Poker Bots and Game Integrity: How Sites Keep Games Fair
Few topics generate more heat in online poker forums than “the games are rigged” or “I’m playing against bots.” The honest answer is more reassuring and more nuanced than either the doomsayers or the cheerleaders admit: cheating exists, but the reputable operators have spent two decades building layered defenses that make it hard, expensive, and usually short-lived. Understanding how those defenses actually work is the best antidote to both paranoia and complacency.
Sorting Real Threats From Folklore
It helps to separate the genuine integrity risks from the myths. The three threats that legitimate sites take seriously are bots (software playing automated, often near-optimal strategies), collusion (two or more players sharing hole-card information or soft-playing each other), and real-time assistance, or RTA (a human consulting a solver mid-hand). These are real, documented problems, and operators have publicly clawed back funds and banned accounts over all three.
The folklore is different. “The site deals me bad beats to keep me playing” and “action flops are programmed to build pots” are the most common rigging claims, and they do not survive scrutiny. A well-run site has no incentive to favor any player, because it earns a fixed cut of each pot regardless of who wins. The way that cut is taken is worth understanding on its own; we cover it in how poker rake works. More importantly, players dramatically underestimate how often statistically rare events occur across millions of hands, and they remember coolers far more vividly than routine pots. Much of the “rigged” feeling is really the emotional signature of normal short-term swings, a topic we unpack in poker variance and downswings.
What RNG Certification Actually Means
The foundation of a fair game is the shuffle. Online sites use a random number generator (RNG) to order the deck, and the credible ones submit that RNG to independent testing labs. Names you will see referenced include eCOGRA, iTech Labs, GLI (Gaming Laboratories International), and BMM Testlabs. These auditors examine the source of randomness, run statistical batteries to confirm the output is uniformly distributed and unpredictable, and check that the shuffle cannot be reverse-engineered from observed cards.
Certification is not a one-time sticker. Under most licensing regimes the RNG is retested periodically, and the operator must demonstrate that the deployed code matches the audited code. A licensed site will typically publish or make available its certification, often referencing the testing lab and the date of the most recent audit. When you cannot find any such documentation, that absence is itself a signal. Licensing and certification go hand in hand with the legal framework a site operates under, which varies enormously by jurisdiction and is worth checking before you deposit; see our breakdown of online poker legal status.
How Sites Hunt Bots and Colluders
RNG certification proves the cards are dealt fairly. It says nothing about who is sitting across from you. That is a separate, ongoing security problem, and modern operators attack it on several fronts at once.
- Behavioral and timing analysis. Bots tend to act with unnatural consistency: identical timing patterns, robotic bet-sizing, marathon sessions without breaks. Security teams model normal human variance and flag accounts that fall outside it.
- Statistical play-style fingerprinting. A solver-driven account often plays closer to game-theory-optimal than any human realistically can across a huge sample. Anomalously “perfect” frequencies are a red flag worth investigating.
- Collusion graph analysis. By mapping who plays whom, how often, and how chips flow, operators surface clusters of accounts that win and lose disproportionately to each other or that never tangle in big pots.
- Device, network, and biometric signals. Hardware fingerprints, IP and geolocation data, and mouse-movement or input patterns help distinguish a real person from an emulator or a shared cheating operation.
- Client-side and screen-scraping detection. Many clients watch for prohibited software, virtual machines, or tools reading the table to feed an external solver.
- Human review and player reports. Automated flags are usually confirmed by trained investigators who review full hand histories before any ban or refund.
No single signal is conclusive, which is the point. The strength of the system is in correlation: a bot might defeat one check, but defeating timing, statistical, network, and device analysis simultaneously, across thousands of hands, is genuinely hard.
| Threat | Primary detection signal | Typical operator response |
|---|---|---|
| Bots | Timing regularity, robotic sizing, GTO-perfect frequencies | Account ban, balance confiscation, redistribution to victims |
| Collusion | Chip-flow and pairing patterns between accounts | Group ban, pot-by-pot refunds to affected players |
| Real-time assistance | Prohibited-software detection, statistical anomalies | Ban, forfeiture, sometimes public disclosure |
When operators get this right, they frequently refund the players who were harmed and publish a summary of what happened. That transparency is one of the clearest markers of a trustworthy room.
What Players Can Actually Do
Security is shared. You cannot audit an RNG yourself, but you have more leverage than you might think.
- Play on licensed, certified sites. This is the single biggest decision you make, and it filters out most risk before you ever sit down. Our guide on how to choose a poker site walks through the checks that matter.
- Protect your account. Use a strong, unique password and enable two-factor authentication. A “bot” stealing from you is sometimes just a compromised login.
- Keep your own records. Tracking software and hand histories let you spot patterns and give support concrete evidence if you suspect foul play. The legitimate analytical tools serious players rely on are surveyed in poker tools pros use, note the line between studying away from the table and getting real-time help during a hand, which is where RTA crosses into cheating.
- Report, with specifics. Send hand numbers, timestamps, and a clear description. Vague accusations get deprioritized; documented ones get investigated.
- Choose your games. If a stake or format feels infested, move. Healthy ecosystems and responsive support are competitive advantages reputable rooms advertise.
The frontier here is moving fast. As solvers get stronger and cheaper, detection is leaning harder on machine learning and cross-operator data sharing, and some next-generation platforms such as DEEPFOLD are building integrity tooling in from the start rather than bolting it on later.
The Honest Bottom Line
Online poker is not a rigged carnival game, and it is not a pristine, bot-free paradise either. It is a closely monitored marketplace where the operators’ commercial interest in keeping recreational players happy aligns with catching cheats. Certified RNGs settle the question of whether the cards are fair. Layered behavioral, statistical, and device-level detection handles the harder question of who is playing. And an informed player who sticks to licensed rooms, secures their account, and reports problems with evidence is exposed to far less risk than the forum panic suggests. Stay skeptical, stay documented, and pick your room carefully, the system works best when players hold it accountable.
Frequently Asked Questions
Is online poker rigged or full of bots?
Online poker is neither a rigged carnival game nor a bot-free paradise; it is a closely monitored marketplace where reputable operators have built layered defenses against cheating over two decades. Cheating exists, but on licensed sites it is made hard, expensive, and usually short-lived.
Does RNG certification mean a poker site is fair?
RNG certification, verified by independent labs such as eCOGRA, iTech Labs, GLI, and BMM Testlabs, confirms the cards are shuffled and dealt fairly and unpredictably. It does not, however, say anything about who is sitting across from you, which is a separate security problem operators handle with behavioral, statistical, and device-level detection.
How do poker sites detect bots and colluders?
Operators combine several signals at once: behavioral and timing analysis, statistical play-style fingerprinting, collusion graph analysis of chip flow, device and network data, screen-scraping detection, and human review of hand histories. No single signal is conclusive, so the strength comes from correlating them across thousands of hands.
What can I do to protect myself from cheating in online poker?
Play only on licensed, certified sites, secure your account with a strong password and two-factor authentication, and keep your own hand histories. Report suspected foul play with specifics like hand numbers and timestamps, and switch games or formats if one feels infested.
More from Railbird
Online Poker News: What’s Shaping the Game in 2026
A running look at the trends moving online poker in 2026, regulation, software, the player pool, and what it means for everyday grinders.
How Poker Rake Works, and Why It Quietly Decides Who Wins
What rake is, the difference between pot rake and tournament fees, rakeback, and why beating the rake is the real hurdle for winning players.
Do You Actually Need a Poker HUD in 2026?
Once near-essential, HUDs are now banned on many sites. Whether you need a poker HUD in 2026 depends on where you play and how much volume you put in.