Bookmaker’s anti-fraud software under scrutiny

ookmakers will be investigated by the Information Commissioner’s Office (ICO) after it was revealed that their websites may be downloading software onto users’ computers without their permission. Skybet and Totesport have been highlighted in an article originally published by the BBC as operators who use the IP tracking software in question, and both claim that they are not breaking the law.

The issue came to light after two customers complained to the ICO after discovering the software on their hard drives after using betting sites. The software, called ‘iesnare’, downloads onto computers automatically, either by logging in to certain websites or even after just a visit to a home page.

Brian Chappell, who runs the organisation Justice for Punters, had his accounts with bookmakers banned after winning bets.

“I actually cleaned my hard drive on my laptop and I intentionally went on the Skybet website before I went on any other internet site and within two seconds, iesnare – now called iovation, they keep changing the name – and there it was,” Chappell said.

Skybet responded: “Like many other operators, we use iesnare to tackle fraudulent activity. We notify customers we use iesnare in a banner at the top of our website and in our privacy policy.”

iesnare is spyware provided by iovation.com and they actively target the online gaming industry. The PC’s footprint data includes IP information, browser and OS information,

Peter Phillipson, who runs a horseracing blog, had also found iesnare running in his computer background. When he disabled the software, Totesport stopped him from logging in.

Complaining to the ICO, he said “They told me they don’t believe that the argument that Totesport use, that it’s identifying a computer only and nothing personal, is valid. They say the IP data being processed here constitutes personal data under the Data Protection Act. So they found in my favour.”

The betting companies deny using the spyware to ban successful bettors, and claim to only collect their basic info like IP addresses.

“Totesport uses this product for fraud prevention, authentication and customer protection purposes by checking whether devices have been identified with fraudulent transactions in the past, such as reported instances of identity theft, account takeovers, or malware attacks. It does not collect any client information. However, we are constantly reviewing our procedures and working with the ICO,” a spokesperson for Totesport said.

Chappell believes that an IP address could be used for identification.

“If you open an account with a company and they restrict your account, another thing you might like to try is that you open another account with them using another name. Because it’s the same IP address you’re using, it will identify you as a person who’s had an account closed down,” he said.

Iovation, the manufacturers of iesnare, claims it had “no access to information, such as the winning and losing history of players, nor do we have access to specific betting details. Every service contract signed by an iovation customer requires that the customer comply with respective data privacy laws, which includes the appropriate consent and notice provisions.”

The investigation is continuing, with Garreth Cameron from the ICO commenting: “Our enquiries will focus on looking at whether the companies in question have been very clear, very transparent about their use of these technologies.”