Deposit pages at U.S.-facing online gambling sites get hit by card-testing bots roughly three times as often as withdrawal pages, according to fraud teams tracking the pattern over the past 18 months. The bots aren't trying to steal from player balances — they're probing whether stolen card numbers will authorize, and deposit flows are where the answer comes back fastest. That asymmetry matters because it tells you where operators are actually exposed, and it isn't where most compliance budgets go.
Why deposits are the soft target
Card testing works by submitting small transactions against a merchant account to see which numbers are live. A deposit page is built for speed: enter card, get approved, start playing. The response comes back in under two seconds, and a bot can log success or failure instantly.
Withdrawals are the opposite. Payouts involve identity checks, cooling-off periods, and manual review thresholds that typically kick in above $2,500 at most U.S.-licensed books. A bot trying to test cards through a withdrawal form hits a wall of friction — and worse, from the fraudster's perspective, a withdrawal request ties a card to an account that's now flagged.
So the traffic follows the path of least resistance. Fraud analysts at three separate platform providers described the same ratio: for every failed card attempt logged on a cashier page, they see roughly one on the payout side. One team running a mid-size sportsbook put the split at 74% deposit-side, 26% withdrawal-side across a 90-day window ending in March.
The numbers behind the noise
The volume is smaller than headline breach stories suggest, but the pattern is consistent. A typical mid-volume operator sees between 400 and 900 declined card attempts per day, with spikes of 3,000-plus during coordinated attacks. Those attacks usually last 20 to 40 minutes and rotate through proxy pools in batches of 50 to 200 IPs.
The tell isn't the decline rate alone — it's the velocity. Legitimate players rarely attempt more than two cards in a session. Bots will run 40 to 60 attempts per minute against the same deposit endpoint, often with card numbers from a single BIN range. Issuers notice before operators do, which is why chargeback alerts frequently arrive days after the attack has moved on.
What operators are actually doing about it
The countermeasures that work aren't exotic. Device fingerprinting at the cashier page, velocity limits tied to account age rather than raw attempt count, and CAPTCHA challenges triggered on the third failed authorization all cut bot traffic measurably. One operator reported a 62% drop in card-testing attempts after adding a challenge on the second decline rather than the fifth.
The harder problem is the tradeoff. Every additional friction point on a deposit page costs conversions. Operators know that a player who fails a card test and gets challenged may simply leave — and at a 96.1% average slot RTP, the house edge doesn't recover a lost depositor quickly. Fraud teams and growth teams have been arguing about this threshold for years, and the argument hasn't gotten easier.
The question nobody's answered
If deposit pages absorb three times the bot traffic, why do most fraud budgets still weight withdrawal monitoring and account takeover detection so heavily? Part of it is regulatory: payout fraud triggers complaints and licensing scrutiny in ways deposit fraud doesn't. Part of it is legacy tooling built when payouts were the bigger loss channel.
But the ratio suggests the threat model has shifted faster than the defenses. Card testing on deposit pages is cheap, fast, and mostly invisible to the player — until the issuer starts declining legitimate transactions because the BIN range got burned. The open question for U.S. operators is whether conversion-friendly deposit flows can survive without becoming the path of least resistance for the next bot wave.