Collusion rings in Texas Poker are invisible at the account level. They're only detectable at the cluster level — and most platforms aren't looking there. Here's the exact methodology that caught 30+ rings extracting over ₱6M per month.
Every iGaming risk team monitors individual player accounts. Velocity rules, withdrawal limits, win-rate thresholds — these are table stakes. But Texas Poker collusion rings are specifically engineered to stay below individual detection thresholds while extracting value collectively.
Consider how a well-run collusion ring operates: 20-50 accounts are distributed across tables. Each account maintains a "normal" individual win rate. The value extraction happens through coordinated card-sharing — legitimate-looking losses from honest players flow to ring members, who rotate the "winner" role to keep individual metrics clean. No single account looks alarming. The operation only becomes visible when you look at the group as a unit.
The fundamental detection problem: Collusion is a network-level phenomenon. Individual account metrics are specifically gamed to look normal. If your detection logic operates at the account level, it will miss coordinated ring activity by design.
The breakthrough in collusion detection comes from computing metrics at the cluster level — treating a group of linked accounts as a single entity and analyzing its aggregate behavior. When you do this, patterns that are invisible at the account level become statistically undeniable.
Return-to-Player (RTP) above 1.0 means a group is extracting more from the platform than it deposits. In a fair Texas Poker game, cluster RTP should regress toward 1.0 over a large sample. Sustained cluster RTP of 1.5 or above — meaning the group withdraws 50% more than it puts in — is statistically anomalous and forensically significant.
The ring we identified had a cluster-level RTP of 1.90 across 53 accounts over 30 days. Fair-play variance cannot produce this result. At the individual account level, many members showed RTP values between 1.1 and 1.3 — plausible for lucky players. The 1.90 cluster figure was only visible in aggregate.
Across 53 accounts in the identified ring, 51 showed positive net win rates over the measurement period. The probability of 51/53 accounts running positive under fair play conditions is vanishingly small. This kind of win-rate distribution is a near-certain indicator of coordinated play.
The key calculation: in fair Texas Poker, roughly half of players should be net losers over any 30-day window. If a cluster shows 90%+ positive win rates, you're not looking at skill — you're looking at coordination.
Collusion rings focus where they can control the table. A cluster with 80%+ of betting volume concentrated in a single game type — particularly Texas Poker — combined with the RTP and win-rate signals, is a strong composite indicator. Legitimate high-volume players spread across game types.
This is one of the most underused signals in collusion detection. Jackpot wins are random events. A group of 53 accounts playing high volumes of Texas Poker over 30 days should statistically accumulate some jackpot wins. Zero jackpot wins in a high-volume cluster is a further indicator that the group's results are driven by coordination rather than game outcomes.
Once a collusion pattern is confirmed forensically, the next step is generalizing it into a detection rule that can be applied automatically across the full player base. The rule should be specific enough to minimize false positives while broad enough to catch the full ring population.
The productionized detection rule we deployed:
-- Collusion ring detection rule
-- Applied at cluster level after account linking
SELECT
cluster_id,
COUNT(DISTINCT account_id) AS cluster_size,
SUM(total_withdrawal) /
NULLIF(SUM(total_deposit), 0) AS cluster_rtp,
SUM(texas_poker_bets) /
NULLIF(SUM(total_bets), 0) AS poker_concentration,
SUM(jackpot_wins) AS total_jackpot_wins,
AVG(win_rate) AS avg_win_rate
FROM player_cluster_metrics
WHERE snapshot_date = '{{ run_date }}'
HAVING
cluster_size >= 3 -- minimum ring size
AND cluster_rtp >= 1.5 -- sustained extraction above deposit
AND poker_concentration >= 0.80 -- game focus signal
ORDER BY cluster_rtp DESC;
This rule, applied across the full player base, flagged 30+ collusion rings containing approximately 840 players. The threshold values (RTP ≥ 1.5, concentration ≥ 80%, cluster size ≥ 3) were calibrated against the confirmed ring data to minimize false positives while capturing the full population of rings operating above the noise floor.
The detection rule above operates on behavioral signals. Adding registration fingerprints as a secondary layer reduces false positives significantly and enables earlier detection of new ring formation — before the behavioral signals accumulate enough data to trigger.
Batch-registration fingerprinting looks for:
When a cluster identified by behavioral signals also shows batch-registration fingerprints, confidence in the collusion classification increases substantially. When a new registration batch matches known ring fingerprint patterns, it can be flagged proactively — before the behavioral signals have time to develop.
Detection is only the first step. For the investigation to be actionable — and for leadership to understand the urgency — you need to size the impact on honest players. This means computing the three victim layers:
| Victim Layer | Who They Are | How to Quantify |
|---|---|---|
| Direct victims | Players who lost money at tables with ring members present | Net loss at shared tables during ring activity window |
| Platform | Lost rake/fee revenue from distorted game outcomes | Expected rake vs. actual rake on affected tables |
| Ecosystem | Legitimate players who quit due to losing streaks caused by undetected collusion | Churn rate uplift in affected player cohorts vs. control |
In the case we investigated, the direct financial extraction from honest players totaled over ₱6M per month. The ecosystem impact — players who churned after sustained losses at compromised tables — was harder to quantify precisely but represented additional long-term revenue at risk.
When a ring is confirmed, the response needs to operate on two timelines simultaneously:
Immediate actions (within 24-48 hours of confirmation):
Longer-term controls (deployed over the following weeks):
After deploying the detection rule described above, it correctly identified 84% of confirmed collusion ring members in back-testing against the known population. The remaining 16% were peripheral ring members with lower individual activity volumes — they fell below the cluster size threshold or had insufficient data in the measurement window.
A detection rate of 84% on a over ₱6M/month extraction problem means you're recovering approximately ₱5.9M/month from the most active rings, while the remaining ₱1.1M/month comes from smaller operations that require a refined follow-up investigation. That's still an exceptionally strong ROI on the detection work.
Perfect detection is not achievable. The goal is to make coordinated collusion economically unviable by raising the detection probability high enough that ring operators cannot run sustainable operations without getting caught. For broader context on how collusion rings fit into the full organized fraud landscape, see iGaming Fraud in 2026: The Scale of the Problem Most Operators Don't See →
If your Texas Poker or PVP games show anomalous withdrawal patterns, a cluster-level forensic audit can confirm or rule out organized collusion — and give you a specific remediation plan.
Book a Free Consultation →