Zodiac

I build predictive models for iGaming platforms — the machine learning systems that sit underneath the surface of every player session, continuously generating risk scores, lifetime value estimates, churn probabilities, and fraud flags from raw behavioural data. The data science layer in a modern online casino is doing triple duty simultaneously: the same feature pipeline that detects fraudulent multi-accounting also scores responsible gambling risk, and the same clickstream data that powers personalised game recommendations also feeds the anomaly detection model watching for bot-like play patterns. There is no clean separation between these functions. A player's session length, bet volatility, deposit timing, device fingerprint, game type preference, and response to previous promotions are all ingredients in the same feature set, consumed by models with very different output labels but overlapping inputs. At Zodiac, the data science infrastructure is built on this reality — a unified behavioural data layer that powers fair play detection, player protection, and personalisation from a single source of truth. This page explains how those models work and what they mean for Kiwi players, no worries.

How does player lifetime value actually distribute — and what does a Monte Carlo simulation of NZ player trajectories look like?

Lifetime value modelling is the foundational data science problem in iGaming. The question every operator needs to answer is: given what I know about a player's behaviour in the first seven days, what is the distribution of possible long-term value outcomes? The answer is not a single number — it is a probability distribution. A player who deposits NZ$50 on day one and spins high-volatility pokies for ninety minutes could, with equal plausibility, churn after three sessions or become a monthly active player for two years. The shape of the LTV distribution is extremely right-skewed in iGaming: most players cluster at low value, a small tail of players contributes disproportionately to platform revenue, and the inflection point between those segments is often not visible until around the thirty-day mark. Understanding this distribution is what separates a data-driven retention programme from a generic one. Monte Carlo simulation runs thousands of possible trajectory paths for a cohort of new players, drawing from historical session data, to show the realistic range of outcomes. The simulation below uses Zodiac's NZ player cohort data. For definitions, see the casino glossary.

What the simulation makes immediately clear is that the distribution is not Gaussian — it is not a bell curve centred on the expected value. The red early-churn lines that flatten near zero by day ten represent roughly forty to fifty percent of new players on most NZ-facing platforms. These players deposit once or twice, find the experience does not match what they were looking for, and do not return. Their LTV is close to zero or marginally positive. The teal lines that diverge sharply upward represent perhaps five to eight percent of the cohort, yet those players generate a disproportionate share of long-run revenue. A data science team that fails to identify them early — by day seven or day fourteen at the latest — is leaving significant retention opportunity unrealised.

The two yellow vertical markers are the two most important checkpoints in our NZ player LTV model. Day seven is the early churn signal window: if a player has not completed a second session by day seven, the probability of month-one retention drops by approximately sixty percent in our cohort data. At this point, the model triggers a targeted re-engagement nudge — a personalised game recommendation based on the specific pokie category or live table type they spent most time with in session one, delivered via email or in-app notification. Day thirty is the segment lock point: by day thirty, behavioural features have stabilised enough for the model to confidently assign a player to one of five LTV segments (micro, low, mid, high, and premium), and the retention strategy diverges by segment from that point forward. This is the architecture behind the personalisation you experience as a Kiwi player on Zodiac — not guesswork, but a statistical model calibrated to NZ cohort data.

Which fraud signals have the strongest correlation — and how does the detection system combine them?

Fraud detection in iGaming is a correlation problem before it is a classification problem. A single signal in isolation is almost always insufficient to confidently flag a fraudulent account — an unusual deposit amount might be a high-roller's first session; a new device might be a player using their work laptop. The analytical power comes from combining signals that, individually, look benign, but jointly exceed a decision threshold. The six fraud signal types we track most closely are: deposit velocity (how quickly NZ$ deposits are accumulating relative to cohort baseline), account age versus activity level (new accounts with behaviour typical of experienced players), device fingerprint consistency (shared hardware or browser signatures across multiple accounts), game selection entropy (unusually low variety suggesting a specific exploitation target rather than genuine entertainment), bonus claim rate relative to wagering contribution (claiming aggressively but fulfilling wagering minimally), and IP geolocation consistency (frequent changes suggesting VPN or proxy use). The heatmap below shows the pairwise correlation between these six signals across Zodiac's fraud detection dataset — the cells with the deepest colour are the combinations that, when co-occurring, have the highest predictive power for confirmed fraud.

