Frogo Sells Dynamic Thresholds to Lean Casino Risk Desks

Six days after Frogo published a case about $26 million in potential slot-exploit losses, operations chief Kostiantyn Kryvka told operators to stop treating fraud prevention as a tax.

He was speaking for the RedCore-owned platform on April 30, 2026. The people his pitch actually serves sit below the COO: a small investigations desk, the high-value player stuck in a static review, and the acquirer that can freeze a casino’s cards.

Kryvka Treats Fraud Prevention as a Growth Budget

Kryvka, head of operations at Frogo, pushed back on the cost-center framing in that interview and refused to call an anti-fraud tool a tax on doing business.

It’s much more of an investment. It’s a solution that brings value from the implementation stage and shows a positive ROI within the first month.

Kostiantyn Kryvka, Head of Operations, Frogo

When the setup is right, he said, the same stack segments the audience, lifts retention, and keeps funds that would otherwise be stolen. He did not argue for cutting the risk team. He argued for moving people off repetitive checks and onto work such as new-market research and loyalty analysis, because a cleaner operation is supposed to grow, not shrink.

That is the vendor line. The operational fact underneath it is simpler: manual review does not scale with a traffic spike, and a COO who still buys fraud work as budget burn will keep buying static rules that stall good players while farms walk around the number.

The €500 Rule Fraud Rings Already Knew

Kryvka’s working example is blunt. A static rule that says €500 is the line for a manual check is easy to write and easy to game, because a group moving funds through dozens of €400 tickets never trips it. A dynamic rule watches a user’s own baseline over a window and fires on a spike in count or volume instead of on a round number every farm already memorized.

The same logic runs in reverse for a genuine high-volume player, whose usual activity above €500 does not have to wait in a queue built for strangers. Kryvka said static rules will not disappear entirely, but relying on them alone is an outdated strategy with too many gaps, and Frogo’s product mixes both.

The daily change for an operations team, on his telling, is fewer false alarms and more time on cases that are actually strange. The conversion change is the one operators feel in deposits, because the VIP stops being treated like a suspect because a round number said so.

One Click Through a Fraud Farm

Investigating a case, Kryvka said, still means device IDs, IP addresses, card hashes, and linked accounts, and the old path is a table plus dozens of repeat searches to assemble a network. That work is slow, and a tiny miss in a large set leaves a farm standing. Frogo’s graph view is sold as the opposite: one click that shows how users, cards, and devices connect, plus the last action taken on a profile so a reviewer does not forget to block the rest of the cluster.

Payment-fraud graphs outside casinos typically link accounts, devices, and payment instruments into one map an analyst can walk, then score a new event by how close it sits to known bad nodes. The casino version of that map is what lets a small team do the work of a much larger department, which is Kryvka’s operating-cost claim.

WHAT THE GRAPH IS SUPPOSED TO JOIN

• Device IDs: Hardware that repeats across accounts which look unrelated in a table.
• IP addresses: A shared network origin sitting under new registrations.
• Card hashes: The same payment instrument reused under fresh user names.
• Last action: The prior step on a profile, so the rest of the farm can be blocked in one pass.

“We never leave a partner alone with a complex tool,” Kryvka said, describing onboarding, explainable triggers, real-time support, and regular catch-up sessions to retune policies. Ready-made rules cover common business events, and the AI layer is there to catch small shifts in behavior, but he called it a repeating process of adaptation rather than a box a COO can ignore.

The Slot Glitch That Put $26 Million in Play

On April 24, 2026, Frogo published a case study on a slot-provider exploit in which players were winning on every third spin. A client running 100,000-plus unique users a day and 98% automated cashouts, the company said, faced $26 million in potential losses if the payout engine kept treating the activity as normal play.

SIGNALS FROGO SAYS FIRED

• RTP and GGR: Spikes that did not match an ordinary session mix.
• Win shape: Single-win anomalies and an unnatural drop in losing rounds on the same slots.
• Cashout cycle: Deposit, minimum play, then withdrawal inside 30 minutes.
• Clusters: Multi-accounting on shared devices, payment methods, and IPs, plus new sign-ups for the broken games.

Device fingerprinting, a risk-scoring engine, and graph analysis are what Frogo says connected those rings. Some operators without a comparable stack lost millions, the case study said, and others halted payouts, which is its own churn event.

