Online Poker Fairness Explained: RNG, Anti-Collusion, and Bot Detection

A poker room runs on trust. Players will put up with a slow lobby, a clumsy cashier, even a thin promotions calendar. What they won’t tolerate is the suspicion that the table isn’t straight. Once that sets in, the good players leave first, the games dry up, and the operator is left defending a licence and a name that took years to build.

3UP builds poker platforms, so we have a stake in this subject. This post explains how online poker fairness is built and checked, and gives you a set of questions to put to any provider, us included.

What “Fair” Means: Three Layers of Integrity

It helps to split fairness into three layers, because a platform can fail on any one of them.

Game integrity is about the cards. The shuffle and deal have to be random and unpredictable.

Player integrity is about the people at the table. No collusion, no bots, no outside assistance, no one playing under several accounts.

Platform integrity is about the people behind the table. Nobody inside the operator or the software provider should be able to see hidden cards or change an outcome, and every sensitive action should leave a record.

This is why “we use a certified RNG” is never a complete answer. A perfect shuffle does nothing for you if two players are sharing hole cards over a call, or if an employee has a back door into the deal. The rest of this post follows these three layers.

RNG and the Shuffle: How Random Is Random?

A random number generator (RNG) is used to make the shuffle unpredictable. Not all of them are formed equal. An ordinary pseudo random function is generated – for example, the pseudo random functions that are provided in most programming languages.

If it has a lot of output, then its next value is computed. A cryptographically secure source is a source designed in such a way that this can’t be done in practice even by someone who saw a long sequence of previous results. The second type is the only one that’s acceptable when you’re playing for real cash.

Just half of it is the source. It’s important just as much what method they use to convert random numbers to a shuffled deck. The numbers don’t necessarily have to be good, but a bad shuffle could mean some cards get shuffled in an incorrect order, and this has also been found to be a problem in real software in the past. The expectation is that a good source is used in conjunction with a correct and unbiased algorithm.

The dealing should also take place on the server. All the deck is created and stored on the server, and each player’s client is only given what it is entitled to. In the event that hidden cards are ever left lying on a player’s device, they can be read by someone they shouldn’t.

Independent labs test RNG output and shuffle behaviour against published technical standards, such as GLI-19 for interactive gaming systems. A certificate tells you that a specific version of the software, tested at a specific time, met the standard. It doesn’t promise that nothing has changed since, and it says nothing about collusion or insider access. Treat it as necessary, not sufficient.

The last one is soundability. Once all hands are logged, a hand can be checked after the fact, as opposed to arguing about it, if the hand is logged in sufficient detail.

Which raises the most important question players receive: is online poker rigged? What players are reacting to is variance, for the most part. Losing with the best hand in this random game can’t be a big deal and no one remembers the river that saved them, but the one that lost them. That’s correct, but it doesn’t mean that genuine concern shouldn’t be discounted. It is not just that it’s ignored and dismissed, there are reasons for it to be there.

Collaboration: Players Working Together Against the Table

Two or more players playing together as a team against the rest of the players at the table. It looks like a couple of shapes that one can identify. Also known as “dumping,” it is defined as when a player deliberately misplaces his/her chips on the table. In soft play partners are kind to each other and exclude other players. Players will reveal their hole cards in the sharing of information.

The damage is quiet, that’s what makes it corrosive. However, the good ones appear to devalue unknowingly and by the time suspicions begin to creep in, much of them have been lost.

Collusion is not looked at hand by hand, but rather account by account and relationship by relationship. They look into account histories for other abnormal hand combinations between different accounts, account to account play frequency, unusual games played (playing with the same device, IP address, etc.), and the amount of money going in and out of the account. There are no single signals that warrant a conclusion. If you notice a cluster of them, it’s a good sign that you should monitor them.

That last thing is important, and we return to it below: detection is best as automation + people who are making judgements. The following features do not include operational information nor do we give more than a general overview; Never post an ‘undetection’ guide.

Bots and Real-Time Assistance

A bot is a program that performs actions as a human. Bots are easily identified by their behaviour – a leisurely response to the music, monotonous timing, regular patterns of action and no signs of fatigue after extended sessions.

