of specific “drunk” players with particular spotters.

  Countermeasures. Same as Big Player countermeasures; additionally, observe whether seemingly intoxicated players actually display reduced skill; monitor player interactions between apparent strangers; watch for unnatural pauses before decisions.

  Target: Blackjack

• Team Play · Professional

  Scam #14: Back-Spotter System

  A team member stands behind the table without playing, counting cards as an observer. When the count becomes favorable, the back-spotter signals a Big Player to join the table. This variation minimizes the spotter’s financial exposure (since they don’t place bets) and allows one spotter to monitor multiple tables simultaneously. In team configurations, multiple back-spotters may cover a pit, each signaling a central BP who moves between favorable tables.

  Detection. Watch for individuals who stand behind tables for extended periods without playing; coordinated movement between a standing observer and seated players; repeated pattern of a player joining a table shortly after an observer arrives; multiple observers covering different tables in the same pit.

  Countermeasures. “No standing behind tables” policies during busy periods; ask observers to either sit and play or move along; surveillance monitoring of non-players observing games; table entry timing analysis; mid-shoe entry restrictions.

  Target: Blackjack

• Team Play (Dealer Collusion Network) · Professional

  Scam #15: The Tran Organization Model

  A comprehensive cheating system where an organized group controls every aspect of the table: the dealer executes false shuffles, spotters track cards, bettors place wagers based on known sequences, and computer operators analyze patterns from remote locations. The organization recruited dealers at multiple casinos, expanded to include extended family members and associates, and used sophisticated electronic devices to relay information. Card trackers used concealed devices to transmit card order to remote computer operators who identified patterns and relayed betting instructions.

  Detection. Comprehensive analysis of win rates by dealer-player combinations; surveillance review of shuffle techniques; electronic sweeps for transmitting devices; monitoring of known associates across multiple properties; analysis of betting patterns that align with unshuffled card sequences; review of dealer schedules and player attendance patterns.

  Countermeasures. Thorough background checks for dealer hires; integrity testing of dealers; electronic detection sweeps; information sharing between casinos about known cheats; use of automatic shufflers; rotating dealers frequently; surveillance monitoring of all shuffle procedures; cross-property alert systems.

  Target: Blackjack, Pai Gow, baccarat

• Hole Carding · Intermediate

  Scam #16: First-Basing (Basing)

  A player seated at first base (the position immediately to the dealer’s left) exploits sloppy dealer technique when the dealer checks for blackjack. If the dealer lifts the corner of their hole card too high or angles it toward first base while checking under their up-card, a sharp-eyed player can glimpse the card value. This information provides a massive mathematical edge, allowing the player to make perfect playing and doubling decisions. First-basing is most effective against dealers who check hole cards manually rather than using electronic readers.

  Detection. Watch for players who strain or lean when the dealer checks for blackjack; players at first base making unusually perfect decisions; players who only play at tables with specific dealers; players who request or wait for first base specifically; dealers known for sloppy hole card checking technique.

  Countermeasures. Use electronic hole card scanners instead of manual peeking; train dealers on proper card-checking technique (keeping cards low and parallel to the table); use “peekers” or mirrors that don’t require card lifting; ensure adequate lighting doesn’t create reflections on card surfaces; seat players so the hole card is not angled toward any seat.

  Target: Blackjack

• Hole Carding · Professional

  Scam #17: Spooking

  A two-person team technique where the “spook” is positioned behind or to the side of the dealer (not seated at the table) to read the dealer’s hole card when the dealer checks for blackjack. The spook then signals the information to a Big Player seated at the table. Unlike first-basing, the spook doesn’t need to be a seated player, providing a better viewing angle. The signal may be as simple as moving to a specific position, touching their face, or using electronic devices. Spooking is generally considered illegal in most jurisdictions (unlike first-basing, which occupies a legal gray area).

  Detection. Watch for individuals standing behind the dealer who appear to be observing the dealer’s cards; signals between standing observers and seated players; players making perfect decisions after looking toward a standing person; coordination between a seated player and a non-player observer.