FROGO’S PUBLISHED EXPLOIT FIGURES

The company published a case study claiming 96% of potential losses prevented, with legitimate players cashing out as usual. The operator and the slot provider are not named, and no independent audit of those figures has been published.

PIN-UP Global’s Fraud Desk Went to Market

Frogo is not a generic software shop that wandered into casinos. It sat inside PIN-UP Global, an iGaming holding, and went on sale as a B2B platform at ICE Barcelona in January 2025. In August 2025 the holding became RedCore, a Cyprus-based group that still lists a large affiliate business beside the fraud brand.

Frogo chief executive Volodymyr Todurov is also RedCore’s chief analytics officer, and he has described the product as one that started with the group’s own iGaming needs. Marina Ilina is CEO and founder of RedCore. She has framed the group as a move from internal tools to products other digital businesses can buy, after years inside gambling.

RedCore’s own account of the November 3, 2025 SiGMA ceremony in Rome lists seven independent brands including Frogo: PIN-UP Partners, Pay.Partners, Communications Hub, mr.Booster, Riddick’s Partners, and Talk with Us. PIN-UP Partners is still sold as an affiliate program and direct advertiser. The same group that buys and sells casino traffic is the group selling the tool that is supposed to catch fake affiliate traffic and multi-accounting.

FROM INTERNAL TOOL TO B2B BRAND

1. January 2025: Frogo launches at ICE Barcelona as a B2B anti-fraud platform.
2. August 2025: PIN-UP Global becomes the RedCore business group, with a head office in Cyprus.
3. November 3, 2025: RedCore receives the Transformation of the Year award at SiGMA in Rome.
4. April 24, 2026: Frogo publishes the $26 million slot-exploit case study.
5. April 30, 2026: Kryvka gives the converting-losses interview.

When Kryvka talks about experience in the complex world of iGaming, this is the corporate history behind the sentence. The desk was trained on bonus abuse, multi-accounting, and affiliate noise before the login was sold to someone else.

Visa Tightened the Merchant Line to 1.5%

The interview landed 29 days after Visa lowered the merchant excessive line under its Acquirer Monitoring Program. Checkout.com lists a 1.5% merchant excessive threshold from April 1, 2026, for markets outside MENA, with a floor of 1,500 combined fraud reports and disputes in a month. Acquirers sit on a tighter clock: 0.5% is already above standard, and 0.7% is excessive.

VAMP LINES NOW IN FORCE

A casino can win the fraud war in its own back office and still lose card processing if those ratios blow out. Dynamic thresholds and fewer false declines are how an operator tries to grow deposits without handing the acquirer a spike. That pressure does not appear in Kryvka’s COO-facing language, and it is the quiet customer for any tool that claims to convert losses into profit.

Noisy Queues Teach Reviewers to Click Approve

Identity vendor Sumsub’s June 25, 2026 iGaming Fraud Report, based on more than 3 million observed fraud attempts, found that suspicious transaction volumes rose 4.5x from Q1 2025 to Q1 2026, while the average suspicious transaction rose to $6,500 (€6,002) from $3,960. The global fraud rate on verification attempts hit 1.53% in Q1 2026, up 18% year on year and, Sumsub said, nearly 40% since the 1.10% rate in 2024.

The global average hides a 5.8x spread between Africa at 2.54% and North America at 0.44%. Europe sat at 1.14%, with 41% of detected fraud involving deepfakes, the highest share Sumsub recorded in any region. Fraudsters now take 4.6 times as long as legitimate players to finish a verification attempt.

Right now, the industry is seeing a huge amount of AI-generated or AI-assisted fraud content. An ‘industry-wide DDoS attack of AI-slop’, if we’re willing to put it into stronger terms.

Kris Galloway, iGaming Product Evangelist, Sumsub

A noisy queue does more than delay a good deposit. It trains reviewers to override the next alert, after which the casino is worse off than it was with a dumb €500 rule it at least understood. Kryvka’s answer to that failure mode is a smaller queue and a graph a three-person desk can actually finish, plus a vendor that still gets on the call.

Sumsub recorded that 4.5x jump two months after the Frogo interview. The people who have to open the graph are the same people a false-positive queue trains to click through.