Real time assistance (RTA) is more difficult. Here a player follows a solver’s advice in the hand. The timing and habits of the player look human because they are human, so the clean signals of a bot go almost unnoticed. Relying on a mix of approaches, platforms use behavioural analysis, statistical comparison of a player’s decisions against known strong play, and clear rules in the terms of service. Beware of any vendor that assures that they will catch everything. Not all systems are able to catch everything and it is a constant battle that each side adapts to the other. It’s part of being honest.

Prevention helps too. The already high cost of cheating is exacerbated by human-verification requirements at questionable times, limitations on multi-tabling and session length, and restrictions on third-party tools within the client.

There is no question about this. Bots and solver assisted play is cheating and a room where it is treated as being less is on the verge of losing its honest players.

Multi-Accounting, Ghosting and Insider Risk

Multi-accounting means one person running several accounts, often to get around limits or to collude. The main counters are device fingerprinting, identity verification and payment-method matching.

Ghosting is when someone else advises a player in real time. It is hard to see from the platform’s side and usually surfaces through a sudden change in a player’s behaviour, or through reports from other players.

Insider risk gets the least attention and deserves more. The clearest case is the insider cheating at Absolute Poker and UltimateBet, which came to light in 2007 and 2008. Regulators concluded that people with privileged access had been able to see opponents’ hole cards, and both sites were penalised. PokerNews’ retrospective covers it in detail. The lesson is practical: the people who run the platform need tightly limited access, every access should be logged, and no single person should be able to act alone on sensitive data. Running this kind of fraud and game-integrity operation properly is also a real line in the budget, which we cover in our guide to the online poker platform cost.

Detection Is Only Half: Thresholds, Human Review and Appeals

There are articles talking about detection in this area. The part about what works or doesn’t work for operations is left out.

An automatic flag is not a decision. Honest players can seem strange: a good player, a regular who always sits at the same table family members on the same home network, etc. There should be limits so that if too many are flagged the review team gets flooded with noise but if they are not flagged they can find cheaters. There should be a queue where someone looks at the numbers and understands what they mean before deciding to flag.

The player under review should have a process, which means being told what is happening a chance to respond and a way to appeal. Once cheating is confirmed the best practice is to close the accounts take the winnings as the terms say and if needed give the money back, to the players who were affected. An operator risks losing trust as much as the cheater did if they rush any of these steps and punish an innocent player.

How 3UP Approaches Poker Integrity

No platform can promise zero cheating. What you can demand is strong prevention, fast detection and a fair process.

Here is what operators get with 3UP. [Confirm and fill: RNG source, shuffle method, and the independent lab and certificate date; if no certificate is held, state what is done internally and that operators can arrange independent testing for their own licence.] [Confirm: dealing is server-side, with the client receiving only what each player may see.] [Confirm: the anti-collusion and bot or RTA monitoring tools available, such as hand-history review, account-relationship reports and alerts.] [Confirm: multi-account and device checks, and KYC integration.] [Confirm: back-office audit logs, role-based access and manual account actions, plus how operators escalate suspicious accounts to 3UP support.]

You can see how this fits into the full product on our turnkey and white label poker solutions page. If you want to check our background first, we’ve answered common questions about our legitimacy.

Provider Checklist: 8 Questions to Ask Any Poker Software Vendor

These can be used with any provider. Even if you do not talk to us, you have reason to ask them.

1. What is the independent lab that tested the RNG and can I get a copy of the certificate?

2.Is dealing fully server-side?

3. What operator collusion and bot detection tools do operators have?

How are data that are falsely identified as positive dealt with?

Who in your company has access to player data/hole cards and how is this recorded?

6.How are multi-accounts detected?

7. What can I explore and take action about in the admin back office?
8. If I think a player may have a problem, what is the procedure?

We are happy to answer these for 3UP: contact us.

FAQ

Are online poker games rigged?

Not if it is done right. The great majority of bad beats are regular variance. The RNG section above explains how that is backed by a cryptographically secure RNG, a correct shuffle, server side dealing and independent testing.

Are there any ways to tell if poker bots are being used?

Partly. There are platforms that have a behavioral analysis, statistical checks and human review, and many bots are caught. There isn’t a system out there that’s perfect, however, and real-time support is less obvious than a fully automated bot.

What is the difference between collusion and cheating?

One type of cheating is collusion, which is defined as two or more players collaborating to cheat. Cheating is the broader term and includes bots, outside help and multi-accounting.