How Winamax detects automation
In one line: Winamax does not look for one “bot signature.” It builds a behavioural profile of every account, scores how far each session drifts from human norms, then correlates accounts and reviews the strongest cases by hand before acting.
Modern anti-bot security is statistical, not a single trip-wire. The myth that “humanised” mouse movement defeats it misunderstands the model: it is not one check you can pass, it is a continuously updated picture that gets sharper the longer you play.
The four stages
Collect the signals
The client and server log far more than the cards: cursor trajectories and acceleration, the exact millisecond gap between a board change and your action, where inside a button you click, window focus, and how your table schedule looks over days. A bot is consistent in ways humans never are — and consistency is the signal.
Model the behaviour
Each account gets a behavioural baseline; sessions are scored against that baseline and against the wider population. The output is an anomaly score, not a yes/no. “Too steady,” “too fast across all spots,” or “identical timing regardless of decision difficulty” push the score up.
Correlate accounts
One suspicious account is a lead; a cluster is a case. Detection links accounts by shared device fingerprints, payment instruments, IP and timing patterns. A bot farm is far easier to catch as a network than any single account is in isolation.
Reach a verdict
High-score cases go to human review and hand-history analysis before enforcement, which is why action can feel delayed — the platform is building a case it can defend, not reacting to a single hand. The end states are limitation, freeze, or seizure plus permanent ban.
What does not save a bot
- Randomised delays. Add jitter and the distribution still looks unlike a human’s across thousands of hands.
- “Human-like” mouse curves. They help against the crudest checks and lose to population-level statistics.
- A fresh account. The account graph links it to the device and funding behind it.
- Low stakes. Volume across many tables is itself a flag, not camouflage.
A question about account security?
We document how bots and detection actually work. For a specific question on compliance or account safety, reach the team.