Fraud at second zero: why waiting until cashout to detect abuse is a strategic mistake

Volodymyr Todurov, CEO of Frogo, argues that if you only verify users at withdrawal, you have already paid for the fraud. The operational damage is done long before cashout, which is why he pushes “Second-Zero Prevention” — risk screening from the first millisecond a user lands on the page.

1. The traditional approach treats payout-time checks as the main defence: let users register, deposit, and interact freely, then stop abuse at the cashout stage. On paper that sounds efficient. In practice, it turns fraud detection into an after-the-fact cleanup exercise.
2. By the time a fraudster, bot farm, or bonus abuser reaches withdrawal, the business has already absorbed the cost. Todurov lists the main damage points: burnt marketing budgets from fake traffic and bonus abuse, operational overhead from manual compliance and KYC reviews, inflated server and payment costs from bot activity and fake micro-deposits, and distorted analytics that pollute conversion, retention, and ROI data.
3. His point for operators is simple: cashout-only controls do not protect unit economics. They protect the last step in the funnel, after acquisition spend, support workload, infrastructure usage, and reporting quality have already been hit.
4. The proposed alternative is to move risk evaluation to “Second-Zero Prevention” — screening from the first millisecond a user touches the landing page, before any form field is filled out. According to Todurov, modern Device Fingerprinting can capture device environment, connection parameters, and physical interaction signals immediately and build a risk baseline at entry.
5. The visible signals at this stage include hardware and environment anomalies such as virtual machines, headless browsers, anti-detect software, spoofed canvas signals, and automation frameworks like Selenium or Puppeteer. He also points to cross-site and cross-domain identity signals via device_id, which let operators recognise hardware that has already appeared elsewhere in the funnel.

For high-risk operators, the practical takeaway is not about “more security” in the abstract. It is about where in the funnel you choose to spend fraud-prevention effort: after the money and traffic are already gone, or at the point where abuse first becomes machine-readable.