Poker Scam Patterns — The Six Categories That Recur Across Every Platform

The exit scam

An agent operates legitimately for months or years. They build reputation, a large active player base, and growing aggregate balances. Then, in a single week, they disappear with every outstanding balance. A fresh Telegram account with a new avatar often surfaces shortly after.

Red flags:

• Agent resists withdrawal testimonials from recent players (past 30 days specifically)
• Balance-holding policies that encourage leaving funds with the agent rather than withdrawing regularly
• Operation structured around a single Telegram identity with no business entity, no website, no public team
• Sudden 'temporary technical issues' affecting all withdrawals at once

How to avoid:

Withdraw regularly — don't let balance accumulate with any agent beyond your comfort level. Run the 7-point agent verification checklist before first contact. Test with a small deposit, small play session, and full withdrawal before scaling up. Exit-scam agents usually fail the test-transaction step.

The variable-rate rakeback bait

Agent advertises 50% or 60% rakeback upfront to win business. After enough volume has been played to matter, they quietly drop the rate — citing 'market changes,' 'operator policy,' or 'tier adjustments.' The drop is usually from 50%+ to 30% or lower.

Red flags:

• Rakeback rate quoted only verbally or in a Telegram message, never documented with a formal schedule
• Rate described as 'up to X%' without a published ladder
• Agent unwilling to commit the rate in writing with a specific start and end date
• Tier rules defined vaguely or subject to 'agent discretion'

How to avoid:

Require the rakeback rate in writing with a commitment period. Walk away from any agent who refuses. Compare against the published market — Deep Poker's ladder (25% Bronze to 50% Legend) sets a real floor for what a transparent program looks like. 'Up to 65%' is a marketing claim, not a rakeback rate.

The exchange-rate skim

When you deposit crypto, the agent credits chips at a slightly unfavorable USD rate. When you withdraw, they convert back at a rate that favors them again. Over many transactions, the cumulative skim can dwarf the visible agent fee or rake.

Red flags:

• Chip-credit rate never published, always negotiated per-deposit
• Agent refuses to show live exchange-rate benchmarks (Binance mid-market, Coinbase rate)
• Spread between deposit rate and withdrawal rate larger than major-exchange spreads (which are typically under 1%)
• No receipt showing the rate applied to each transaction

How to avoid:

Screenshot the live BTC/USDT/USDC rate at deposit time. Demand the same visibility on withdrawal. Any agent who can't or won't document the conversion rate is either skimming or will be soon. Published platforms like Deep Poker credit at transparent rates; the reference mid-market rate is the one that matters.

The impersonator

Someone copies a legitimate agent's Telegram username, avatar, and messaging style. They solicit new players with a slightly better rate than the real agent, take the deposit, and disappear. Often targets players who mention the real agent's name publicly.

Red flags:

• Username is legitimate-looking but has a subtle substitution (zero instead of O, extra underscore, capital I instead of lowercase l)
• Account creation date is recent despite claiming long operation history
• 'Better rate than you've seen' language
• Resistance to video call or multi-channel verification

How to avoid:

Verify the exact Telegram username through a second channel — the real agent's website, an older community post, or a referral from someone who has transacted with them recently. Never accept a rate improvement as a reason to switch to an unverified contact. Real rate improvements come through the same verified channel as the original relationship.

The withdrawal stall

Your deposit clears in minutes. Your first withdrawal request hits persistent 'processing' or 'verification' delays. Agent may request an additional deposit to 'unlock' the withdrawal or cover a fabricated fee. Classic advance-fee pattern in crypto-poker clothing.

Red flags:

• Withdrawal suddenly requires a new document that wasn't asked for at deposit
• Processing time keeps extending — every update pushes the expected date further out
• Agent requests additional funds to 'release' or 'verify' the original
• Support channel goes silent after the withdrawal is requested

How to avoid:

The moment an agent asks for additional money to receive money, the funds are already gone. Do not send more. Document everything (chat logs, TXIDs, timestamps) and proceed straight to the rescue procedure at the bottom of this page. A legitimate delay gets acknowledged and resolved within a few business days — a stall extends indefinitely.

