Fraudster stole up to $10,000 each from poker pros, likely due to a legalized betting payment processor breach. I was one of the victims.

[Dan Druff]

(This portion updated on November 16, 2022 at 1:00am PST, thanks to user "Dizzy".)

Bank Account Theft Via Global Pay -- So Easy a Caveman Can Do It

The fraudster does not need your bank account information to steal from you. He doesn't need your full social security number. He doesn't need to verify anything, or authenticate he's really you.

If you have already had a past deposit processed by Global Payments -- which is HIGHLY likely if you used an eCheck in the past on legalized online gambling sites -- then it is INCREDIBLY EASY to impersonate you with the most basic of information.

Global Payments provides a service called "VIP Preferred". This is a deposit option which allows you to draw an eCheck from your bank -- essentially a direct deposit coming from your bank account. The button looks like this, on the app interface:




One you click on the above button, the system automatically loads the bank account information you previously used on other sites! This means that anyone signing up a new account with your full name, address, last 4 of your social, and date of birth, will get full access to deposit from your bank account, without any further verification!

This is insane!!

I tried a test of this just now, using BetMGM New York, where I previously did not have an account. I signed up a new account on their app, using only my name, address, date of birth, and last 4 of my social. I did not verify anything, and I clicked on "VIP Preferred", as shown above. I then got the below screen:




It's that easy!!

(Note that the only reason it's not letting me deposit above is because I'm past my limit -- because the scammer already reached it by stealing my $10k!)

This was incredibly negligent on the part of Global Payments to make it so easy to impersonate someone and steal, and further negligent on the part of BetMGM and other legalized gambling apps to allow such large transactions on the same day the account was opened, including withdrawals!

Certain states, like Nevada, require more than this. BetMGM Nevada, for example, requires you to scan your ID and sent it in to them (or verify in person at a sportsbook). This is likely why Nevada-based sites/apps have not been used for this fraud. The verification requirements vary from state to state.