Navigating the Botting Industry: Fraud, Cheating, and Multi-Accounting

[Music] welcome to the novic gaming podcast where it is our mission to explore the business and future of video games we bring together the industry's brightest Builders investors and thinkers to keep a pulse on current events dissect emerging Trends and games share Lessons Learned and have a great time this podcast is also part of novic growing ecosystem which ranges from free and premium research to Consulting and AD advisory services for more information visit [Music] www.nic.edu and that's why reforge Labs exist reforge Labs uses AI to rapidly create

video ads for mobile game studios like yours helping you test and find a winning creative without breaking the bank in 24 hours or less reforge Labs delivers ads that capture attention and elevate your game above the noise Make marketing easy and fast with reforge Labs so you can focus on building the game you love to learn more simply visit reforge labs.com or check out the link in the show notes and with that let's dive into the episode what's up everyone and welcome to the novic gaming podcast I'm your host Alex te and this is the interview and inside segment so all Industries struggle with Bots as one of our guests will explain today um they're especially pervasive in social media and e-commerce X faces a botting overload that has diluted its platforms information and comments while e-commerce sites have suffered bot attacks that drain inventory just ask anyone who tried to buy a PlayStation 5 in 2020 in gaming uh Bots play a

fascinating dual role uh sometimes they're beneficial actors facilitating matchmaking building followership or serving as NPCs however they often turn malicious you know farming game economies ruining the experience for real players um or enabling cheating in fact gaming ranks as the number one vertical for botting with the highest percentage of fake and fraudulent traffic this has led to the development of numerous infrastructure and Security Services specifically designed to reduce Bing and catch Bad actors and two experts from the field are joining me today we'll explore the botting industry in games examining different types of bots understanding WHY games are targeted discussing solutions for bot detection across a products life cycle and investigating where the business opportunities lie um specifically how AI is changing um the Bing industry so my first guest is George ing CTO and co-founder of ggwp George prior to founding ggwp worked at cyber security startups as well as the US Department of Homeland Security and user I am super excited to have him on air today as it will be really interesting to see how

strategies and fraud and cyber translate to games welcome to the Pod George welcome thank you awesome all right my next guest is Henry lagard founder and CEO of verisol verisol is a platform that helps businesses autom make fate account detection to keep your business healthy and Bot free um I ran into Henry at an event a couple months ago we just had a fascinating conversation about the botting industry that inspired this podcast so Henry I'm super excited to to have you on air today yeah thank you thanks for making the um our dream come to life here yeah it was super great to meet and George great to see you here as well to too awesome all right so before we dive in uh I'd love to do a quick round of intros uh tell the audience a bit about how you came to found your respective companies um I would also love to hear from you your best case study um on how you've helped a group crack their botting problem and I will also share one of my favorite Bing problems as well after you guys kick it off um Henry how about you you uh you

lead here perfect so I'm Henry I'm the CEO and founder of verisol we help companies detect and prevent fake accounts Bots Etc one of our primary focuses is in gaming um I come from the fraud and identity space and throughout my entire career have realized how challenging it is to stay ahead of fake account spots and you know when we talk to customers their engineering teams are fed up with it they don't want to work on it Etc and so we figured hey it's uh you there's safety and numbers and there's value in bringing this all under the same roof and so we take strategies we see across all of our different clients and help apply those to the rest of them um and so really we focus on helping customers prevent multi accounting so you know people trying to farm economies with multiple accounts whether that's potentially poker tables or reward systems referral systems um all the way to the most advanced AI Bots that mimic human behavior can mimic

human conversation Etc which George will talk about um one of the most interesting case studies is that that we've seen recently called it in 2024 is one bad actor that was responsible for over a million dollars in chargebacks creating basically over 50% of the fake accounts on a single gaming platform so basically massive problem with fake accounts huge number of chargebacks they were losing kind of millions of dollars monthly to fraudulent payments when we uncovered it it was one single individual that was creating massive Accounts at scale and I'm sure George Alex you've seen this same concept before where it's likely not that there's a huge number of kind of fraudsters in there but it's a few frauders creating huge numbers of fake accounts and huge havoc and so helping them uncover that was a massive unlock both for growth and for cost reduction so that was a super interesting one just

from the you know kind of nature of one one kind of unmasked guy dang yeah that's that's a good one um George uh you got what you got yeah so I'll tell you a little bit about ggwp first uh we have a Community Management solution using AI based content moderation we also have sanctions nudges and warnings in the product um let me think so I can't share anything too spicy about any specific game but I will share that uh recently you know we look at things like aimbots um speed hacks spaming games um but we did a lot of work around smurfing and boosting for a popular competitive game and just in the first bandwave we looked at over let's let's call it in the tens of thousands um obviously don't know about the total volume in the community and that's part of the challenge here in this space but just from that alone with you know fairly rudimentary uh behavioral analysis at a start point we're able to pick up a good

number of these types of accounts in game got it um all right so ggwp and you uh how did you found yourself at ggwp before um giving your background in cyber yeah so um as you mentioned before I was at uh Homeland Security for some time I was also at DARPA uh doing DOD research uh we were supporting a conflict in Afghanistan um and that's kind of how I got into cyber in the first place since the nature of the threat has sort of moved digital in in a lot of areas um after founding science and being acquired uh I sort of took some time off I was teaching at Cal just thinking about what I wanted to do um I've always been a lifelong gamer so it was a good opportunity I was playing you know during Co I guess you know you couldn't go out as often so I resorted to playing online games with some some friends uh some of which I I co-founded ggw with uh we're playing competitive