The helper-intercept

You post in a public channel asking how to deposit, or someone messages you after you join a poker Telegram group. A stranger offers to 'walk you through' or 'help' with your deposit. The deposit address they give you is theirs, not the platform's.

Red flags:

• Unsolicited DM offering help with deposits or withdrawals
• Helper claims to be 'with support' or an 'official agent' without verifiable credentials
• Urgency framing — 'the exchange rate is better right now' or 'before the limit resets'
• Asks for screen share during deposit flow

How to avoid:

Never take deposit instructions from a DM you didn't solicit from a verified official channel. Legitimate platforms never initiate support contact. On Deep Poker, the deposit address comes from your own panel inside a logged-in session — not from any message, anywhere.

Wrong-network misdirection

A scammer takes advantage of the shared address format across EVM chains (0x addresses work on Ethereum, BSC, Arbitrum, Polygon, etc.). They give you a legitimate-looking address that's valid on a chain the destination doesn't watch. Your funds land at an address you can't reach.

Red flags:

• Deposit instructions specify a chain that isn't on the platform's official supported list
• Instruction to 'use ERC20 even though the platform says BEP20' or similar network override
• Address given through a chat channel rather than the platform's own UI

How to avoid:

Copy the address directly from the platform's logged-in deposit screen, not from a message. Confirm the network label on the deposit screen matches the network you'll send from. If the address format doesn't match the network you picked, re-select the network before pasting anywhere.

The spoofed-TXID reply

After a real deposit from you, a scammer sends a message with a screenshot of a fake transaction confirmation pretending to be 'your deposit.' The fake screenshot comes with a call to 'contact support' at a scam link because 'something went wrong.' You think it's your own money that's stuck and panic-click.

Red flags:

• Support contact arrives unsolicited shortly after a real deposit
• TXID in the screenshot doesn't match the one in your own wallet
• Support link is a lookalike domain, not the official platform URL
• Urgency language — 'act in the next 10 minutes' or 'funds will be returned if not resolved now'

How to avoid:

Only use the support channel inside your logged-in account or the official website URL you navigated to yourself. Verify your own TXID in your own wallet's transaction history — not in a screenshot someone sent you. When in doubt, do nothing for an hour and let your real balance update confirm the deposit landed.

The dust attack + spoof follow-up

A scammer sends a tiny amount (a few cents) to your wallet from an address that looks almost identical to one you've used before. Later, when you want to send to that similar-looking address, you accidentally pick the scammer's address from your 'recently interacted with' list.

Red flags:

• Unsolicited tiny crypto deposits with no apparent source
• Address in your interaction history that looks suspiciously similar to one you use regularly
• Wallet auto-suggestion pulling up an address you don't remember adding

How to avoid:

Never rely on wallet auto-complete or recently-used lists for deposit addresses. Paste the address fresh from the platform every time, and verify the first and last characters match. A dust attack doesn't hurt you directly — it only works if your next send uses wallet history as the source of truth.

The 'fee-to-unlock' scam

Your withdrawal is in 'processing.' You're told a tax, network fee, or compliance fee needs to be paid before the withdrawal releases. Legitimate platforms never require you to pay a fee before receiving money — fees come out of the withdrawal itself, not out of your pocket.

Red flags:

• Any request to send additional funds in order to receive existing funds
• Fee presented as 'tax,' 'network fee' (when the platform has never charged one), or 'anti-fraud deposit'
• Amount requested seems calibrated to what you'd be willing to send to unlock a larger amount
• Instructions to send the fee to a different address than your usual deposit flow

How to avoid:

The rule is simple: to receive money, you never send money. Any counterparty requesting a 'release fee' is stealing from you. Stop transacting immediately and start the rescue procedure.

