Poker account frozen for a security review: what it means

A security review is an investigation under the poker site's terms, not a final decision. The site has seen something it wants to look at, such as collusion, chip dumping, a bot or banned assistance tool, a second account, or a location problem, and it has restricted your account while it checks. The outcome depends on the evidence and the site's published rules. Your account may be cleared, closed, or closed with some funds held or redistributed to players who were affected.

So "under review" does not mean your money is gone. It also does not mean you will be paid in full. This page explains what happens in between.

What does a poker security review look for?

Peer-to-peer poker is different from casino games: you play against other people, so the site has to protect them from you, and you from them. Regulators make this an explicit duty. In Great Britain, the Gambling Commission's technical standard RTS 11 requires operators to implement measures to "deter, prevent, and detect collusion and cheating", to keep records that allow investigation, and to be able to suspend or disable accounts (Gambling Commission, RTS 11, last updated 17 July 2023). Ontario's AGCO standards say much the same (AGCO Standards 4.17 to 4.19).

The usual subjects of a review:

• Collusion. Two or more players sharing information or coordinating play against others at the same table. RTS 11 guidance mentions detecting players who regularly share tables, or who share an address and sit at the same table.
• Chip dumping. Deliberately losing chips to another player, for example to move money between accounts. RTS 11 names it as a suspicious play pattern to detect.
• Bots and real-time assistance. Software that plays for you, or tools that tell you what to do during a live hand (real-time assistance, or RTA).
• Multi-accounting. One person running more than one account, or more than one seat at a table. RTS 11 guidance suggests preventing a player from occupying more than one seat at a table.
• Location and VPN breaches. Regulated markets limit play to people physically inside them. iGaming Ontario, for example, says you must be physically located in Ontario to play (iGO). Masking your location breaks those terms.
• Account sharing. Letting someone else play on your account, including a coach.

A review can also start because another player complained. RTS 11 and the AGCO standards both say player complaints about cheating should be investigated.

What can the poker site see that you cannot?

This gap explains why reviews can feel one-sided.

As an example of what one operator says it collects, PokerNews reported in April 2022 that PokerStars' game integrity team gathers behavioural data (how you interact with the client, including decision times), technical data (IP address and device identifier), basic software information, and gameplay data, while stating it cannot capture what is on your screen (PokerNews, 25 April 2022). Other sites collect different data.

The practical point: you are unlikely to see the whole case against you. Your best evidence is your own records, explained below, and our guide to bet IDs, round IDs and hand histories shows where to find them.

What might the site ask you for?

Requests differ by site and by suspicion. Common ones:

• Identity documents, to confirm you are the account holder.
• Proof of address or location, especially if a location check failed or two accounts share an address.
• Device information, such as which computers and phones you play on, and whether anyone else uses them.
• An explanation of specific hands or sessions, for example why you played a certain way against a certain opponent.
• Information about software running on your device while you played.
• Payment details, if money moved in unusual ways.

Upload documents only through the site's own account area or official support channel. Never send them to an email address or chat account that contacted you first.

What happens to your balance during and after the review?

During the review, most sites restrict the account, which can mean no play, no withdrawals, or both. What happens afterwards is set by each operator's terms, so read yours rather than assume.

Regulators require sites to tell you their policy. In Great Britain, RTS 11 says operators must make information available about their policies on cheating and on "recovered player funds", and the guidance says players should at minimum be told that accounts found to have cheated will be closed. In Ontario, the AGCO standards say operators' policies and procedures on unfair behaviour, covering matters such as account suspension and recovery of funds, must be made available to the public on request.

Possible outcomes, depending on the terms and the evidence:

1. Cleared. The restriction is lifted, and the balance is available as normal.
2. Closed, balance returned. The site ends the relationship but pays out the balance, sometimes minus amounts tied to a breach.
3. Closed, funds withheld. Winnings linked to the breach are kept under the terms.
4. Closed, funds redistributed. Money is taken from the offending account and paid to players who were affected. For example, partypoker said in April 2019 that it had closed 277 bot accounts between 1 December 2018 and 31 March 2019 and redistributed $734,852.15 to affected players (PokerNews, 9 April 2019).

If you were on the losing side of a cheat, you may receive money in a redistribution like this. That is at the operator's discretion under its rules, not a right you can count on.

How should you respond to a security review?

Keep it short, factual and calm. Investigators read a lot of angry messages; a clear one stands out.

Do:

• Ask for a case or reference number, and which part of the terms the review relates to.
• Answer the specific questions asked. If you do not know something, say so.
• Explain innocent overlaps plainly. If a family member plays from the same house, say so and give their username if they agree.
• Provide documents promptly through the official upload route.
• Keep copies of everything you send and receive.

Do not:

• Send long, emotional messages or threats.
• Open a new account to keep playing. That alone can breach multi-accounting rules.
• Use a VPN to "test" whether you can log in.
• Uninstall software or delete files you think might be relevant. That can look like hiding evidence.
• Post accusations about the site or other players in public while the review is running.

What records should you keep?

• The date and time the account was restricted, with time zone.
• Every email and chat transcript with security or support, saved as originals.
• Your hand histories for the sessions in question, downloaded if the site allows it.
• Cashier records: deposits, withdrawals and transfers, with references.
• A list of the devices and networks you play on.
• Screenshots of the terms and permitted tools policy as they stood when you played.

Our gambling complaint evidence checklist covers how to store these so nothing is lost. If the review drags on, turn them into a dated complaint timeline.

What if you disagree with the outcome?

Start with the site's formal complaints process, which is separate from the security team. Ask for a final written response.

What happens next depends on the licence. In Great Britain, the Gambling Commission says a gambling business has 8 weeks to resolve a complaint, after which you may be able to use an alternative dispute resolution (ADR) provider, an independent service that reviews unresolved disputes with licensed operators (Gambling Commission, how to complain). In Ontario, you complain to the operator first and can then escalate to iGaming Ontario, which says it cannot settle bets, refund wagers or award compensation (iGO player support). Our guide to what happens after a gambling complaint explains each stage, and the complaints hub lists routes by country.

Offshore poker sites may have no independent dispute route at all, which is one reason to check the licence before you deposit. See how to verify a gambling licence.

Who should you not believe?

A frozen account attracts scammers. Expect messages from people claiming to be "insiders", "security agents" or "account recovery specialists" who can unfreeze your account for a fee, or who ask for your login to "check the case". No outside person can unfreeze an account. Only the site's own team can, and a request for a fee to lift a review is a sign you are not dealing with the site. Do not pay, do not share credentials, and report the contact to the site. Our guide to why gamblers are targeted again explains the pattern.

In practice: a fictional example

Player A's account is restricted after a session. Support says it is "under security review" and gives no detail. Player A:

1. Asks, in one short message, for a case reference and which terms clause applies.
2. Downloads the hand histories and cashier records for the past month.
3. Notes that a housemate also plays on the same site from the same internet connection, and says so in reply, with the housemate's agreement.
4. Uploads identity and address documents through the account area when asked.
5. Waits, and follows up once a week with the case reference, without new accusations.

That approach does not decide the outcome, which rests with the site and its rules. It does give the investigators what they need, and leaves a clean record if a complaint becomes necessary later.

For more on regulated online poker, see our poker hub, and if the review is affecting how you feel about your play, our safer gambling page lists free support.