games and we just kind of saw how people were talking and kind of surprised how that hadn't really changed over the years so we really just wanted to address that problem got it very cool awesome co-founders found um in Discord over over gaming that's the best gaming Story the best gaming founder story ever um all right so one of my favorite Bing stories is uh during my time at blizzard um I'll I'll not name the franchise but this franchise and a particular region um had a pretty malignant bot problem um and so it was really frustrating from the business side uh because the da of this game was basically uh inaccurate to some extent right and so that diluted lots of different kpi metrics like arpd Dow and daau ratios and other kind of key critical um you know business health indicators um that you would use to basically make a product decision or steer business decisions um and so basically was kind of already it was

automatically known that in this region there are X number of bots and you have to strip them out every single time um in every report that's ever made in collected through Tableau collected through financial software systems Etc um and so it was obviously having a lot of challenges because you also needed to educate anybody that was new to the franchise about the bot Community um because otherwise they may report something inaccurately and so I thought that it was uh it's really interesting and it obviously also had um a lot of these Bots were basically farming the economy so it also had big impacts on currency reserves Etc it's a it's it's a really interesting point I'll just mention that it's one of those things kind of one of those pernicious problems people don't really think about like when they're listing kind of the top impacts of bots it's like oh yeah user experience for real users cost farming Etc but like just the day-to-day data Ops for the team like it just drags on you you're like all right new person hired okay here's the exactly here's the fake numbers here's the real stuff like here's the Cal you got to back it out

like yep it's like a hardcoded minus X every single time across yeah and it's yeah it's definitely huge so um all right so we both all approached in this conversation with a couple of different Bing problems um you know yours Henry from this one malignant bad actor that was kind of really sabotaging the kind of the the monetary outcome of this of this company and making you know you know 50x the scale of fake accounts George yours has to do a lot with competitive Smur bfing Etc and then mine more like on the business side um but these were all obviously in gaming uh and the first topic I want to talk about today is kind of why Bots are prolific problem in games and I'd be curious to hear from you guys you know why Bots over WHY games over any other industry um and specifically also like what games are most suspect to bots I can think of several genres off the top of my head but I would love to hear from you guys where you know you guys work with a lot of these clients um so Henry maybe I'll pass it to you first uh what's your pitch on sort of why why Bots and gaming

yeah it's a great question we think about this a lot I think there's kind of three main components at play here so number one is generally kind of an unbounded play economy so if you think about most Industries there's some sort of transaction or some moment at which you can extract value so let's just say in e-commerce it's you know you got kind of one transaction point when you're thinking about like ticketing your one ticketing purchase and then you kind of get detected within gaming there's almost an unbounded earning capability because you have this Rich almost you know kind of lifelike economic system that mirrors the real world and has this unbounded nature and so the more you play the more you earn and so it kind of is an uncapped reward structure super interesting versus other Industries secondly I think just from what we see in terms of the um client sophistication

I think gaming companies are a little bit behind the ball versus some of the other folks to you know obviously compared to like a financial services or something like that the the gaming industry there are you know some triaa games that have a lot of internal resources spent on on fraud trust safety Etc um with you know extremely powerful backgrounds Etc I just think that on the whole the industry is a bit weaker from a defensive standpoint from what we've seen in terms of the tools and Technologies at play I also think like the end you know the folks joining gaming companies they just want to build games like they really care about the user experience the gaming and they don't want to get sidled with Broad and abuse and stopping that and I think it often comes less onto a unique team and more onto a single person who's like hey I don't really want to work on this um and then yeah the the the third is actually slipping my mind but think on it George I'll pass it to you in terms

of um kind of what you think and then I'll come back let me yeah think on that for a sec sure I I definitely agree with the unbounded play economy point I think to the less sophisticated companies uh agree with that as well um one consideration is like even for these really large game Publishers usually we're talking about like thousands of employees so to be fair if you're talking about let's call it the equivalent of a AAA financial institution you're talking about tens of thousands of employees which means yes you do have a larger surface to cover but you also have like a lot more people and a lot more Capital able to set up some of this infrastructure um I I think for why do you see a lot of this stuff in gaming I agree that there's three points one is limited deterrence in my mind right what one consideration is like what is the penalty if you get caught what happens and gaming you know we can talk about you can have a whole another podcast on free-to-play models alone but specifically here just if someone is banned they just create a new account so

that minimizes the the uh punitive impact let's say and often the space itself is gray right in terms of the legal enforcement so it makes it less risky than financial or e-commerce fraud too potentially right another thing you have is like high engagement right you you have uh these younger techsavvy people that already playing these games so they just get to spend time in these environments that they're already familiar with and to to go further into that uh people get really invested in these games so like these competitive games it's not just about a financial incentive they've really want to win so turn they start to cheat and that's a big part of the the Bing that that we see especially and then um yeah that the last one is just that persistent market demand right like to to Henry's point it's an Unbound play economy there's a huge black market for in-game currencies and there's new games coming up all the time so lots of opportunities there yeah that what you just said George resonates

and actually remind me of the third point which is the kind of black gray economic Market on which a lot of these things transact that's exactly there's just less visibility on what's happening there often it's kind of a secondary Market that exists outside of the game itself in some circumstances kind of a black or gray Market um and so it does you know there's less visibility less of a spotlight on those transactions and so you know much easier to commit fraud or friendly you know type fraud in that circumstance those are great points yeah George you kind of already alluded to this um but before we talk maybe a little bit about genres or particular regions where Bing is a little bit more malignant in video games um you know was curious about what you've observed in defense that games could potentially learn from um because you did some comparing to other Industries you know the consequences are low the appetite is there the marketplace is gray but is there something that games could basically you know what's a lesson that Gam I think could take from other