  Countermeasures. Restrict non-players from standing behind the dealer; position tables so the dealer’s back is to a wall when possible; use electronic hole card readers; train dealers on proper card handling; alert floor staff to question individuals lingering behind tables.

  Target: Blackjack

• Hole Carding · Intermediate

  Scam #18: Front-Loading

  A technique used in games where the dealer loads their own hole cards under an up-card during the deal. If the dealer holds the cards too high or at the wrong angle when placing the hole card under the up-card, players at certain seats can see the card value. This is particularly exploitable in poker-based games like Three Card Poker, Caribbean Stud, and Mississippi Stud where dealers handle their own cards. The player gains an edge by knowing one or more of the dealer’s cards before making betting decisions.

  Detection. Players consistently making optimal folding/raising decisions that align with dealer card knowledge; players requesting specific seats; dealers whose card-handling technique exposes cards; surveillance review of dealer loading technique from player angles.

  Countermeasures. Train dealers to keep cards low and parallel to the table surface when loading; use shufflers that minimize dealer card handling; position tables and shufflers to prevent exposure; regular evaluation of dealer technique from all player positions; surveillance cameras positioned to see what players see.

  Target: Three Card Poker, Caribbean Stud, Mississippi Stud, Ultimate Texas Hold’em

• Hole Carding · Intermediate

  Scam #19: Hole Carding in Pitch Games

  In pitch-style blackjack (where the dealer holds the deck and pitches cards face-down to players), sloppy dealers may inadvertently flash the value of cards during the pitching motion. A player seated in the right position can read these flashes. Similarly, when dealers check hole cards under tens or face cards, they may expose the card to certain seats. This also applies when dealers handle their own cards in poker variants. The technique requires careful seat selection and keen observation.

  Detection. Players who consistently select specific seats; leaning or positioning to see dealer’s cards; perfect playing decisions that suggest hole card knowledge; players who appear to track specific dealers and avoid others.

  Countermeasures. Train dealers on proper pitch technique (low, flat delivery); use shoes instead of pitch when possible; position lighting to prevent card reflection; ensure dealer’s body position blocks card exposure to all seats; regular technique evaluation.

  Target: Pitch blackjack, single/double deck games, dealer-handled card games

• Edge Sorting · Professional

  Scam #20: Edge Sorting (Phil Ivey Method)

  Edge sorting exploits unintentional asymmetries in the back design of playing cards. Many card decks have backs that are not perfectly symmetrical when rotated 180 degrees - one long edge may show a slightly different pattern than the other. The player asks the dealer to rotate “lucky” high-value cards (7s through 9s in baccarat) during initial play under the guise of superstition. Once the shoe is completed, all high cards are oriented one way and low cards the other. After an automatic shuffle (which preserves orientation), the player can distinguish high from low cards by observing which edge pattern is visible, gaining a significant statistical edge.

  Detection. Watch for unusual requests to rotate cards; players asking for specific card brands; requesting automatic shufflers; requesting to keep the same decks across multiple shoes; players who seem unusually interested in card backs; abnormally high win rates on games where edge sorting is possible.

  Countermeasures. Use only cards with fully symmetrical back designs; never rotate cards at player request for any reason; use shuffling methods that randomize card orientation; inspect new card decks for manufacturing asymmetries before use; train dealers to politely decline card rotation requests regardless of player status; use “turning” procedures that randomize orientation.

  Target: Baccarat (primarily), Pai Gow, any game where card orientation matters

• Shuffle Tracking (Advantage Play) · Professional

  Scam #21: Shuffle Tracking

  A technique where advantage players memorize sequences of cards as they are played, then track these “slugs” (groups of cards) through the dealer’s shuffle process. By understanding how a particular casino’s shuffle procedure distributes cards, the player can predict when a favorable slug (rich in tens and aces) or unfavorable slug (rich in low cards) will appear in the next shoe. When a favorable slug is predicted to be dealt, the player increases bets dramatically. The technique requires exceptional memory, understanding of shuffle mechanics, and careful observation.

  Detection. Players who pay intense attention to the shuffle process; players who track discards visually; unusual bet increases that align with specific points in the shoe; players who scout games and note shuffle procedures; bet patterns that suggest knowledge of upcoming card groups rather than just count-based betting.

