Ghost Accounts: How Fabricated Identities Hide the Real Bettor

The problem is not always a fake document. In a growing number of cases, the document is real, the CPF is valid, and biometric verification passes without a hitch — but the person in the registration data is not the one actually placing bets. For iGaming operators and PSPs, that is the point where ordinary onboarding KYC stops being enough.

1. A ghost account is opened using the legitimate identity of one person — a relative, an acquaintance, or someone paid for the job — but it is operated by someone else, the real bettor. Unlike synthetic identity fraud, which mixes fabricated data with a stolen CPF to create a “customer” who does not exist, a ghost account uses a real identity from start to finish. The fraud is not in the document; it is in who controls the account after approval.
2. This is exactly why traditional onboarding checks miss it. KYC at signup is designed to answer one question: is the person registering who they say they are? In a ghost-account setup, the answer is yes, because the person who registers and passes facial biometrics is the actual holder of the documents. The problem starts later, when that person hands over control of the account, for money or some other arrangement, so a third party can bet under their name.
3. The scheme is especially attractive for people who need to hide their betting identity: people who have already been banned or self-excluded from other platforms, politically exposed persons who do not want bets tied to their CPF, and minors using an adult family member’s account to bypass age verification.
4. Minors are now a direct regulatory concern here. Law No. 14.790/2023 expressly prohibits under-18 participation in fixed-odds betting, and the Estatuto Digital da Criança e do Adolescente (ECA Digital, Law No. 15.211/2025), in force since March 2026, tightened the requirement for real age-verification mechanisms in any digital product or service likely to be accessed by that audience, including betting platforms. A ghost account opened under an adult’s identity effectively nulls age verification at signup, because the check was done correctly — just on the wrong person.
5. The technical response has to go beyond confirming that the document is authentic and the face in the onboarding flow belongs to a live person. Operators need to monitor whether account usage remains consistent with the profile of the person who opened it over time: same device, same access region, same behavioral pattern, and same timing. In other words, approval is not the finish line.