Industries you've worked in in cyber yeah like like cyber like I think does a much better job of digital fingerprinting the same opportunities there are available in gaming so games can certainly better leverage behavioral analysis and again it's not that games don't do anything there there's just a lot more they can do with the digital fingerprints and and the AI and ml to to better detect these threats um I I think another easy one from like banking is just like kyc not just banking but a lot of areas where you're a little bit stricter on the identity so you think about how banking deals with fraud how um for creating a loan you're using a social security number in the US right it's it's not as e like just thinking about your ID in in a game you're just creating a new account with an email oftentimes and people just generate these fake emails constantly if it was tied to your ID you might not have the same signups that's like a different problem but from a security standpoint that's obviously going to be easier to manage and then the last thing I think um the Intel community in general does a

very good job of is around Intel sharing right you think about like law enforcement agencies and them sharing watch list or behavioral attack patterns games from what I understand do do some of it like the large tripa do have security people that they send to these same conferences but beyond that I think the gaming industry just can do a much better job around shared databases of I don't know like known you know C threats no spam threats right Bad actors of different types known frosters and just patterns as well that's really interesting um yeah those a great pieces of advice imagine signing up for a game with your social security number I think I would uh I think I would adopt maybe a very different play style um admittedly um that's that's really interesting more cing people out when you get killed and stuff like that right I mean Korea actually does you know use your national ID to sign up and people still play a ton in Korea so that's not necessarily the the end of it but yeah

certainly there's like ux and CCU considerations and game has to balance got it um uh Henry you've worked with a couple of clients um is there particular maybe a particular pattern that you see to the genre of games that you that you've worked with yeah it's a it's a great question I think there's a couple things that we look for kind of telltale signs that there will be fraud the first and clear front runner is economic value somewhere so whether that's an in-game currency that you can use to buy items that has some sort of in-game marketplace or you know maybe a dark gray or black Marketplace for it um you know whether there are um marketplaces for ingame items things like skins Etc whether there's uh potentially even like a cryptocurrency tied to it some sort of token some sort of economic component is the Far and Away the most powerful driver of true true fraud I think um secondary to that

would be one point George you brought up is just this incentive to win you know like I want to win and therefore I'm going to go to extra lengths to do it even if I'm not earning money maybe it's uh leaderboards Prestige things like that so some sort of multiplayer component is kind of the next thing I would think about um you know if it's a single player game story mode there's really not an incentive for for Bots and fraud so right number one is is kind of that economic piece number two is some sort of other uh value or some sort of intrinsic value maybe that's Pride or Prestige or um things like that some of the signs we see interesting okay so I think that that also is a nice segue to start talking about um you know some of the definition Bingo that we're talking about when we're talking about the bot space because you just gave two examples there one is kind of like an economic Mo economically motivated bot and the other one is about winning um or leaderboards Etc and so before we kind of dive into

the meat of things I kind of want to make sure we're all T aligned around the same language and so I would love for you guys to tell me you know what's the difference between a game development game develop bot a player side bot and a server side bot um or are some of those things overlapping or different um George maybe you can take us kick us off on that yeah so so I think of game or or server Bots um being more like things like NPCs our CPU controlled adversaries in training modes right or or like a a teammate in a Left 4 Dead type game right um player Bots are things that the players are creating often times doing things that the game doesn't necessarily want them to do like a WOW gold farming bot or an a bot um reducing recoil or just automatically locking on to or tracking like heads got it okay and so then for but for those like some of that is an account side bot and then some of that

is a potentially like a tool that's helping me cheat um is there a n clature that you use to kind of delineate like on gray area tools like aim assist software or inventory optimizers versus a this is a fake account Henry to your example of the um your example that you opened with um this person had created like 50 a lot of a lot of fake accounts yeah I think some of it depends on the the game's definition and it can actually change on on that mode as well right so um is setting a macro okay I think that's a good example of a gray one um and a macr one which probably blurs the definition doesn't help clarify but games can allow you to create macros within the game then it's a server side or game server type macro but players can create macros through Hardware or through software and if you think about like if you're going to play League of Legends at the world

championship there's like uniform Hardware because deliberately they don't want you to create these macros to simplify these complex uh button press combinations um some games though are actually fine with it it kind of goes back to what Henry was describing it's about the impact to other players right um yeah got it yeah and we'll definitely talk a little bit about um when botting is good and when it's bad and I think that that's a great example right there um as there are so many tools that actually help players experience the game better that you might consider to be quote a bot um in terms of um you guys use this this word user Integrity a lot um what does user integrity mean um yeah what does user integrity mean in gaming it's a good question so I think when we when we think about kind of whether users are good or bad we we think about it in a couple different categories the first is the kind of root level user Integrity this is the are they like a real human are they a

unique actor and are they do they have good or bad intentions and you can discern some of these things by by not even looking at their behavior but looking at things like their device their Network how they connect how they um move the mouse how they collect these these type of root root level um interactions and connection activities um then there's kind of this behavioral integrity component right this is like are they doing good or bad things in your application and this is really where you know George and team are specifically um focus is trying to root out those bad behaviors and where we typically focus is hey are these unique users signing up do they have good intentions are they just here to you know extract have we seen them before have they been banned before all that type of stuff like is it a prima facial like good or bad kind of person signing up got it okay so there's like two parts