  Countermeasures. Use complex shuffle procedures with multiple riffles, strips, and cuts; use automatic shufflers that randomize more thoroughly than manual shuffles; change shuffle procedures regularly; use continuous shufflers (which completely eliminate shuffle tracking); limit deck penetration; train dealers on thorough, randomized shuffling.

  Target: Blackjack

• Shuffle Tracking · Professional

  Scam #22: Key Card Sequencing (Slug Prediction)

  A variation of shuffle tracking where players identify “key cards” - specific cards whose appearance signals that a favorable slug follows. By memorizing which cards appeared before a high-value slug in the discard tray, the player watches for those key cards to reappear after the shuffle. When key cards are dealt, the player knows the favorable slug is coming and increases bets. This reduces the memory burden of full shuffle tracking to remembering just a few key indicator cards.

  Detection. Same as shuffle tracking detection; players who seem to bet based on specific cards rather than overall count; players who visually track the discard tray intently.

  Countermeasures. Same as shuffle tracking countermeasures; particularly effective is using shuffling procedures with sufficient randomization to break up all card sequences.

  Target: Blackjack

• Ace Sequencing (Advantage Play) · Professional

  Scam #23: Ace Sequencing

  An advanced technique where players track the position of aces through the shuffle process to predict when they will be dealt. Since aces are the most valuable cards in blackjack (creating blackjacks with any ten-value card), predicting their appearance provides a massive advantage. Players memorize sequences of cards immediately preceding each ace in the discard tray. During the shuffle, they watch for these “key card” sequences to reappear. When the sequence is spotted, the player knows an ace is likely coming and can increase bets or make strategic plays accordingly. In team play, one member watches for key cards while another places bets.

  Detection. Players who visually track aces and surrounding cards intently; unusual bet increases when specific card sequences appear; players who focus heavily on the discard tray; coordinated team play where one player signals another; bet patterns that spike predictably after certain card combinations.

  Countermeasures. Use automatic shuffling machines designed to fully randomize card order; implement multi-step shuffle procedures that break up all sequences; use continuous shufflers; change decks frequently; limit the number of decks in play; train dealers on thorough shuffling technique.

  Target: Blackjack

• Ace Sequencing (Team Play) · Professional

  Scam #24: Ace Steering (Team Play)

  A team-based ace sequencing variant where one team member’s primary role is to ensure aces are dealt to the team’s Big Player rather than to other players or the dealer. The “steerer” uses card counting and shuffle tracking to predict when an ace is coming, then manipulates the cut card or signals the BP to adjust their position or betting to receive the ace. This is extremely difficult to execute and requires intimate knowledge of dealing mechanics and shuffle procedures.

  Detection. Unusual frequency of aces being dealt to specific players; coordinated team movement around ace predictions; manipulation of cut card positioning; players who focus intently on cut card placement.

  Countermeasures. Standard shuffle tracking countermeasures; dealer control of cut card placement; eliminating player-cut procedures; using automatic shufflers; surveillance monitoring of unusual card distributions.

  Target: Blackjack (team play)

• Electronic Signaling Device · Professional

  Scam #25: Vibrating/Signaling Button Devices

  Small electronic devices hidden on a cheater’s person (in pockets, shoes, belts, or clothing) that receive signals from an accomplice and communicate through vibrations. One buzz might mean “bet,” two buzzes “fold,” three buzzes “raise.” The accomplice may have access to hole card information through hidden cameras, shuffler hacking, or other means. These devices are specifically designed to be undetectable to surveillance and can only be found through physical pat-downs or electronic sweeps. Some require magnets for removal, making them nearly invisible.

  Detection. Electronic sweeps (RF detectors); physical pat-downs for concealed devices; watch for players who seem to receive information without obvious sources; players who touch specific body areas before decisions; unusual betting accuracy; EMF detection equipment.

  Countermeasures. Regular electronic sweeps of gaming areas; physical inspection of players in high-stakes games when legally permissible; no-device policies with enforcement; faraday cage considerations for sensitive areas; awareness that these devices exist and are widely available online.

