AI and the Next Online Casino: Fraud Graphs, Synthetic Dealers and the Line the EU Just Drew

Q: Is online casino fraud increasing?

Sumsub measured an iGaming fraud rate of 1.53 percent in Q1 2026, up 18 percent year on year and 40 percent against 2024, with suspicious transaction volume for the sector up 4.5 times between Q1 2025 and Q1 2026. The pattern is fewer but more sophisticated multi-step attacks.

Most of what the gambling industry calls “AI” in 2026 is invisible to the player. It runs in fraud scoring, identity verification, offer timing and risk pricing — three layers below the reel animation. The parts you can see, like a synthetic live dealer, are the least consequential.

Here is what has actually shifted this year, with the numbers that are verifiable and a clear note on the ones that are not.

Fraud moved from a rules problem to a network problem

The defining technical change of 2025-26 was the move from threshold-based rule engines to graph machine learning. A rules engine scores each account in isolation: this deposit is unusual, this device is new, this IP is flagged. A graph model scores relationships — accounts to devices to payment instruments to behavioural fingerprints.

That matters because modern iGaming fraud is structurally a ring. A single synthetic account is designed to look legitimate; the twelve accounts sharing one device fingerprint and a rotating set of cards are not. Isolation-based scoring cannot see the second thing at all.

The attack side has industrialised in parallel. Sumsub’s annual identity fraud report describes a shift “from high-volume automation to high-fidelity deception” — fewer, smarter, multi-step attacks that chain synthetic-identity creation, deepfake verification, bonus abuse and money laundering into a single automated flow (Sumsub Identity Fraud Report 2025-2026). Its iGaming-specific measurement: a 1.53% fraud rate in Q1 2026, up 18% year on year and 40% against 2024, with suspicious transaction volumes for the sector rising 4.5× between Q1 2025 and Q1 2026.

Sumsub’s scheme breakdown for 2026 puts identity theft at 28% of third-party fraud, account takeover at 19%, card testing at 17%; on the first-party side, synthetic identity at 21% and deepfakes at 11%.

A number we are not repeating. Several trade write-ups this year attribute an “8.3% suspected digital fraud rate” to TransUnion’s H1 2026 fraud trends work. TransUnion’s own published position is that the overall rate of suspected digital fraud declined to 3.8% in 2025, with the growth concentrated in account takeover, account-creation fraud and scam severity rather than in aggregate volume (TransUnion, H1 2026 update). Where a secondary source and a primary source disagree, we go with the primary one.

What this means for a player’s experience

The visible consequence of graph-based detection is that verification stopped being a one-time event.

The old model was point-in-time KYC: verify at onboarding, trust thereafter. The 2026 model is continuous behavioural monitoring — every session scored for anomalies, with step-up verification triggered mid-relationship rather than at signup. That is why a long-standing account can suddenly be asked to re-verify before a withdrawal.

It is genuinely a mixed development. It catches account takeover, which is the single largest category of loss and the one that hurts players directly. It also means withdrawal friction that arrives without warning and without explanation, on a licensed site where you have done nothing wrong. Our fast verification guide covers what documentation shortens that process.

Synthetic dealers and generative content

The consumer-facing AI story is smaller than the coverage suggests but real. Playgon Games has moved toward launching AI-generated live dealer technology into the iGaming market (Casino.org), using real-time rendering and voice synthesis to produce digital presenters.

Whether that displaces human-dealt live casino is doubtful in the near term, for a reason that has nothing to do with technology: the entire commercial appeal of live dealer over RNG is the visible human and the visible physical shuffle. Replace both with a rendered presenter and you have built an expensive RNG game with a face on it. The distinction is unpacked in our live dealer vs RNG comparison.

Generative AI’s larger effect is on the production side — procedural content generation, asset pipelines, and automated marketing copy. Studios report completing comparable work in a fraction of previous timelines. For players, the visible outcome is release cadence: more titles, shipped faster, with the quality distribution that implies.

Personalisation is now the regulated part

This is the genuinely new constraint of 2026.

The EU AI Act (Regulation 2024/1689) entered into force on 1 August 2024 and applies in phases. The dates matter, because trade coverage tends to blur them:

Milestone	Applies from
Article 5 prohibited practices	2 February 2025
General-purpose AI model obligations	2 August 2025
Act fully applicable	2 August 2026
High-risk obligations, Annex III domains	2 December 2027

Source: European Commission.

The Act never mentions gambling. It does not need to: Article 5 prohibits AI practices that exploit vulnerabilities or materially distort behaviour in ways that impair informed decision-making, and that is a description of retention modelling built on harm-indicator data (GamingMarkets).

The requirement that flows from that is auditability. A personalisation system must be able to explain why a given player received a given offer at a given moment. “The model decided” is not an answer that survives an AI Act review.

The Digital Fairness Act, expected to be proposed by the European Commission towards the end of 2026, extends the same logic to interface design — dark patterns and addictive design mechanics specifically.

Great Britain sits outside both instruments but not outside their gravity. Most large operators run one product across multiple European markets, and the compliant build tends to become the global build.

The honest summary

Claim	Status
Fraud detection moved to graph ML	Well documented, vendor-confirmed
Continuous verification replaced one-time KYC	Happening, visible to players as withdrawal friction
iGaming fraud rate rising	Sumsub: 1.53% in Q1 2026, +18% YoY
Synthetic live dealers	Technology exists (Playgon), commercial case unproven
AI personalisation now legally constrained	EU AI Act Article 5 applicable since 2 Feb 2025; Act fully applicable 2 Aug 2026
”AI improves your odds”	No. RTP is a fixed, certified game parameter

That last row is the one worth being unambiguous about. Nothing in this article changes the mathematics of a slot or a roulette wheel. Return to player is a certified parameter of the game, not a dynamic output of a model, and any site implying otherwise is describing marketing rather than mechanics — see our RTP explainer.

Frequently asked questions

How do online casinos use AI in 2026?

Primarily in fraud detection, identity verification, responsible-gambling monitoring, offer personalisation and content production. The player-visible parts — synthetic dealers, AI-written promotional copy — are a small share of the actual deployment.

Is online casino fraud increasing?

Sumsub measured an iGaming fraud rate of 1.53% in Q1 2026, up 18% year on year and 40% against 2024, with suspicious transaction volume for the sector up 4.5× between Q1 2025 and Q1 2026. The pattern is fewer but more sophisticated multi-step attacks.

Why do casinos ask me to verify again after years?

Because point-in-time KYC has been replaced by continuous behavioural monitoring. Sessions are scored for anomalies and step-up verification is triggered mid-relationship rather than only at signup.

Does the EU AI Act apply to gambling?

It does not name gambling, but it does not have to. The Article 5 prohibited practices — including AI that exploits vulnerabilities or materially distorts behaviour — have applied since 2 February 2025, and the Act becomes fully applicable on 2 August 2026. Operator personalisation and retention tooling has to be transparent, justified and auditable to sit safely under it.

Can AI change a slot’s RTP?

No. Return to player is a certified, fixed parameter of a game tested by an independent laboratory. It is not adjusted per player by a model.

Sources

Responsible gambling

Better fraud detection protects the operator’s balance sheet and your account balance. It does not protect you from your own spending — that is still a limit you set, before you play.

If gambling is affecting you or someone you know, contact GamCare on 0808 8020 133 (free, 24/7) or visit BeGambleAware.org. UK players can self-exclude across all UKGC-licensed operators via GAMSTOP. You must be 18+ to gamble.

Editorial analysis. 18+. Please gamble responsibly.