to that there's the behavior and then there's like the are you a real person yeah exactly got it and part of that user Integrity is also like do they align with your terms of service right there's certain applications or uh that that might be Geo vened right so are they in the right geography are they kind of in your target market are they um Bas are they are there users you'd feel comfortable showing your CEO that you have or are they folks that are you know they're creating multiple accounts they're you know spoofing geolocation to pretend to be in your target Geo when in reality they're coming from a highrisk geography things like that got it all right okay so we' talked about user Integrity which is a component of behaviors and then also user identity uh talked about game game develop Bots player side Bots and server side Bots um we talked a little bit about a assist software and kind of like gray area tools like some sort of you know modding

and things like that um are there any other terms from your guys's perspective of being experts in this space that are basically used totally wrong by like noobs like me um and if and if so if any of those come to mind what hap what are they the the only thing that comes to mind is the word bought in general I feel like people use as this catchall term for bad uh when you know in reality it's like there's good and bad Bots like we just talked about and then there's also there's there's Bots but there's also like real users that are just manually creating a bunch of accounts with a bunch of devices or like getting around blocks or doing and so everyone kind of gets looped into this like bot idea and I think uh it's not necessarily bad I think it's easy to to do I just think there's when you peel back there's kind of there's different ways to look at it like hey is it actually an automated thing happening that's what I think of when I think of a bot or is it

like hey this one person's creating many accounts that's more like multi accounting or maybe even just like pure fraud they're using fake credit cards fake emails to you know buy stuff charge it back and then resell it right and so almost thinking about it all as one I think you're going to apply like a sledgehammer when you kind of need more like different approaches for each of those different um problem sets George any thoughts yeah I think maybe it it's helpful just to Define like what is a bot right at the core um I think my perspective would be we're really just talking about Automation and some things are intelligently automated and some aren't and then there's like other bad activity that doesn't require Bots that Henry's also referring to that often gets swept in right because you can do fraud without using a bot you can do fraud with using a bot uh and then there's like going back to like player game like really you're talking about like who creates it and what what is the target scope of use got it in other words I should not

call this episode an episode about Bots it should be an episode about frauda no I think again I don't think it's like I think it's a great I don't want to disparage it at all I think it's a great term that everyone it's clear it's like everyone understands it which is great I think where it's when I think about the solution it's like I like separating into kind of three or four unique problems under that category but from a high level like conversationally it's it's Bots suck and we hate Bots yeah it's the right wayed okay right where the C got it all right so um we're going to talk a little bit about setting up the infrastructure now that you've decided that Bots you know once you've decided that Bots are bad um but uh you know both of you have talked and you've started a business that anchors yourself in the fundamentals of removing toxicity or removing Bad actors um and we've talked a little bit about how Bots are just not always bad you even mentioned

that Henry a couple a couple minutes ago um you know there's examples of games that uh might be better with bots in them and you know something like cod mobile uses Bots for matchmaking liquidity and that actually seems to be helping with player retention um what are the positive applications in your guys's mind behind besides something obvious like matchmaking or NPCs um you know are there other basically positive things that Bots can be used for besides those two components which people think of as kind of like the you know the the hail marer the sorry the the golden Trove of good Bots the white the white bot the white actors the white hats yeah it's a good question I think it it it depends on the game but there are instances where there's a lot of lowlevel activity that might be extremely manual or tedious Etc that's not creating like unique value isn't super fun for players that in some circumstances Bots can kind of help automate that away and provide some sort of economic liquidity in the fact that

they're able to kind of do some of these tedious tasks that you know people don't want to do along the way so in that way maybe there's something interesting I think um you know it also can create Buzz around you know one of the main things we see is that folks can be apprehensive to remove Bots or they don't want to look under the curtain because there's growth right you want numbers you want users and you want to see those go up and to the right and so there's something scary about trying to kind of uncover who's real and who's not and I think um and so in some circumstan I think bots in a game can actually be a positive signal that there's some value there or that there is something kind of interesting from an economic perspective that should be driving us real user activity as well um but our perspective

is not always that you need to remove every bot it's just that you need to figure out which ones are Bots and which are not that way you can make that decision effectively right if you figure out hey there's a cohort of bots that it's kind of like maybe on the gray area but they're not act they're not actively deteriorating from the user experience or the economy then in that way they might not be that bad so there are circumstances in in some cases maybe even it's kind of like a judgment call at the end of the day like are they you know are they really hurting you or not in this certain case and you can kind of go do Case by case at that point yeah I think you can tell because games are incorporating it into the workflows right do you think about Monopoly go and being able to Auto roll or like even uh Pokemon the the new TCG Pocket game where we can Auto Battle so there's definitely a lot of that um again those are game creative so we know it's okay or at least they believe it's okay and

and helpful for the players but I I think the spicier take is the are some of these player design Bots that on the surface hurt the game economy actually good for player base at least in the short term at least right so if you think about I don't know some of these games like the the popular MMOs like like a RuneScape back in the day like a wow um did some players actually enjoy enjoy the game more because of this market so now um you as someone that doesn't want to grind that long get access to this really cool gear that you wouldn't otherwise get access to I think the answer is probably yes in some ways right because even if you're not you know buying from the gold Farmers directly the entire economy is a lower cost for you unless you're able to you know get this gear at a cheaper rate the trade-off is in the long term it can create some Market imbalance and the game has to decide like when do they need to really crack down on this to