  Target: Poker, blackjack, baccarat, any card game

• Electronic Signaling Device · Professional

  Scam #26: Radio Transmitter Collusion System

  A comprehensive electronic cheating system where hidden radio transmitters and receivers facilitate real-time communication between colluders. One player may wear a hidden microphone or have a concealed camera transmitting to an accomplice in a remote location (parking lot, hotel room) who analyzes the situation and transmits instructions back via earpiece or vibration device. Systems can include hidden cameras in clothing, Bluetooth earpieces concealed in ears, induction loop receivers, and cell phones configured for covert operation.

  Detection. RF scanning equipment; physical searches; watch for players who seem to be receiving instructions; delayed decision-making suggesting external consultation; Bluetooth signal detection; cellular signal anomalies in gaming areas; unusual antenna-like protrusions from clothing or accessories.

  Countermeasures. RF detection sweeps; jamming devices in high-stakes areas (where legal); physical inspections; no-phone policies; surveillance monitoring for unusual behavior; shielding gaming areas from external radio signals; awareness training for staff on what to look for.

  Target: Poker, blackjack, baccarat, all card games

• Electronic Device · Intermediate

  Scam #27: Smartphone App Collusion (Concealed Use)

  A player hides a smartphone on their person (in a pocket, on their lap, in a bag) and uses it to receive real-time information during play. This may include text messages with hole card information from a confederate, access to a hacked shuffler’s camera feed, consultation of strategy charts or solvers, or communication with an external advisor. Players may pretend to check messages while actually receiving critical game information. In livestreamed games, a player might access the stream with a delay to see opponent hole cards.

  Detection. Watch for players looking at laps or pockets during hands; unusual timing of decisions; players who always have phones nearby; bulges in pockets; screen illumination visible through clothing; players who seem to know more than they should about hidden cards.

  Countermeasures. Strict no-phone policies at the table; require phones to be placed in phone lockers or face-up on the rail; physical pat-downs for concealed devices in high-stakes games; surveillance cameras positioned to see under table areas; enforce penalties for phone use during hands.

  Target: Poker (especially livestreamed games), all card games

• Hidden Camera / Electronic Device · Professional

  Scam #28: Hidden Camera Card Reading System

  A cheater conceals a miniature camera on their person (in clothing pockets with holes, on the table disguised as a phone/power bank/hat, or in accessories like watches or jewelry) positioned to capture card faces as they are dealt from the shoe. The camera feed is transmitted to an accomplice outside the game area who can read the cards and relay information back via earpiece or vibration device. In some cases, the camera connects directly to a smartphone with image recognition software. Modern spy cameras can be hidden in pens, lighters, buttons, and glasses.

  Detection. Physical inspection of items on or near the table; watch for unusual object placement near the dealer’s shoe; clothing with suspicious holes or bulges; players who position items to face the dealing area; electronic sweeps for transmitting devices; review footage for players placing objects near dealing areas.

  Countermeasures. Restrict items on the table (no hats, large objects, or unnecessary electronics); position shoes to minimize card exposure; train dealers on slide-dealing techniques that minimize card visibility; use shufflers with protective covers; physical inspections; multi-angle surveillance; awareness of common concealment devices.

  Target: Poker, blackjack, baccarat, any dealt card game

• Electronic Device · Intermediate

  Scam #29: Smartwatch / Wearable Card Reader

  Modern smartwatches and wearable devices can be used for various cheating applications: receiving text messages with card information, running solver apps for real-time strategy advice, displaying card counting calculators, vibrating with pre-programmed signals, or even running custom apps that interface with external card-reading systems. Some specialized “poker watches” have been marketed specifically for cheating. Fitness bands, smart rings, and other wearables offer additional concealment options.

  Detection. Look for players frequently checking wrist devices during hands; tapping or touching watch faces during play; unusual timing of decisions; players who wear multiple or oversized watches; Bluetooth signal detection; electronic sweeps.

  Countermeasures. Ban smartwatches and electronic wearables in gaming areas; require players to remove watches before play; RF detection; physical inspection of wearable items; enforce clear policies about permitted electronic devices.

