Spain’s Gambling Regulator DGOJ Tackles Identity Theft, Is Blockchain the Answer?

The Spanish Directorate General for the Regulation of Gambling (DGOJ) has commenced discussions with licensed operators in the country to discuss the growing problem of identity theft in online gambling.

Following the launch of the regulator’s PhishingAlert voluntary registration service, 7,712 identity theft cases related to gambling have been revealed.

DGOJ Report Highlights 91% of Gambling Identity Theft Occurs in Sports Betting

The DGOJ collaborated with the State Agency for Tax Administration (AEAT) and the State Security Forces and Corps to publish a report showing that 91 percent of incidents occurred within an online sports betting context.

The PhishingAlert voluntary registration service “allows detecting any attempt to activate a user registration in a state-wide gambling operator by persons providing identity data that coincide with those of the citizen registered in the service, and who would be informed of this circumstance.”

The alert service is regulated under gambling law and requires participant authorization to participate in the scheme. Furthermore, it only captures data from gambling operators who have formally agreed to partake in the DGOJ’s scheme and proceeds to verify the data provided by the PhishingAlert applicant through the regulator’s identity verification system.

The Protocol for Action for Impersonated Taxpayers (PACS) launched in April 2024 and has revealed that approximately 5 percent of all individuals who win more than €100 through online gaming have been victims of impersonation.

Fraud and impersonation are a growing risk, owed partly to the emergence of artificial intelligence and AI-generated documents falsifying consumer information. This has had knock-on effects on gambling companies’ know-your-customer policies and anti-money laundering risk profiles.

Data collected from people’s 2023 income tax returns show that identity theft affects both men and women equally, despite the fact that the number of women participating in online gaming only represents about 16.5 percent of the total.

Fraudsters Use E-Wallets and Digital Payment Methods to Evade Detection

Analysis shows that people who steal identities then use more difficult-to-trace payment methods, such as electronic wallets like PayPal, which cannot be verified in real-time. The data has shown that people who are fraudulently using gambling accounts spend longer using the account per day and make far more wagers before moving on to a new account.

The average duration of an account from creation to cancellation is 38.5 days, but this lowers to 7.5 days on average with accounts created using stolen information.

According to the DGOJ, identity theft using family members or acquaintances is among the most common patterns. This is especially prevalent in minors, and people registered on the General Register of Access Prohibitions to Gambling. It’s also prevalent behavior in people who have been blocked by operators.

Given the Spanish rules around the tax on winnings, the regulator suggests that part of the reason behind the prevalence of identity fraud is to avoid having to declare winnings. The AEAT adopted new requirements in 2023, with users having to pay tax on winnings of over €300 should they earn over €22,000 annually, a significant reduction from the previous €1,000 threshold.

The DGOJ has discussed with gambling operators the need to improve their fraud prevention and detention mechanisms and the responsibility to provide care for those impacted. It has also suggested that  the number is understated as it is limited to those who have ‘requested to join the PACS protocol.’

Currently, operators in Spain do not accept cryptocurrency as a form of payment. One problem that blockchain can help solve with a clearly visible ledger. As crypto sportsbooks become more popular, transactions and identity credentials will become better protected, and technological innovation could help reduce the problems experienced by the DGOJ.