Competitions and entry fraud: identifying bots without losing genuine winners

Entry fraud in a competition refers to any attempt to obtain prizes or extra entries by means contrary to the rules: multiple accounts, automated scripts, coordinated entry or manipulation of the draw mechanics. To detect it, the organiser combines three families of signals: technical indicators (device, network, duplicates), behavioural indicators (pace, sequence of actions, timing) and indicators of consistency between the registration and the rest of the data. No single signal is enough to prove fraud; it is their accumulation, documented and applied according to criteria written in advance, that justifies an exclusion.

Why is entry fraud increasing in online competitions?

An online competition rewards a simple and repeatable action: filling in a form, sharing a post, voting, referring a friend. This simplicity makes automation tempting. A script can submit forms at high speed, a network of accounts can vote in a coordinated way, and a group of participants can share referrals among themselves to artificially inflate a ranking.

The most frequent frauds fall into four families:

• Multiple accounts: the same person creates several identities to multiply their chances.
• Automation: bots fill in forms or trigger actions at a rate impossible for a human.
• Coordination: an organised group (sometimes paid) produces entries or votes in bulk.
• Circumvention of the rules: identity theft to claim a prize, fictitious referrals, creation of accounts for third parties without their consent.

The important point for an organiser is that these frauds do not all look alike. A bot mainly leaves traces of speed and regularity. A coordinated network leaves traces of synchronisation between accounts. An isolated fraudster using several email addresses mainly leaves technical and documentary traces. Different checks are therefore needed for each case.

Which behavioural signals should be monitored?

Technical detection (IP addresses, VPNs, browser fingerprints, duplicate emails or phone numbers) is necessary but insufficient. It does not see a participant using a legitimate VPN, nor a bot that changes address with every request. Behavioural signals, on the other hand, describe the way an action is carried out.

Suspicious timing

A human participant has an irregular pace. They read the rules, hesitate, go back, close the tab, reopen it. A bot has a pace that is too regular or too fast. The signals to examine are:

• Submissions made at almost identical intervals (for example every three seconds for several hours).
• Entries concentrated in the first seconds after the competition opens, or just after a reminder published by the organiser.
• Activity peaks outside the hours when the target audience is actually online, especially if the activity is spread across several time zones with no apparent logic.

Abnormal paths

The path refers to the sequence of pages and actions. A human journey is often disordered: a home page, then the competition page, then a pause, then the form. A script generally follows a direct route, without consulting the rules, without scrolling, and sometimes skips mandatory steps (for example submitting the form without ever loading the email confirmation page).

A strong signal is the invariant path: hundreds of entries that follow exactly the same sequence of events, to the millisecond, are very unlikely among humans.

Impossible speed of engagement

Some actions have a realistic minimum duration. Entering a name, an email, an address and answering a general knowledge question takes a non-zero amount of time. If the complete submission arrives in less time than it takes to read the question, that is a strong indication of automation or copied answers.

This threshold should be set from real tests, by timing several people filling in the form on different devices, and not from intuition. A threshold that is too strict penalises fast people, users of autocomplete and those who legitimately copy and paste their details.

Consistency between data

An account may look normal in isolation and become suspicious when compared with other information: a postal address that does not match any delivery area accepted by the rules, a phone number already used by several registrations, a date of birth incompatible with the required age range, or a username modelled on a series (user2481, user2482...).

Operational checklist of warning signals

Here is a list that can be used as is to prepare the checks for a competition. Each signal must be recorded, and not treated as proof.

1. More than five registrations sharing the same browser fingerprint or the same device identifier over the duration of the competition.
2. A regular submission rate within a few seconds, over more than ten consecutive entries.
3. A form completion time below the minimum threshold measured during your tests.
4. Emails with a disposable domain or an automatically generated pattern (random strings, incremented numeric suffixes).
5. Referrals forming a closed graph: a small group of accounts refers exclusively to each other.
6. A concentration of entries within a few minutes after a reminder post on social media.
7. Votes or likes coming from the same block of IP addresses or the same access provider over a short period.
8. Postal or phone details inconsistent with the conditions of entry.
9. Accounts created shortly before the competition begins and with no other activity.
10. Entries that fail the validation steps (confirmation link never opened) but are nevertheless counted.