  Target: Poker, blackjack, any card game

• Hidden Camera / Electronic Device · Professional

  Scam #30: Card-Reading Pen / Lighter Concealment

  Miniature cameras and card-reading sensors can be concealed in everyday objects like pens, lighters, keychains, car keys, and ashtrays. These devices capture card images and transmit them wirelessly to an accomplice. The objects appear completely normal and raise no suspicion when placed on a table. Some versions include built-in memory for later review. Advanced versions can interface with smartphone apps for real-time analysis and transmission.

  Detection. Physical inspection of objects on the table; watch for players who always place specific objects in the same position; electronic sweeps for transmitting devices; awareness that common objects may contain hidden cameras; watch for objects positioned to face the dealing area.

  Countermeasures. Restrict non-essential items on gaming tables; provide casino-approved pens and accessories; physical inspection of suspicious items; electronic detection sweeps; awareness training for dealers and floor staff on concealment possibilities.

  Target: Poker, blackjack, any card game

• Marked Cards / Optical Cheating · Professional

  Scam #31: Infrared Marked Cards with Contact Lenses

  Playing cards are marked on the backs with invisible infrared ink that is completely invisible to the naked eye and standard cameras (which have IR-cut filters). The cheater wears special contact lenses or glasses with infrared band-pass filters that make the markings glow clearly, allowing them to read card values without any visible indication of cheating. The lenses use a micro-filter embedded in the pupil area (5-8mm diameter) that appears as a slightly tinted contact lens but is hard to detect in normal conditions. The system emits no electronic signals, making it completely invisible to RF detectors.

  Detection. Use surveillance cameras with IR capability to detect abnormal reflections on card backs; inspect cards regularly for invisible markings using UV/IR lights; watch for players wearing tinted contact lenses or unusual glasses; players who make decisions with uncanny accuracy; card handling checks by dealers; regular deck replacement with verified clean decks.

  Countermeasures. Use RFID-enabled or barcode-marked secure decks; inspect new decks for manufacturing defects or aftermarket marking; regular deck changes; use UV/IR detection lights to inspect cards; purchase cards only from trusted manufacturers; train dealers to notice inconsistent card handling; consider using casino-specific custom card designs that are harder to obtain and mark.

  Target: Poker, blackjack, baccarat, any card game

• Marked Cards / Electronic Device · Professional

  Scam #32: Barcode Marked Cards with Scanner

  Cards are marked on their edges with invisible barcodes (printed with UV or IR ink). A concealed scanner - hidden in a chip tray, phone case, or other table object - reads these barcodes and instantly identifies each card. The information is relayed to the cheater via smartphone, earpiece, or vibration device. Unlike traditional marked cards that require human reading, barcode systems provide perfect, instant identification of every card. The FBI’s 2025 illegal gambling indictment specifically mentioned “invisibly marked cards” and “electronic poker chip trays” as tools used by the alleged cheating ring.

  Detection. Electronic sweeps for scanning devices; inspect cards for edge markings under UV/IR light; watch for suspicious objects on the table that could conceal scanners; monitor for players receiving electronic signals; inspect chip trays and table accessories for hidden electronics.

  Countermeasures. Use secure, verified card decks; inspect all cards and equipment regularly; restrict non-standard equipment on tables; electronic detection sweeps; use casino-provided accessories only; implement strict controls on which cards enter play.

  Target: Poker, all card games

• Electronic Device / Shuffler Hacking · Professional

  Scam #33: DeckMate 2 Shuffler Hacking

  The DeckMate 2 automatic card shuffler contains an internal camera designed to verify that all 52 cards are present. Security researchers discovered that by inserting a small device (Raspberry Pi or USB drive) into an exposed USB port on the shuffler, attackers can compromise the machine’s software and access this camera feed. The camera reveals the exact order of all cards in the deck, which can then be transmitted via Bluetooth to a cheater’s smartphone. A remote operator can view all player hands and determine optimal plays, relaying instructions to players at the table. The attack exploits hard-coded manufacturer passwords that are identical across all devices.

  Detection. Physical inspection of shufflers for attached devices; watch for small electronics connected to USB/Ethernet ports; unusual Bluetooth activity near shufflers; monitor for players who seem to know opponent hands; analyze win rates at tables with specific shufflers; check shuffler firmware integrity.

