How to Spot Bots and Collusion in Online Poker Games

How Bot Detection Works

A poker bot is software that plays poker algorithmically. It has no emotions. It plays a mathematically optimal strategy (or close to it). It doesn't make mistakes that human players make.

The tells are subtle but consistent.

First: timing. A human player needs time to think. They'll have variation in how long they take before acting. A bot acts the same speed every time (or has scripted delays that are too uniform). If someone acts in exactly 1.3 seconds on every decision, that's suspicious. Humans vary between 2 seconds and 20 seconds depending on the situation.

Second: decision consistency. A human player might fold the same hand twice but call it on the third time based on their emotional state or the table dynamics. A bot, if it decides to fold, will always fold that hand in that situation. This is detectable over large samples.

Third: balance. A good player is balanced: they have value hands and bluff hands in the right ratio. A bot is often over-balanced or under-balanced. A human makes emotional mistakes that create imbalance. A bot makes logical mistakes that create a different kind of imbalance.

Fourth: aggression patterns. A human gets aggressive when they're winning and passive when they're losing. A bot doesn't have emotional state. It plays the same game regardless of results.

Collusion Detection

Collusion is when two or more players work together against the other players. They share information outside the game. They coordinate to isolate a target and extract money.

Online collusion is harder to detect than bot play because it involves humans making decisions. But it's still detectable through statistical analysis.

First: hand frequency. If two players never play against each other, that's weird. Real random play means two players will clash sometimes. If they avoid each other consistently, they might be signaling.

Second: hand patterns. When they do play, do they have statistically impossible hands? The probability that Player A has strong hands only when Player B has weak hands is calculable. If it's beyond statistical noise, it's suspicious.

Third: timing. Do the colluding players bet and fold at coordinated speeds? Not perfectly coordinated (that would be obvious) but coordinated enough that they're moving together?

Fourth: betting patterns. Do they take turns aggressive and passive? One player plays tight while the other attacks? Real random play doesn't stratify like this.

Famous Collusion Cases

Absolute Poker in 2007. An account with admin access had won millions of dollars from players. When examined, the account had seen opponents' hole cards. Pure cheating, but it exposed how little oversight existed.

UltimateBet in 2008. Similar scenario. An insider account with impossible winning rates and impossible hole-card knowledge.

Full Tilt Poker in 2011. The site was investigated for systematic collusion and insider cheating. Players sued. The site went down. Evidence showed that some professional players had accounts with suspiciously good results.

These cases revealed that online poker sites weren't running the surveillance they claimed. They had the data to detect both bot play and collusion. They didn't act on it, either because they didn't want to (some players were good for marketing) or because they lacked the expertise.

What Modern Sites Do

Licensed and regulated sites now have actual oversight.

They run statistical analysis on every account. They look for patterns that don't match human play. They monitor win rates, hand frequency, betting patterns, and timing. If an account shows statistical impossibilities, they investigate.

They also require that players not play together if there's a relationship between them (family, friends, known collusion partners). They don't enforce this perfectly, but they try.

They have third-party audits. RNG providers check that card dealing is random. Security consultants check for bot play. It's not foolproof, but it's better than what existed in 2007.

Unregulated sites? No oversight at all. Anything goes.

What You Can Do

If you suspect bot play: document it. Save the hand history. Note the account name, the time, the plays. Send it to the site's security team.

If the site is regulated (Malta, UK, Gibraltar), they have to investigate. If they don't respond, you can escalate to the regulator.

If the site is unregulated, you have no recourse. Which is why you shouldn't play on unregulated sites.

If you suspect collusion: same thing. Document the hand histories. Look for patterns. Send it to security.

The hardest part: collusion is more subtle than bot play. You might be playing against two smarter opponents. That's not collusion; that's just losing. For collusion to be provable, you need statistical evidence, not suspicion.

The Remaining Problem

Bot play and collusion still exist on some poker sites. The better-regulated sites are genuinely trying to prevent it. But in gray-market and unregulated casinos, there's minimal oversight.

If you're playing for real money online, play at a licensed site. Malta Gaming Authority, UKGC, Gibraltar, Curacao. These jurisdictions require reporting and oversight.

If you're playing at an unlicensed site, assume you're facing bots and collusion. The ROI on a bot or a collusion ring is positive for the operators. Why wouldn't they do it?

The safest play: licensed site, established site, positive player reviews about security. It's not perfect. But it's the best protection you have against playing against software and cheaters.