R. Paul Wilson On: Casino Security and Customer Protection

Author: R. Paul Wilson

I recently revisited the annual World Game Protection Seminar in Las Vegas, a by-invitation-only event that has seen year-on-year growth aimed at addressing the evolving threats within the gaming sector. The event, orchestrated by the renowned Willy and Jo Allison, has become an essential gathering for exchanging tips and strategies related to casino games, as well as fortifying business defenses.

The topic of deception spans a vast and complex spectrum. Discussing methods to legally outmaneuver casinos, alongside tales of illicit game manipulation, offers a rich tapestry of intrigue. Yet, it's vital to also acknowledge the considerable efforts and resources the casino industry dedicates to safeguarding its most precious commodity: the players.

Combating the Emerging Threats in Gaming Security

This year's agenda spanned a range of topics, some beyond my purview—like procedural updates for frontline staff. However, my interests, particularly in social engineering and mechanical tampering (highlighted by innovations like a shuffling machine capable of dealing cards in any sequence), were thoroughly addressed while my own presentation delved into the necessity of a deeper exploration of deception.

In the lead-up to the conference, Willy and Jo hosted a private reception for the speakers, offering an opportunity for informal discussions over wine and hors d'oeuvres about the upcoming sessions. Conversing with a fellow speaker, I observed that - historically - the discourse, both on stage and off, seemed more aligned with casino interests than player safeguarding. It struck me that as live gaming increasingly attracts criminal attention—given the valuables players often possess—the focus seemed skewed.

Yet, an enlightening counterpoint was raised: by more effectively securing casino games, the industry simultaneously enhances player protection, illustrating these goals to be mutually reinforcing.

In 2023, Willy Allison astutely anticipated the growing relevance of social engineering, hacking and digital deceit in the wake of technological advancements, so they dedicated a day for experts from these realms to share their insights with casino professionals. It was not only insightful to absorb the presentations on topics like OSINT and hacking shuffling machines but also to engage with subsequent discussions, tracking the thought processes of those on the front lines of gaming security.

Within the agenda, there were insightful discussions and presentations on cheating and other criminal activities targeting the industry. This included an annual overview by Sal Piacente, a recognized authority with extensive knowledge of advantage play and fraudulent gaming tactics, complemented by live dialogues between Willy and seasoned experts.

Uncovering Vulnerabilities in the Casino Industry

The primary aim of this event was to both illuminate current challenges and propose viable solutions. However, it also highlighted ongoing issues within casino culture concerning the prevention of deceit. My interest was particularly piqued by how participants would approach the growing menace of digital intrusions, exemplified by the cyber attacks at MGM and other properties last year.

Rumors had reached me that a certain executive had dismissed these cyberattacks as negligible risks, covered by insurance, and showed little concern for their recurrence. This perspective struck me as remarkably myopic—a stance unfortunately not uncommon in the gaming sector—which overlooks a critical aspect: the jeopardy to casino customers whose personal information may be compromised, potentially leading them to patronize alternative venues following a breach.

Social engineering, leveraging traditional con artistry techniques, emerged as a focal point of interest among security professionals. This was not solely due to the multi-million-dollar cyber heists targeting major Las Vegas establishments in 2023 but also because of a spree of telephone frauds aimed at smaller casinos across the United States.

In these incidents, casino employees were duped by individuals posing as supervisors or higher management, claiming that an urgent legal issue threatened the closure of the casino due to unpaid licensing fees. To avert the supposed crisis, employees were instructed to collect a significant sum of money and deliver it to a designated individual in the parking lot forthwith.

This scheme, albeit an archaic trick in contemporary guise, proved sufficiently convincing to inflict substantial financial losses on several establishments. Regrettably, in many of these cases, the deceived employee was subsequently apprehended under suspicion of collusion with the fraudsters.

Exposing the High Stakes Deception of Casino Scams

What took me aback was not merely the feasibility of such a scam but its success on at least six documented occasions—and considering the reluctance of casinos to disclose such deception, it's plausible that the actual number of cases is significantly higher.

Astonishingly, one presenter estimated that the scam had been attempted over a thousand times, achieving success only in a few instances. However, this highlights the imperative for the industry to consistently exchange information about emerging threats. It begs the question: after - let's say - five hundred attempts, shouldn't every individual working in sensitive areas like cash rooms or cages be well-informed about potential scams?

Yet, an overarching reluctance to acknowledge deception, coupled with a pervasive casino ethos that abhors the appearance of vulnerability, has furnished scammers with countless opportunities to replicate this scam, ultimately defrauding establishments of millions of dollars.

This uncovers a fundamental weakness within the casino industry: hubris. It's unrealistic for anyone in any sector to grasp the full array of deceptive tactics. Yet, I've repeatedly encountered resistance from casino managers and security personnel, asserting they don't require insights from me—or anyone with my expertise—on safeguarding their operations.

This stance is evidently flawed, as casinos continue to fall prey to both novel and time-worn schemes, whereas a true expert in deception, lacking any vested interest or background in gaming operations or corporate protocols, might readily identify vulnerabilities that insiders overlook.

Road from Vulnerability to Vigilance

During my onstage interview with Willy Allison, I emphasized the importance for corporations to scrutinize their own vulnerabilities and immerse themselves in the world of cons and scams. This, I argued, would not only enhance their understanding of their own weaknesses but also equip their staff with the ability to detect scam indicators, especially those working on the front lines of the casino industry. Predictably, the initial question from conference attendees echoed a common concern: "How do we ensure you won't identify a vulnerability and exploit it against us?"

While sharing the stage with my host, Willy Allison, I offered a nuanced and diplomatic answer, underscoring the significance of considering counsel from various sources and balancing such advice against potential risks.

However, in hindsight, I wished for a more forthright response if establishments like Crockfords or the Hacienda had sought the insight of a twelve-year-old amateur magician armed with just a basic book on card tricks, such a novice might have immediately noticed when players were exploiting one-way card designs to win at baccarat—a flaw that cost 'industry insiders' millions before they recognized a tactic I would have found blatantly apparent. As I quipped later, if you can't consult Hannibal Lecter without him eating your face, perhaps a career in the FBI isn't for you!

After this interview, I was surprised to meet several people from a wide range of properties interested in talking further about protection through better education, and my conversations with Willy and Jo revealed that the industry is indeed making concerted efforts to shield itself and its patrons by increasingly welcoming new perspectives and strategies for defense. This cultural shift is evident in the audience at the WGPC, which has grown significantly since my last appearance, as well as in the diversity of attendees.

The event now attracts not only security managers and floor supervisors but also senior executives and decision-makers who possess the authority and incentive to implement protective measures for the industry's future.