  Countermeasures. Disable or cover exposed USB/Ethernet ports on shufflers; regularly update shuffler firmware; conduct physical inspections of shufflers; use only manufacturer-maintained devices; monitor for unauthorized personnel accessing shuffler internals; implement shuffler authentication protocols; secure shufflers when not in use; use second-generation shufflers with improved security.

  Target: Poker (primarily), blackjack, baccarat

• Electronic Device / Internal Collusion · Professional

  Scam #34: Shuffler Insider Compromise (Maintenance/Employee)

  A rogue maintenance employee or casino insider with access to shuffler internals installs a backdoor or compromise during routine maintenance. Unlike the external USB hack, this attack is performed by someone with legitimate access to the shuffler’s internal components. The insider may install modified firmware, add wireless transmission capabilities, or create other persistent compromises that are extremely difficult to detect. Second-hand or black-market shufflers are particularly vulnerable as they may have been pre-compromised before reaching their current location.

  Detection. Maintain chain-of-custody records for all shufflers; regular firmware integrity checks; only allow manufacturer-authorized technicians to service shufflers; monitor for unauthorized access to shuffler storage areas; compare shuffler performance against baseline; watch for unusual electronic emissions from shufflers.

  Countermeasures. Use only manufacturer-direct shuffler purchases with maintenance contracts; require background checks for all maintenance personnel; implement tamper-evident seals on shuffler enclosures; conduct regular firmware audits; maintain secure storage for spare shufflers; prohibit third-party maintenance on gaming equipment.

  Target: Poker, blackjack, baccarat, all shuffler-dependent games

• Online Poker Cheating · Intermediate to Professional

  Scam #35: Poker Bots (Automated Play Software)

  Software programs that play poker automatically without human intervention. Bots use artificial intelligence, game theory optimal (GTO) algorithms, or machine learning to make decisions. Modern bots can operate 24/7 across multiple tables simultaneously, maintaining consistent optimal play that human opponents cannot match. Bots range from simple scripted programs to sophisticated AI systems that adapt to opponent tendencies. They are particularly prevalent on unregulated or lightly regulated sites where detection infrastructure is minimal.

  Detection. Monitor for superhuman consistency in decision timing; analyze play patterns for GTO-perfect frequencies across huge hand samples; track mouse movement patterns (bots often show mechanical input patterns); identify accounts that play impossibly long sessions without breaks; flag accounts with decision timing that is too consistent; behavioral analysis comparing to known bot patterns.

  Countermeasures. Deploy dedicated bot detection teams; use behavioral analysis software to flag suspicious accounts; implement CAPTCHA or human verification challenges; monitor for software running alongside the poker client; use device fingerprinting to identify automation tools; analyze hand histories for bot-like patterns; require webcam verification for high-stakes play; share bot detection data across platforms.

  Target: Online poker (all variants)

• Online Poker Cheating · Intermediate to Professional

  Scam #36: Real-Time Assistance (RTA) / Solver Use During Play

  A player runs poker solver software (PioSolver, GTO+, or similar) on a separate computer or device while playing, inputting the current hand situation and receiving mathematically optimal strategy recommendations in real-time. This gives the player a massive advantage since they are effectively playing with perfect GTO strategy while opponents make human mistakes. RTA eliminates the skill element of poker by reducing it to a contest of who has better software. Modern RTA setups can automatically read the poker client and provide recommendations within seconds.

  Detection. Flag accounts with unusually consistent near-GTO play across large samples; monitor for complex decisions made in suspiciously short or long times; compare player decisions to known solver outputs; check for software running alongside the poker client; analyze whether play patterns match solver recommendations with statistical improbability; look for accounts that never make “obvious” mistakes.

  Countermeasures. Develop detection algorithms that compare play patterns to solver outputs; monitor client-side processes for known solver software; use timing analysis to flag inhuman decision patterns; require screen sharing or webcam verification for suspected accounts; employ former professional players as game integrity analysts; maintain updated databases of RTA software signatures; ban and confiscate funds from confirmed users.