The fake KYC wall

A platform that didn't require KYC at signup suddenly requires KYC at withdrawal time — and the process keeps rejecting documents. Each iteration asks for more personal information, often enough to enable identity theft. Meanwhile the withdrawal is 'held' indefinitely.

Red flags:

• KYC appearing only at withdrawal time when it wasn't required at deposit or play
• Document requests escalating beyond standard KYC (selfies with specific hand gestures, full bank statements, passport with account balance visible)
• Rejected documents with vague reasons
• Multi-stage 'verification' that stretches for weeks

How to avoid:

On any legitimate regulated operator, KYC is front-loaded or triggered early. KYC introduced only at withdrawal is a red flag the operator wasn't actually licensed. Prefer platforms with a clear KYC policy from the start — or platforms like Deep Poker that don't require KYC at all, where withdrawal is self-serve and bounded by an SLA.

The indefinite verification

Withdrawal is 'under review.' You're told a human will get back to you. Days pass, then weeks. Messages go unanswered. The platform may continue accepting deposits from you and others throughout this period — that's the tell.

Red flags:

• Active deposit channel but frozen withdrawal channel
• Support delays that always push forward, never resolve
• No specific SLA — 'we'll get back to you' with no stated timeline
• Other players in the community reporting the same withdrawal pattern at the same time

How to avoid:

Platforms with a published withdrawal SLA (Deep Poker: 1 hour typical, 24 hours absolute maximum) are accountable to their own numbers. Platforms without one can extend delays indefinitely. When a withdrawal exceeds twice the platform's stated SLA without a clear resolution plan, treat it as a scam event and document aggressively.

Collusion / team play

Two or more players share hole-card information and coordinate play at the same table to extract EV from non-colluders. Common forms: soft play (avoiding raising each other, ganging up on outsiders), explicit signaling (sharing cards via side channel), same-IP collusion (physically-colocated multi-accounts).

Red flags:

• Same two or three players consistently sitting at your tables across sessions
• Soft-play patterns — players at a table never putting heat on each other
• Unusual chip flow between the same player pairs over weeks
• Coordinated sit-in / sit-out behavior

How to avoid:

Play in unions with dedicated security teams (Massiv, TMT) where algorithmic pattern detection runs. Report suspicious pairs to the club manager or union security team — the union can see aggregated patterns you can't. Change tables if you see consistent same-player behavior you can't explain.

Chip dumping

A specific form of collusion. One colluder deliberately loses chips to another by overbetting with weak hands or calling off stacks. The receiving player cashes out via the agent. The losing player's deposits fund the winning player's withdrawals. Proceeds are split offline.

Red flags:

• Consistent one-way chip flow between the same two accounts over dozens of sessions
• The 'losing' account making statistically implausible play against only the 'winning' account
• Account pairs with matching login patterns (same time windows, similar session lengths)

How to avoid:

Union-level detection is the effective response. This is why Massiv, TMT, and larger unions invest in pattern-detection algorithms that run on their full transaction history. At individual club level or across small unions, chip-dumping is harder to catch.

Bot play

Software playing instead of a human. Ranges from simple starting-hand-chart bots (low-stakes volume plays) to sophisticated GTO-adjacent bots running solver-derived strategies (hard to distinguish from strong human play).

Red flags:

• Identical timing patterns across large hand samples (typically faster than human reaction)
• Session length that extends unnaturally long (24+ hours)
• Response consistency that doesn't show the variance of human play
• Lack of table chat or emote interaction

How to avoid:

Prefer platforms with active anti-bot enforcement (GGPoker's Poker Integrity Council seized $1.2M from AI-bot accounts in January 2026; major ClubGG unions run bot-detection). Format that disadvantage bots — bomb pots, straddle tables, action-forcing structures — are where humans outperform current-generation bots.

Ghosting

A stronger player feeds a weaker player decisions in real time via voice or messaging. The weaker player is the visible account; the stronger player shares profits offline. Difficult to detect without voice/video evidence.