find that balancing act because they lose one of their core levers in maintaining that balance because it's not great either way right when it goes off the rails and no one can get anything or everybody can get everything because it starts to delegitimize like the value of person that you know is spending 40 hours a week and then going on raids with their friends to to get the same gear and that's kind of a tradeoff it is it's a really good point George and there's one one component of that that's kind of interesting where you know if there are Bots or Farmers that are creating kind of um item liquidity let's say or creating kind of that economy a lot of where that transaction set will take place is in like a black or gray Market outside of the game itself so like in the you know RuneScape you know example a lot of the transaction activity happened outside of the game and so it is there is value there but I can't help but think that the game could be better off by capturing that economic value with some sort of in-game transaction set you know

Marketplace and I think a lot of games are kind of headed that way um but the more you can keep within your walls Garden the more you can monetize those transactions that are taking place and also um you know as you were saying kind of govern or watch over and make sure that the supply demand balance stays in equilibrium to some extent um so that's a totally I think that's another great point about when Bots can be good it's just they're they can be good but maybe even better if you can capture some of that extra economic activity that maybe is happening because of it yeah that makes a lot of sense and I think um you know George your question if it's like is it making the experience better or worse for players like um I used a bot to open my Hearthstone packs because I would grind a lot and I'd open a lot of packs and I would just I just built a little space bar pressy thingy because the games they refus to let you Mass open packs and I was like well I don't

want to open pack 75 pack one was fun but 75 is not I also have another friend who's a huge lost Arc person and I would make fun of him for playing lost Arc at like randomly at 9:45 in the morning I'm like aren't you supposed to be at work and he's like no I'm at work these are my Bots and I'm like oh so it's every single time the little icon comes up that's like XYZ is playing lost AR I know that's his Bots it's a matter of fact he's probably having more fun because he feels like he's kind of like optimizing and Min maxing and that's actually enjoyable right and so there's kind of like this I think balance between like how much do you as a developer allow Bots for gameplay purposes because your players actually feel like that's actually a fun part of them playing playing the game um versus the consequences of leading the player base on um I think like you said Henry you know maybe the the question is not whether or not you exterminate them but you know how do you identify them and make sure that you're that you at least know that this is a bot or this is um a player using an augmented um uh you know

application of some kind and flagging those accounts um and so maybe that's like kind of like where we should start now so like you've decided that like you are on a mission to um basically either identify the players in your player base that are Bots or identify players who are using software that is you know outside the realm of the original scope of the game um and so my first question is before we talk about the actual game studios them like the your game itself right is there anything that the first parties do like a steam Xbox or Playstation to expunge Bots um for example um I was doing some research and YouTube explicitly forbids the use of automatic systems to explicitly artificially grow any account um what's the landscape looking like out there for you know some of the primary PC and console platforms yeah it's a great question I I can't specifically talk to the consoles but I can speak to the kind of uh PC as well as online service providers I think from what we see

almost everyone does have something here so steam certainly has you know internal resources focused on this I would be I would venture yes that the console you know consoles have teams focused on this as well um it it's just a really hard problem and so you kind of need it at every layer and you should never trust you should really never trust that the guy in front of you in line or the the you know service in front of you in line did a good job um one example of this just broadly is I'll talk to folks and they're like oh well we use you know sign up with Google and expecting that Gmail has done the work of preventing fake accounts and you know you can buy a Gmail for an aged Gmail for like seven cents in inbox right so you can get kind of unlimited of these things for zero cost nearly and so the key is you know kind of trust but verif right you want to you want to have some trust that

there's something happening further up the stack but definitely not rely on it is is kind of what we see yeah so as far as far as what I see in the gaming space specifically um I know steam has like valve anti-che um specifically for some of the behavioral stuff in game I know Sony works with a lot of third party anti-cheats for detections um Microsoft has been public in the space they've you know filed a few pens on their own behavioral analysis detection but unsure of in in practice what they actually use and plus it it's it's a difficult problem there's a lot of variation especially in the behavioral side in game like from you know title to title so it's a little bit different I think more notably they've taken more action on deterrence right like one in setting policy as you mentioned if you don't have a policy it kind of catches users offu because you didn't set their guard rails in the first place and at this point in time like everybody or at least all the major large players are much better in terms

of where their policies are in terms of use today um like for example I think just this year Sony decided to block kronis which um you you can do some macros around you can do things that like help with like aim assist and it kind of makes sense if you think about uh the the crossplatform firstperson shooter games that they were doing it did give console users some advantage that they allowed um that that type of controller input so so in in that way they're rejecting certain Partnerships or affiliations with certain you know Hardware types for example and in the deterrence you actually see platform level banss and I think that in itself is a major deterrent right meaning if you get caught cheating or doing something fraudulent in any you know Sony game you get banned in that ecosystem which is much heavier than a mobile freet to play where we can just create a new account for that one game yeah I think on con so for anyone who owns the hardware for instance you know

the console providers or in Mobile's case you know Apple and Google they have Hardware level data about the users and so at kind of a platform level on an owned piece of on an owned device like a console they can take that action the challenge is when it comes to PC or online it's nearly impossible to kind of block one user from returning or even to detect them as the same person across console to PC things like that the other question at play here is kind of how much data the games themselves would get get from the device owners so for instance Xbox you know PlayStation Etc they'll know the Unique Piece of Hardware a user is playing on however they likely aren't Expos and I don't know the console as well but like in Mobile you're not really exposing that data you're giving them an ID that they can then use but through resets things