  Target: Online poker (all variants, primarily high-stakes)

• Online Poker Cheating · Intermediate

  Scam #37: Ghosting (Account Sharing)

  A less-skilled player allows a more skilled player (the “ghost”) to take over their account during critical moments of a tournament or high-stakes game, typically in late stages where decisions are most consequential. The ghost may physically take control of the computer or access the account remotely. Since online poker opponents cannot see who is actually making decisions, they believe they are playing against the original account holder. Ghosting also includes skilled players coaching others in real-time through headsets or messaging apps during play.

  Detection. AI-based behavioral analysis monitoring for sudden shifts in play style; compare bet sizing, aggression levels, and decision speed between early and late tournament stages; flag accounts showing dramatic improvement in late stages; monitor login patterns for remote access; track IP address changes during sessions; analyze whether decision patterns match the account’s historical play.

  Countermeasures. Implement behavioral analysis that flags sudden play style changes; require identity verification for tournament winners; monitor for IP address and device changes during sessions; use continuous authentication analyzing play patterns; encourage player reporting; implement video verification for major tournament final tables; ban account sharing explicitly in terms of service.

  Target: Online poker (tournaments and high-stakes cash games)

• Online Poker Cheating · Amateur to Intermediate

  Scam #38: Multi-Accounting

  A single player creates and operates multiple accounts on the same poker site, often using different identities. This provides several unfair advantages: the player can hide their true playing style by rotating accounts, gather more data on opponents than permitted, play at the same table as themselves (self-collusion), enter the same tournament multiple times to increase winning chances, and avoid detection by spreading play across aliases. In its most egregious form, a player controls multiple seats at a single table, seeing multiple hands and coordinating play between their own accounts.

  Detection. IP address tracking (multiple accounts from same IP); device fingerprinting; correlated account activity patterns; identical betting styles or timing patterns across accounts; linked payment methods or banking information; accounts that never play against each other; shared login times; behavioral biometrics comparing decision patterns; unusual fund transfers between accounts.

  Countermeasures. Strict KYC (Know Your Customer) verification; IP and device tracking; require unique payment methods per account; behavioral analysis comparing play patterns across accounts; limit number of accounts per person (ideally one); detect and flag shared device usage; cross-reference personal information during registration; implement device fingerprinting technology.

  Target: Online poker

• Online Poker Collusion · Intermediate

  Scam #39: Collusion Rings (Online)

  A group of players who know each other in real life form a ring to share hole card information while playing online. They typically use external communication methods (encrypted messaging apps like Telegram, Discord, Skype, or phone calls) to tell each other their hole cards in real-time. With knowledge of multiple hands, the colluders can coordinate betting to extract maximum value from non-colluding players or avoid losing to each other. Advanced rings use screen sharing so all members can see each other’s cards directly.

  Detection. Flag accounts with correlated activity patterns (same login times, similar session lengths); analyze hand histories for soft playing patterns between specific accounts; detect accounts that fold too often to each other in big pots; review chat logs for suspicious communication; IP geolocation analysis for accounts in same area that always play together; statistical analysis of aggression patterns between account pairs.

  Countermeasures. Advanced algorithmic detection of correlated play patterns; IP and geolocation tracking; encourage player reporting with hand history evidence; employ data scientists to identify collusion patterns; network analysis to identify clusters of potentially colluding accounts; monitor for shared device fingerprints; implement delayed hand history sharing to prevent real-time data analysis.

  Target: Online poker (cash games and tournaments)

• Online Poker Cheating (Insider Fraud) · Professional (requires insider access)

  Scam #40: Superuser Account Exploitation

  An insider (typically a company executive, software developer, or administrator) uses privileged access to view all players’ hole cards in real-time during play. This “God Mode” or “superuser” access was originally built into poker software for testing, auditing, or customer service purposes. Unscrupulous insiders or their associates create player accounts with superuser privileges, allowing them to see every opponent’s cards and play with perfect information. The cheating is nearly undetectable from the player side since the cheater appears to simply be an exceptionally skilled player making impossibly good reads.