Red flags:

• A player's performance improving dramatically over a short window without corresponding study
• Consistent delays at decision points longer than normal (the ghost is considering, then messaging)
• Mid-session wins that align with times a known strong player is online but not playing

How to avoid:

Hard to detect as an individual. Union-level scrutiny helps. At high stakes where ghosting is most common, the response is usually enforcement based on tips from players in the community — so report suspicions to the union rather than trying to handle it at the table.

Multi-accounting

One person running multiple accounts, often at the same tables. Enables both collusion (both sides of a potential team under one person's control) and bankroll hiding (losing on one account, withdrawing from another). Sometimes benign (a player forgot old credentials), often weaponized.

Red flags:

• Same login pattern across multiple accounts at the same union
• Shared device fingerprints
• Coordinated sit-out / sit-in behavior that suggests single-operator control

How to avoid:

GPS/IP restrictions at the table level (standard on major unions) block easy cases. Harder cases require union-level account-pattern detection. As a player, report suspected multi-accounts you observe consistently.

RTA (Real-Time Assistance)

A player uses solver tools during a hand to calculate optimal play. Most major platforms prohibit RTA in their terms. Enforcement depends on detecting the solver latency pattern, which is subtle.

Red flags:

• Consistent optimal play in spots that require a solver to identify
• Decision times spiking in complex board-texture spots specifically
• Performance that exceeds a known strong human profile without the corresponding study history

How to avoid:

Primarily a high-stakes concern. If you play at stakes where RTA economics work, play on platforms with active RTA detection (GGPoker in licensed markets, established unions on ClubGG/PPPoker). At recreational stakes, RTA is rarely the relevant risk.

Fake platform support

A scammer impersonates platform support — often initiating contact after you've posted in a public channel about an issue. They direct you to a lookalike URL to 'verify' credentials or ask for your seed phrase / private keys. The credentials get used to drain your real account.

Red flags:

• Support reaching out to you unsolicited on a public post
• Request for seed phrase, private key, or password 'to verify'
• Lookalike domain — deep-poker.com, deep.poker.help, clubgg-support.com, etc., instead of the real URL
• Suspicious urgency

How to avoid:

Legitimate platforms never ask for seed phrases, private keys, or passwords. Any support interaction should happen through a channel you initiated — not one someone reached out to you on. Bookmark the real URL and always open support from there, not from a link someone sent you.

Fake giveaway / airdrop

A 'giveaway' from what looks like an official platform, WSOP, GGPoker, or a known pro. To claim, you connect a wallet to a lookalike site. The connection approves token transfers, draining your wallet.

Red flags:

• Giveaway from a non-verified account (always check verification badges, follower counts, account age)
• Wallet-connect required to claim
• Token-approval request for more than the specific claim transaction
• URL that looks legitimate at a glance but isn't the operator's real domain

How to avoid:

Real platform promotions don't require wallet-connect approvals to claim. Any giveaway that wants you to sign a transaction or approve unlimited spending on a token is the attack vector, not the prize. WSOP, GGPoker, and other real operators communicate promotions through your logged-in account, not through random wallet interactions.

Fake streamer / pro agent

Someone impersonates a well-known poker pro or streamer, claiming to operate an agent service. New players trust the name recognition, send deposits, get scammed. The real pro usually has no affiliation with any agent service at all.

Red flags:

• Well-known pro's name attached to an agent service with no cross-verification from the pro's own verified channels
• Rate 'specially for' followers of the named pro
• Testimonials that can't be traced back to real accounts
• Urgency to 'lock in the special rate'

How to avoid:

Real pros, when they partner with platforms or programs, announce it through their own verified social channels. If a pro's endorsement can't be confirmed on the pro's own X, Instagram, or website, it isn't real. Impersonation of known names is among the most common scam vectors in poker communities.

The fake staking pool

A person or group markets a 'professional staking pool' promising weekly or monthly returns. Early payouts are funded by new deposits (classic Ponzi structure). Eventually the operator exits with outstanding capital. The poker framing is cover for the financial fraud underneath.