like that users can create basically expunge that data and appear to create a totally fresh device such that that game or user or or our application has never seen them before um and so it's a bit about there there are things in place and some of this data can be used by games but the data that the games get themselves from the device owners is transient and kind of ephemeral and not um you know fully I guess um fraud resistant see okay so if you can't um I guess that goes to the question of like how should you set up the infrastructure to like catch your Bots um and I think obviously your your answer is probably going to depend a lot upon like the kind of Bot Behavior that's existing in the game if it's if it's cheating if it's fake accounts Etc um but kind of like if I'm if I'm I'm starting from a fresh new start right and I'm building um a game you know when should I start thinking

about setting up bot detection infrastructure what are kind of like the kind of bare basic Bare Bones basic minimums that I should be doing kind of like food Water Shelter in terms of protecting my game and being able to identify the Bad actors either on the game side game server side or the um player created side Bots yeah it's a great question and something companies spend you know huge teams figuring out I think the piece of advice I would give folks is I I definitely wouldn't start too early like I think you want to have users and you want to have kind of folks in there before you spend a lot of resources on this um but I definitely think once you have a thriving economy that's when you want to be focused on it I think basically don't add don't don't spend your resources before you kind of have game Market fit if you will um you want to have some sort of economic fit or product Market fit with your game before you actually are spending all of your time thinking about Bots and fraud

things like that uh so I would do it then and or when it becomes a problem just from a timing perspective and I'd love to hear your opinion on the timing as well George but from a defense framework perspective I think there's a couple things I would say super high level it the more signals the better right so the more unique signal um components you have the better whether that's Behavioral device Network server side um you know linkages all these type of things you want as many kind of unique complimentary signals high level and then secondly the more you can solve it higher up the or like earlier in the user Journey or earlier in the user user funnel the more Works you're going to save right so if you can catch them at signup you're going to save yourself you know 10 times the work if you're catching them in game just because of the sheer number of data

points you have to look at down the funnel versus higher up in the user Journey so those are my kind of high level things and I'd love to hear your your take on those George and then we can get into the the details as well yeah so I think ultimately as a game developer you're you're betting on your own future success so I agree that in practice none of this stuff or a lot of this stuff is overkill if you're not a large multiplayer game but in success these become massive problems so you should at least address the low hanging fruit so plan for you know what you need to do in advance um I think practically speaking just logging the data pipelines if you don't have logs um for the early signup flow as you mentioned Henry lots of low hang fruit there looking at things like Hardware profiles keyboard bindings those are like relatively simplistic attributes that you can look at and you can find a lot of information just on player behavioral pattern from that um but even

like loging key events in game for the stuff that ggwp focuses more on you know addition to chat and um voice where we're looking at gameplay too so you can't find you know like things like aimbots if you don't like track any of the events in the game so you just need to track a lot of that stuff up front um and when you get down to there there are like a lot of low hang fruit elements like some stuff is pretty straightforward like repetitive movement I mean that in itself can get complex but the most simplistic form or like perfect timing if time to cool down to press is zero milliseconds or less than 20 milliseconds over and over like that's like a Dos pattern in you know normal cyber security and in gaming that's just clearly not a human being with perfect you know response to something long play durations there's got to be some upper bound what if someone's logged on for 48 hours doing stuff non-stop like there's some cut off if if you care about maintaining the balancing gameplay progression those are

really easy things to implement um you know other things obviously get like way more hard right if you're like saying oh someone has to hold the right angle and they're looking the wrong way and that looks like cheating I mean player support teams can always figure that stuff out consistently um but again there's also low hanging fruit so not not all of this stuff is like equally challenging so at a minimum I think you can invest in that or like work with somebody because a lot of those things work out of the box interesting yeah I think that like the tracking of the data itself right which also could just be useful for other things right so this kind of has a double double purpose you know I would definitely want to know how Aver how long my session lengths are in my game right and then therefore since I'm already interested in tracking that kpi and I see a bunch of accounts with session lengths that are above 48 hours you're like this looks suspicious um and so it sounds like your recommendation is from the beginning of a game you know kind of just do some of the Bare Bones Bare Bones things and Henry your recommendation is that okay well if it becomes like a serious serious problem right once you have like

product Market fit to some extent then you can crack down on your specific bot problem in a specific way and so maybe let's split those two things into like the the first thing is um is fake accounts right and so I guess maybe walk me through and maybe we can use the case study from like my example right of how do you EXT now that we're at scale right we have definitely product Market fit um how do I get rid of them um unless maybe like we can we can ggwp is more on the anti-che side toxicity and then your side on the fake fraudulent accounts you you know you let's just say you have identified them how do you get rid of your Bot problem yeah great question so I think yeah as I said earlier the the the more you can focus early on the user journey and kind of and I think behavioral signals are incredibly important component is but the more you can catch before you even have to get the be to the behavioral component the better off off you will be you from a data perspective alone you're

just saving yourself massive amounts of time in terms of sifting through data I think the three main things we think about are kind of three problem vectors we think about are multi accounting bot or Automation and fraud signals so let me just kind of break each individually multi accounting the way we typically approach it and the way we recommend folks approach it is look at things like device Network timings you know signin timings locations Hardware IDs configurations of the device all this type of stuff to create kind of um clusters or Maps or probabilities that users are the same person so that helps to identify clusters of fraud it helps to identify multi- accounting Cil attacks this type of stuff on the fraud signals we're typically looking for things as simple as fake emails you know

