QuintAce has released an open-source system designed to help online poker operators identify accounts that may have access to opponents’ hole cards. The tool combines population-level data analysis with human review, aiming to flag suspicious decisions without treating an unusual hand or short-term winning streak as proof of cheating.
The system analyses a player’s decisions against possible holdings, known cards and a predicted range derived from past play. It is designed to automate work that has previously depended on players manually reviewing hundreds of hands for unusual patterns, as in the 2019 “Postlegate” scandal and the UltimateBet case.
John Andress, Head of Game Integrity at AceGuardian, said the system compares decisions with population behaviour. “A player who can see your cards makes decisions an honest player can't. We measure that against the population, decision by decision,” he said. Andress added that it had been tested on past incidents and was already running in production on some platforms.
From screening to expert review
The process begins by identifying unusual win rates and playing styles over configurable periods. Accounts can be grouped to help detect connections between them. The system then assesses behavioural indicators, including “oracle folds” — folds that would make sense mainly if a player knew specific hole cards — and low-equity bets or bluff-catching results that stand out from the population.
It also evaluates individual decisions against an opponent’s cards on each street. Flagged hands receive a risk score from 0 to 100 based on decision type, hand strength, pot size and decision time. Analysts review the resulting player scores and ranked hands before any final determination.
Andress said players are elevated for review when they sit at the extremes across several signals, rather than on a single measure. He described the output as a scorecard for each player and a ranked list of hands for security teams. “We always want a human in the loop to make the final decision,” he said.
Testing the system on a recent case
QuintAce used accounts linked to “Paul Gregg” to demonstrate the approach with a sample of about 700 hands. In that sample, the account’s win rate was in the 81st percentile, which Andress described as a normal heater. However, its detection metrics were outliers in six of seven categories, ranking in the top 1% in six and the 5th percentile in the remaining category. Andress also pointed to strong hands folded in two seconds or less.
Two examples were classified as oracle folds. In one, the player folded top pair on the turn to a bet of 75% of the pot after four seconds; the opponent’s gutshot, completed on the turn, represented 2.5% of their range. In another, the player almost immediately folded two pair on the river to a completed backdoor straight, which represented 0.2% of their range.
QuintAce also advises players to check for remote-management software they did not install, particularly Windows services such as MeshCentral’s MeshAgent, and poker tools that update from unrecognised sources.
Andress said operators’ reluctance to share information had allowed an attacker to move between sites. “Players lost a lot of money, operators lost trust, and the signals were in their hands the whole time,” he said.