  Detection. Statistical analysis of play that is “too perfect” - bluffing only when opponents are weak, folding with uncanny precision; flag accounts with win rates far beyond statistical possibility; review administrative access logs; audit which accounts had special privileges; monitor for accounts that never make mistakes in big pots; community reporting when a player’s decisions seem impossibly accurate.

  Countermeasures. Strict separation of administrative and player accounts; comprehensive audit logging of all privileged access; independent security audits of software code; restrict superuser functionality to isolated, monitored environments; implement least-privilege access principles; require multi-person authorization for privileged operations; regular code reviews to identify backdoors; independent game integrity monitoring by third parties.

  Target: Online poker

• Electronic Device / RFID Exploitation · Professional

  Scam #41: RFID Card Scanning and Exploitation

  RFID-enabled playing cards contain embedded microchips that transmit card identity (rank and suit) when scanned. These are legitimately used for livestream broadcasts and tournament tracking. Cheaters can exploit this technology by introducing pre-loaded RFID decks into games, then using concealed card-reading devices (scanners hidden in clothing, bags, or on the person) to read the RFID signals. The card data is then relayed in real-time via smartwatch, earpiece, or vibration alerts, effectively revealing all card values to the cheater.

  Detection. Electronic sweeps for unauthorized RFID readers; inspect cards to verify they are the casino’s standard decks; watch for players with suspicious electronic devices; monitor for unusual betting accuracy; check for deck substitution (comparing RFID signatures of in-play decks to approved decks); physical inspection of player belongings for scanning devices.

  Countermeasures. Use custom-designed cards unique to the casino; implement RFID signature verification for all decks entering play; secure storage and chain-of-custody for RFID decks; electronic sweeps for unauthorized readers; restrict deck handling to authorized personnel only; use encrypted RFID protocols that cannot be read by standard scanners; monitor game areas for unauthorized electronic devices.

  Target: Poker rooms using RFID-enabled cards for livestreams or tracking

• Electronic Surveillance Exploitation · Intermediate to Professional

  Scam #42: Livestream Hole Card Information Exploitation

  In livestreamed poker games, RFID readers transmit all players’ hole cards to the production control room for broadcast. If security is inadequate, this information can be leaked to players at the table through various methods: a compromised production crew member texting information, a player accessing the livestream on a delay, a hidden receiver picking up the RFID signals directly, or a hacked feed providing real-time data. The Mike Postle scandal at Stones Gambling Hall exemplified this vulnerability, where it was theorized that Postle accessed the livestream data to see opponents’ hole cards.

  Detection. Monitor whether players have access to livestream feeds during play; secure the production control room with strict access controls; use broadcast delays sufficient to prevent real-time exploitation; monitor for unauthorized access to hole card data; watch players for behavior suggesting advance knowledge of cards (unusual folds, perfect bluff timing); secure all network infrastructure transmitting card data.

  Countermeasures. Implement strict compartmentalization of hole card data - only essential production staff should see real-time cards; secure the production room with no phones or external communication devices; use sufficient broadcast delay (at minimum several minutes); encrypt all RFID data transmissions; monitor network traffic for unauthorized access; conduct background checks on all production staff; implement logging of all access to hole card data; physically secure all RFID receiving equipment.

  Target: Livestreamed poker games, televised tournaments

• Bet Manipulation · Intermediate

  Scam #44: Bet Capping / Pressing

  A specific form of past posting where a player adds additional chips to an existing winning bet after the outcome is known, making it appear the larger bet was always in place. The cheater may distract the dealer with conversation, a tip gesture, or other misdirection while adding chips. They may also knock over their bet stack and “rebuild” it with extra chips hidden in their hand. The goal is to increase payout on hands the player already knows they’ve won.

  Detection. Same as past posting detection; specifically watch for players reaching toward their bets after outcomes are known; players who frequently knock over chip stacks; “rebuilding” bets that result in larger stacks than before; dealer tips timed suspiciously close to bet manipulation.

  Countermeasures. Same as past posting prevention; train dealers to verify bet sizes before dealing and again before paying; require floor approval for any bet adjustments; surveillance cameras positioned to see all betting actions clearly.

  Target: Blackjack, all table games