extremely new emails things like you know if you're playing PC or or freeo play um things like virtual machines emulators things like connecting via you know proxy IPS vpns uh tampering with your device these type of things really clue you into fraud signals one of the biggest things we see is that um decently sophisticated folks know that you're looking at things like device and network so they're trying to obfuscate those details they're trying to hide you know right and so they're they'll tamper with their device details they'll come uh they'll they'll um sign in from different locations different IPS different you know networks things like this identifying that at the onset is a really easy way to kind of cluster users and detect fraud signals and then the last is automation it's a lot of the stuff George mentioned but a lot of these things that folks will use give off kind of Telltale signals or um

actually change the device details themselves and you can actually detect by just looking at the device details for certain keywords or patterns or uh weird stuff happening and permissions all this type of randomly small tests that can actually detect a lot of these automation Frameworks or macros before they even run and so that's kind of the set of things we look at at I think the other thing I would mention is just almost everyone's using some sort of cloud infrastructure all of those have kind of this web application firewall wff that's a I would highly recommend folks use that it kind of works out of the box it's going to did kind of prevent dos attacks or really highs scale attacks from one or two IPS data centers things like that from from attacking you and so that's a super easy way to get started with an outof the-box nearly free product hm interesting okay so but if I can't

those those are all things basically address them like you said and as early in the player Journey as possible like basically prevent them from signing up in the first place they cannot even create an account because it's like you've entered your email I know you're a bot you've been rejected but let's just say that you have the Bots and they're in the ecosystem and they're tampering with the game um how do you at scale expunge them um and you just kind of go in you've used some of these patterns that you set up and then you cancel the accounts um and then they just can never log in again uh is that the way that you guys would approach it or is that too kind of um naive yeah I think it comes back to something you had said earlier George that I liked which is just how clear you've been with the community around the terms of service and like kind of what what are you what do you have jurisdiction to do right like have you been clear about noots and fraud and stuff like that I think one of the strategies we see a lot of games take that is smart and you used this word earlier George ban waves so they'll

do it in waves and this what the one of the reasons is so if you block someone at sign up they can kind of quickly get that feedback and they can retry come back in with a new account Etc but by doing it in waves you actually sh you you lengthen that feedback cycle and so we do you know if they are malicious we would recommend likely either Banning them or asking for some additional form of verification whether that is um you know a kyc George or a phone number verification something like that to say hey we're gonna add cost to this process for you or we're going to flat out ban you and say hey if you have a problem with this go to customer service we I mean one of the games you worked with I think they banned in one wave like over 30,000 accounts and had two or three complaints right so Bots they know they've been caught they don't complain and so if you're targeting good like you're going to be fine it's really you know like these guys when they get

caught they just go they don't they're not reaching out and wasting their Tim or yours like they they know they've been hit so you're they're they're not going to if the targeting's good you should feel comfortable Banning and if you don't we think things like additional verification steps are fine because you're not actually adding friction for the real users right so in the kyc example George it's like you don't want everyone to do that probably it's just like going to deter people as you said but you know if users look really suspicious it's a fine time to ask them to do that because they're fraudsters or Bots anyway and if you did get a false positive like they'll probably just do it and it's fine they lost like a minute of time so yeah I mean from a security standpoint and policy standpoint you you could absolutely ban all the people I think it's a little bit more complicated than that though for for many of these consumer platforms right um there has to be an internal commitment that you're

willing to address the problem and that means also acknowledging the growth numbers are going to take a hit there's going to be some change in the communication of those numbers I actually think that's the biggest one because you need internal executive alignment that it's now okay to go publicly with these things and then once you choose that route and and I think you get there because you think announcing this is better for the game than worse right because there is some trade-off in some ways you want to be transparent so not only having the bandwave but maybe selectively indicating it telegraphing in advance doing early communication giving people time to stop on their own even but you make this announcement and say in x amount of time we're going to do this so that way your entire Community can react to it can get feedback um I think that matters a lot and then once you do it you publicly announce it and that's the deter step right you show that you've actually gone to this step you note the people that you got because you're not going to get everybody right because there's like different paths or approaches to do it and then when they

see that then that causes additional deterrence as well and you continue to engage the community you get their feedback right it's it's bad if you I don't know say everybody liked it because you know they were tired of getting crushed by sweaty real players all the time in some game like oh well you actually created a slight problem for your community U maybe that balances okay low-l rank or unranked you just let it be but in rank games obviously you can't have like these Bots boosting each other because that that's not something you want so just being very specific with the coal and just sharing you know G Gamers as a whole are like very smart they know the community well they know the um platform well so just to share and just engage with them in that decision- making I think is very valuable yeah that I that's that's pretty um because that has actually a lot less to do with the infrastructure of it and more has to do with the humans involved in the process your community your executive team um and how you kind of manage that right it sounds like to you community should play a big role in

either reporting bot detection or you know advocating yes it's positive or no it's negative um is that a correct conclusion yeah and I think in in part it's because these are all large multiplayer games in the first place that have these problems so they have very large communities yeah that makes sense yeah I think no I think it's a really great set of points George there's kind of one piece that I might might just want to jump in on and it's this idea of kind of telegraphing in advance I think it's good to do there is a double-edged sword though where you can actually you basically show your hand so anyone who has anyone who has kind of accumulated resources in a fraudulent way can now go unload those and actually kind of capitalize on that before they've lost that chance and so if you get in this pattern of hey you Telegraph exactly when you're going to do something the you know weeks before then boders know

