How Poker Sites Detect Bots

Rooms do not publish their detection methods, so any article on this subject, including this one, is built from public ban statements, security disclosures, forum accounts and general knowledge of how anti-cheat works. Treat the details as informed description rather than a checklist to defeat.

Client-side checks

Desktop clients and mobile apps can inspect their environment: running processes, window titles, known automation tools, screen-capture hooks, emulator signatures, debuggers. A bot that reads memory is more exposed here than one that reads pixels, but emulators themselves are a visible signal on apps designed for phones.

Timing and behaviour

The server sees every action and its timestamp. Statistical analysis flags players whose reaction times are too regular, whose sessions are too long, who never take a break, who act at the same speed in trivial and difficult spots, or whose mouse movements (where the client records them) look synthetic. Randomised timing narrows the gap but does not close it; humans are irregular in ways that are hard to fake.

Strategy fingerprinting

Rooms with a security team compare a player’s decisions against solver output and against other suspected accounts. A player who plays a near-identical strategy to five other accounts, or who deviates from human population tendencies in exactly the way a solver does, gets flagged. This method catches bots that pass every client-side check.

Player reports

Regulars notice. A player who never chats, never tilts, plays 12 tables for 10 hours and shows up every day gets reported, and reports trigger manual review. On club apps the club owner and agent are another set of eyes with a financial interest in keeping the game clean.

Accounts and payments

Shared devices, IP addresses, payment methods and documents link accounts. When one bot account falls, linked accounts often go with it. VPNs and device spoofing are themselves signals on many apps.

What follows from this

Nothing makes a bot undetectable. Our own bot removes the crude signals; it cannot remove the structural ones. Anyone selling “undetectable” is selling something else.