The two starred cells — Account Age/Activity paired with Device Fingerprint (0.78), and Game Selection Entropy paired with Bonus Claim Rate versus Wagering (0.72) — are the two most operationally valuable correlations in the dataset. What the 0.78 correlation tells us is that when we see a suspicious new account with behaviour inconsistent with its stated age (e.g., a brand-new registration playing immediately with high stakes, no exploration phase, perfect knowledge of how bonus wagering works), that account almost always also shares a device fingerprint with another flagged account. These are not independent anomalies — they are the signature of organised multi-accounting, where the same physical device is used to create and operate multiple accounts with different identities. Catching one signal is useful; catching both simultaneously with high correlation raises the model's confidence to a level that justifies automated account restriction pending human review.

The 0.72 correlation between game selection entropy and bonus claim rate tells a different story — this is the signature of bonus abuse, where a player creates an account specifically to claim a welcome offer and then plays only the specific pokie title with the most favourable wagering contribution rate to clear the requirements as fast as possible. Legitimate players browse. They try different games. Their session entropy is high. Bonus abusers have low entropy — they know exactly which game they want and play it immediately upon claiming, with minimal exploration. When this low-entropy pattern combines with an aggressive bonus claim rate, the model flags the account within the first session. The player never experiences visible friction — they simply do not receive future promotional offers, and their account is queued for enhanced review before any withdrawal is processed.

Which fraud types does the detection system catch — and which detection layer stops each one?

Not all fraud is the same, and not all detection methods catch the same fraud types. The iGaming fraud landscape for NZ-facing operators spans six distinct typologies, each requiring a different combination of detection layers to catch reliably. Bonus abuse is the highest-volume fraud type by transaction count — it is operationally simple to attempt and, without a well-tuned model, costly at scale. Multi-accounting is lower volume but higher value per incident, as organised rings use coordinated account networks to extract promotional value systematically. Bot play is the most technically sophisticated fraud type and the one that evolves fastest, as bot developers update their automation to evade detection in a continuous arms race. Chip dumping (deliberately losing to a co-conspiring account to transfer value) is primarily a poker and live game concern. Money laundering structuring — using casino accounts to cycle funds through gambling transactions — is an AML concern with DIA reporting implications under the incoming NZ regulatory framework. Card fraud covers stolen payment method use and chargeback abuse. The matrix below maps which detection layer is primarily responsible for catching each fraud type at Zodiac.

The matrix makes one structural point very clearly: no single detection layer catches all fraud types, and no fraud type is caught by a single layer alone. Money laundering structuring is the most complex case — it requires both velocity checking (to catch sub-threshold deposit-withdrawal splitting) and manual review with DIA reporting capability, because the downstream obligation under New Zealand's AML framework means that automated detection alone is insufficient when a suspicious activity report is required. Card fraud, by contrast, is predominantly caught at the rules engine and device fingerprint layers, where BIN checks and billing address mismatches provide strong pre-session signals before gameplay even begins.

Bot play is the fraud type that evolves fastest over time, because it is the one where the adversary actively adapts to the detection model. Modern poker bots and automated slot spinners have become sophisticated enough to introduce deliberate timing randomness to evade simple speed-threshold rules. This is why the ML model is the primary detection layer for bots — rules engines are inherently static, but a machine learning model retrained on fresh behavioural data from confirmed bot accounts continuously updates its feature weights to reflect how bots have adapted. The model learns what current bots look like, not just what historical bots looked like. At Zodiac, the fraud detection model is retrained on a rolling basis using confirmed fraud labels from the manual review queue, keeping the detection surface current. For legitimate players, this infrastructure is entirely invisible — it simply means the games you play against are fair, the bonuses you claim are available to genuine players, and the platform you deposit into is protecting your funds from fraudulent interference. That is the purpose of the system, no worries. 18+ · Gambling Helpline 0800 654 655 · Register at Zodiac.