A single point justifies nothing. Three or more convergent, documented points justify a manual review. An exclusion must rest on a body of evidence, not on a single item.

How can a risk score be built without automating injustice?

A risk score assigns a value to each signal, then aggregates these values to decide on an action: accept, review, suspend. The principle is simple; implementation requires caution.

Take the hypothetical case of a cosmetics brand running a prize draw with entry by form and by referral. The marketing team could assign points as follows: 2 points for a suspicious rate, 3 for a duplicate phone number, 1 for a disposable email domain, 2 for a referral in a closed graph. A participant who reaches 4 points goes into a manual review queue; they are never excluded automatically.

Design rules to follow:

• Document each criterion and its weighting before the competition launches, and keep this record.
• Separate the score from the decision: the score prioritises reviews; a human makes the final call.
• Test for false positives: replay the model on past entries or on a sample of tests to see how many genuine participants would be flagged.
• Avoid sensitive criteria: no criterion should rely on data that reveals an origin, an opinion or a protected characteristic.

As for tools, there are solutions for identity verification, bot detection and reputation analysis of IP addresses or emails. The choice depends on volume, budget and the team's ability to interpret the results. A tool that produces an opaque score without explanation is difficult to defend in the event of a challenge. Favour those that disclose the reasons for a flag.

How can a participant be excluded without creating a GDPR dispute?

This is where organisers most often go wrong. Excluding a participant is a decision that affects a person, and it involves the processing of personal data. It must therefore rest on a clear legal basis and a traceable procedure.

Which legal basis should be used?

For the fight against fraud, the organiser's legitimate interest is commonly invoked, provided that a balancing analysis between this interest and the rights of participants is carried out and documented. The competition rules must also clearly inform participants that anti-fraud checks are carried out, which data is analysed and how long it is kept. This information must be accessible before entry, not discovered after an exclusion.

Check the position of your data protection officer or your legal counsel: the exact qualification depends on the processing, the country of residence of the participants and the tools used.

What procedure should be followed before an exclusion?

A defensible procedure unfolds in stages:

1. Characterise the flag: list the signals observed, with the timestamps and technical data that justify them.
2. Review manually: a second look, ideally by someone other than the person who configured the score, examines the case. They also look for legitimate explanations (same household, same company network, shared phone).
3. Inform the person where possible and proportionate, describing the reason factually, without theatrical accusation and without revealing the details of the detection model that would allow it to be circumvented.
4. Allow a possibility to respond within a reasonable time, through an identified channel.
5. Decide and record the decision, with its reasoning, in an internal register.
6. Limit retention of the analysis data to the time necessary to handle complaints and meet legal obligations.

How can a reputational crisis be avoided?

A badly handled exclusion quickly ends up on social media, often in the form of a screenshot taken out of context. A few principles limit this risk:

• Never publish the name or username of an excluded participant.
• Do not use publicly accusatory wording such as "fraudsters"; prefer "entries that do not comply with the rules".
• Prepare in advance a standard response for challenges, approved by legal.
• Explain, in the rules, how the draw is supervised and how the checks are carried out. Clear rules protect more than reactive communication.

Common mistakes to avoid

• Excluding on the basis of IP address alone, which may be shared by thousands of people (mobile operator, company network, student residence).
• Rejecting a winner without notifying them: silence is perceived as an arbitrary sanction.
• Changing the rules during the competition to exclude participants without this being stated in the initial rules.
• Keeping suspected fraud data indefinitely.
• Treating a drawn winner as a suspect before the signals have been verified, which exposes you to accusations that are difficult to retract.

How can genuine winners be protected during the checks?

The anti-fraud check must not delay the awarding of prizes for everyone. A good practice is to carry out the draw on the basis of valid entries, then verify only the designated winners, before the announcement. It is also possible to provide for a reserve draw, described in the rules, to replace a winner whose entry is invalidated after verification.

This choice has two advantages. It limits the number of people subjected to an in-depth check, and it avoids casting suspicion on the entire participant base. It does, however, require the rules to specify the order of operations and the verification period.

For a competition organised by a small team, the most useful rule remains the simplest: document the criteria before launch, never exclude on a single signal, and keep a record of every decision. That is what allows you, in the event of a challenge, to show that the processing was consistent, proportionate and identical for everyone.