Red flags:

• Guaranteed returns framed as low-variance
• No verifiable public tournament or cash-game results from the 'stakers'
• Returns paid in the same asset stakers deposit (signature Ponzi marker — legitimate stakes pay from tournament winnings, which take time)
• Emphasis on recruiting new stakers for 'referral bonuses'

How to avoid:

Real poker staking is rare, opaque to outsiders, and never offered publicly with marketing material. Serious pros stake within private networks, not public Telegram groups. Any 'pool' with a landing page and sales funnel is almost certainly a Ponzi. If a return seems too good, it is — poker returns are high-variance by nature and cannot be smoothed into 'monthly yields.'

Bankroll-sharing arrangements

A 'coach' or 'mentor' offers to share their bankroll with you in exchange for a profit split. You send them money to 'fund your development.' The money is never used for poker — it's consumed. The relationship dissolves with invented reasons (you 'played badly,' you 'violated the agreement').

Red flags:

• Coach/mentor asks for upfront capital before any coaching happens
• Split terms that favor the coach overwhelmingly (70%+)
• No written agreement, or an agreement that gives the coach sole interpretation authority
• Pressure to decide quickly

How to avoid:

Legitimate coaching is paid per hour or per course, with clear deliverables. Legitimate staking flows from staker to stakee, not the other way around. If you're sending money to a coach instead of receiving coaching for money, you're not being coached — you're being stolen from.

Training-site fraud

A training site sells access to 'exclusive content' from alleged pros. The pros don't exist or don't endorse the site; the content is repackaged free material; the subscription model is the scam itself. Sometimes pivots to upsells for 'elite' tiers, 'private coaching,' or 'backing.'

Red flags:

• Training site with no verifiable instructor credentials
• Pro names attached without confirmation from those pros' own channels
• Aggressive recurring-subscription billing with difficult cancellation
• Upsell funnel that escalates to 'staking' or 'bankroll sharing' after the subscription

How to avoid:

Stick to training sites with public, verifiable instructor rosters (Run It Once, Upswing Poker, Solve For Why, etc. — names whose principals can be independently confirmed). Any site that can't document who actually produces the content is a red flag; any site that escalates subscription users toward 'backing' arrangements is a red flag squared.

Urgency + scarcity framing

Scams depend on you deciding faster than you can verify. 'Limited slots,' 'rate expires in 2 hours,' 'exchange window closes tonight' — these are choreographed pressures. No legitimate operator needs you to decide within minutes.

Unsolicited contact initiating the relationship

Real operators don't DM new customers. Support responds when you ask — it doesn't start the conversation. Any 'help,' 'offer,' or 'support' that arrives without you asking is a scam vector by default.

Requests for seed phrases, private keys, or passwords

Anyone with these has your wallet. No legitimate operator needs them. If you're asked, you're being phished — full stop.

Pay-to-receive structures

To receive money, you never have to send money. 'Unlock fees,' 'verification deposits,' 'release taxes' — all variants of the advance-fee scam. If it starts with 'send us X to get Y,' it's a scam.

Rate or return claims without published schedules

Legitimate economics can be documented. 'Up to 65% rakeback' without a ladder means no ladder. 'Weekly 5% returns' without an audit trail means no returns. Real programs publish their rules.

Resistance to small test transactions

A real counterparty is happy to process a $10 deposit and withdrawal as a test. One that resists is filtering out careful users — which is the entire point, from their perspective.

No verifiable public presence beyond one chat app

A Telegram profile alone is not a business. Real operators have websites, formal entities, multi-channel presence, and history that can be verified independently.

Name-drops of real people or institutions without cross-verification

Scammers use real names — pros, sponsors, partners — to borrow credibility. Always verify an endorsement through the endorser's own verified channel. If the named pro's own Twitter or website doesn't confirm it, it isn't real.