From Bot Detection to Biometrics: The Next Generation of Cybersecurity in Online Poker

In September 2025 the W3C's Privacy Working Group published an updated note on mitigating browser fingerprinting, the practice of identifying a device from the configuration details it exposes to a website. The note treats fingerprinting as a privacy threat to be designed out of web standards. Online poker operators have spent the past few years building their anti-cheating systems on top of it.

Automated play is scored continuously

Operators score every account as it plays. An account that takes the solver's line more often than any human sample has done gets flagged, and so does one running a process from the list of known assistance tools. Mouse paths are logged too, because scripted input lacks the small variance of a hand on a mouse.

Collusion detection has had a published method since 2013, when Mazrooei, Archibald and Bowling presented a paper at AAAI that scored every pair of players at a table on how much one player's actions improved the other's expected result over many hands, then ranked the pairs by suspicion.

Device fingerprints identify the machine

A fingerprint combines screen geometry, installed fonts, graphics-rendering output, time zone and dozens of other attributes into an identifier that survives a cleared cache. That is the data the W3C note wants browsers to stop exposing. A poker client needs it to tell that two accounts are one machine, or that a second person is advising from a second device, and the problem of proving which physical device is talking to a server is the one IoT security researchers are working on at a far larger scale.

Behavioral biometrics go a step further. Keystroke timing and mouse dynamics are personal enough that a survey by Subash, Song, Lee and Lee in Computers & Security, published in late 2025, treats them as a way to authenticate a user continuously from how they handle a device, with no password involved. In poker, an account whose typing rhythm changes mid-session is probably being played by someone else.

Certification covers the deal and nothing above it

Gaming Laboratories International's GLI-19 is the standard a test lab certifies a poker site against, and a certificate under it covers the deal, meaning the entropy source, the shuffling code, and the statistical tests the generator has to pass at a 99% confidence level. The behavioural and device checks keep software and second players out of real-money poker games, and GLI-19's peer-to-peer section only warns players that bots may be in play. The operator builds and tunes the detection in private, so a player banned by it must appeal to the company that wrote it.

Mobile play moves the risk to the API

On a phone, the risk moves from the desktop client to the API. The OWASP Mobile Application Security Verification Standard, revised in January 2024, lists the controls an operator's app is measured against, from encrypted storage and certificate pinning to resistance to tampering and reverse engineering. Credential stuffing, the automated replay of leaked passwords, has its own entry in OWASP's automated-threats catalogue, OAT-008, and is one of the attacks that biometric login was adopted to answer.

Review is still done by people

A flagged account goes to a person. A reviewer reads the hand histories and compares the device record with the account's past sessions, and a contested case ends in a video call. Confirmed accounts are closed and the players they beat are paid back; one operator reported $156,446 in such payments in February 2026, spread across 1,360 players who had sat at the wrong tables.