hey I just gotta you know I just got to beat the deadline and they'll tell me when it is and so there's a bit of a I think there's a a bit of a surprise element you do want to have in there at some points and maybe it's you know you're really clear that it's happening but you're not telling him when um but just like it's like you know if you're playing football and I tell you the play I'm going to run like you know it's like it's pretty easy to prepare for and so there's kind of this you want some element of surprise in there but you do want Community buyin totally agree with that I think it's a really good point that I didn't touch on at all I think we do see that is really effective and people do cheer when you know when you boot out Bots and it's even fun to show kind of the fraudsters you found you know like almost like a leaderboard of like the bad guys you found right this guy had 84 accounts we kicked them all out we returned you know 30 skins and $20,000 of resources to you

all you know like it's just like a weird like you gamify the bot killing you know it's like or like you have hunters that can report them and like if they find them and it's true like maybe they get some resources and just kind of this you know Community aspect so Community is super important those are all great points just some minor nuances there from what I've seen yeah I totally agree it's a it's a tradeoff right I mean It ultimately comes down to what you're looking for as well if it's very serious if it's like I don't know you're completely destroying the economy you have a crime syndicate around it you would treat like an FBI swarm case you don't say anything until you like raid right if it's like Alex with her opening Hearthstone packs you probably don't need to jump on her in silent ban right you should probably give her like the heads up and create it as a Game feature I think that's just the reasonable right yeah there's times when you want the secret SWAT team and there's times when you want like the nice neighbor calling that's right that's right yeah that's great Nuance um and I

think that also like you know it's like even after you've identify to everybody the um I guess the manner of death execution uh which is a very I guess to your point Henry of you've strung up the bots on on put their heads on a pike um is different depending on what you're trying to accomplish um and so guys uh we're kind of wrapping up on time here um and there's you know a ton of ton of actually topics to go into on the details of Protection Systems um that we didn't be weren't able to talk about but um I want to kind of ask a final concluding question um which is about Ai and its relationship to botting um and I'd love to kind of hear your takes um on the one hand is AI making it easier to catch the Bots or is AI making it easier for parties to invent Bots um and so do you think that botting will get worse or better for games in the years to come I think from our perspective so it's definitely both I think the the thing that's really interesting is

splitting the bad actor Camp into two halves one is AI is adding sophistication to the existing Bots but it also makes creating bots that much more approachable now kind of anyone with a computer can do it and I think the scale is actually the thing that we've seen be the most interesting explosion so yeah the sophistications getting is more advanced but really it's about the scale has exploded anyone can kind of do this stuff now and you can do it at scale really easily and so that's where we've seen the mo most interesting kind of inflection point from a detection perspective yes AI of course helps um and in Georgia it's probably even more effective for for your what you guys do um the other thing that CH is kind of a headwind is player player privacy is a huge focus and of course that's super important but um every time

there's more privacy there's less data you can use to actually determine whether someone's kind of like real or unique and AI can help kind of bridge that Gap a little bit um and just help kind of cluster or see things faster than deterministic computer models can um but yeah I think that this this explosion of scale is probably the most interesting thing we've seen with AI yeah I mean I think AI is essentially creating or escalating this this Bing arms race right you can detect stuff better too but you can also create stuff much more easily and more complicated Nuance stuff so I think what you would expect to see is uh at the floor the easier stuff is just going to get picked up it takes less effort for a studio to do something small to at least get the basic stuff there's more tools out there it's easier to set up but at the same time the really nuanced hard stuff um is just going to become even harder to detect I think when I I hear your point about scale Henry but what I found is

that uh humans tend to prioritize and focus energy on larger and larger scale problems so the bigger the problem is the more likely people will swarm around it and solve it collectively and in fact the argument for why you don't see like things like more sharing and gaming is there isn't something that would like lead to massive criminal or that completely destroyed the game right to that same extent so I'm slightly less worried because if you think about it from a bad actor perspective the motivation is money or like winning but it's also like not getting caught and the more something goes bad or is really big you're more much more likely to get caught at the end of the day huh interesting all right so he yeah two very uh you know different I guess actually different takes which is the whole point about um predicting the future um well guys this was really fantastic um I feel like I'm much more educated on um some of the nuances um in boding uh or fraud um or

multi-accounting or whichever word is more appropriate to encapsulate um this topic of discussion um and it was a pleasure to gu to have you guys um on air today um if there are any people in the audience that are looking to either get in touch with your companies because of they are looking to implement a uh detection solution or you know bolster up the their defenses and user Integrity uh how can they get in touch with you guys our website or shoot me an email at Henry ver. um same website ggw.com or George ggw.com excellent um well as always friends um that's our episode today uh if you've got feedback or ideas please hit me up at Alexander nov. um we are always open um and with that we are out Henry and George thank you so much thank you so much super fun appr the time if you enjoyed today's episode whether on YouTube or your favorite podcast app

make sure to like subscribe comment or give a five-star review and if you want to reach out or provide feedback shoot us a note at podcast nov. or find us on Twitter and Linkedin plus if you want to learn more about what navic has to offer make sure to check out our website www.navicamls.net to learn about our wide ranging Consulting and advisory Services again that is www.nic.edu [Music]