Machine Always Losing to Certain Players? Here's What's Really Happening
It starts as an observation: “Every time that player sits down, the machine pays out. They always win, and we always lose.” Staff notice it. Other players notice it. The machine “likes” this player, or the player is “lucky.” Neither of those explanations is true. When a machine consistently loses to certain players, the player is controlling the outcome — through electronic cheating, exploitation of a machine defect, or insider collusion. This guide explains what is really happening and what to do about it.
The Three Real Explanations
Scientific thinking requires eliminating impossible explanations before accepting possible ones. The impossible explanations are: the player is genuinely lucky (probability makes it impossible to win consistently over hundreds of sessions), the machine “likes” the player (machines do not have preferences), and the machine is defective but only when this player uses it (if the machine were defective, it would behave badly for everyone).
The real explanations are:
Explanation 1: Electronic control (70% probability). The player carries a concealed wireless transmitter. The transmitter injects signals into the machine’s communication bus that: add credits, trigger specific game outcomes, trigger payouts, or modify game state. The player appears to be playing normally — inserting money, pressing buttons — but the money is irrelevant (they add credits through the transmitter) and the button presses are irrelevant (the outcome was already determined by the transmitter). The player’s actions are theater to avoid detection.
Explanation 2: Machine exploitation (20% probability). The player has discovered a software bug, a configuration exploit, or a physical manipulation technique that only works on this specific machine. They know: a specific button sequence that always triggers a bonus, a timing window where the bill validator can be tricked into double-counting, a specific way to interact with the touchscreen that triggers an unintended function, or a hardware quirk (loose connector, worn sensor) that can be manipulated reliably.
Explanation 3: Insider collusion (10% probability). A staff member is helping this player. The help includes: changing the hold percentage to favor the player, providing the configuration PIN so the player can change settings themselves, disabling the bus monitoring device on this player’s machine, telling the player which machines have loose components or exploitable defects, and warning the player when the owner or manager is approaching.
How to Investigate
When you notice that a specific player always wins, do this within 48 hours:
Step 1: Pull the player’s data. If your machine records per-player data, extract: session dates and times, session durations, credits in vs credits out per session, and win rate per session. If you do not have player-level data, reconstruct from: staff observations (which days/times did the player visit), camera footage (how long did they play each session), and machine-level data (total credits in/out for the periods when the player was present).
Step 2: Calculate the player’s return rate. Return rate = (total credits won) / (total credits played) × 100%. A return rate above 80% over 10+ sessions is effectively impossible by chance on an 80% hold machine (expected return rate: 20%). A return rate above 100% means the player is consistently profiting — every session is a winning session. Nobody is that lucky over dozens of sessions.
Step 3: Check the bus monitor logs. If the machine has a bus monitor, check the log for blocked attacks during the player’s sessions. Correlation between the player’s presence and blocked attacks strongly suggests electronic control (Explanation 1).
Step 4: Observe the player (covertly). Have a staff member (or yourself, if the player does not know you) observe the player. Look for: a phone or small device held in an unusual position (near the machine cabinet, not in normal phone-holding posture), button presses that do not correspond to game events (pressing before the prompt appears, pressing after the result is already shown), and the player consistently choosing the same machine (even when other machines are available, even when that machine was just occupied by someone else).
Step 5: Test the machine without the player. After the player leaves, play the machine yourself (or have a staff member play). Does the machine behave normally? If yes, the player is likely causing the abnormal behavior. If the machine behaves abnormally for you too, the problem is the machine (hardware or configuration), not the player.
What to Do Based on Investigation Results
If the evidence points to electronic control (Explanation 1): Install a bus monitoring device on this machine (and all machines — the player will just move to an unprotected machine). The device blocks the player’s transmitter. The next time the player visits, their transmitter does not work. They try different frequencies, different positions — nothing works. They leave. Monitor: the machine no longer “always loses to this player” because the player stops coming (their method no longer works here).
If the evidence points to machine exploitation (Explanation 2): Watch the player closely to identify the exploit. Once identified: fix the bug (firmware update), close the configuration loophole, or repair the hardware defect that enables the exploit. If you cannot identify the exploit: the player “stops winning” on this machine once bus monitors are installed (even if the exploit is not signal-based, the player assumes the venue has increased security and may move on).
If the evidence points to insider collusion (Explanation 3): Do not confront the player or the staff member immediately. Gather more evidence: configuration change log (check for changes during the staff member’s shift), camera footage (staff member interacting unusually with the player), and bus monitor logs (device disconnection during staff member’s shift). When confident, confront the staff member privately with the evidence. Terminate if confirmed. The player loses their insider access and cannot continue winning.
Prevention: Stop It Before It Starts
The best way to prevent this problem is to never let it develop:
- Bus monitors on all machines from day one. Electronic control never works. The player never gets the impression that “this machine is easy.”
- Regular firmware updates. Exploitation bugs are fixed before players discover them.
- Configuration baseline + quarterly audit. Unauthorized configuration changes are detected within 3 months.
- Two-person rule for configuration changes. Single staff member cannot secretly change settings for a player.
- Per-player win rate tracking. Any player with an abnormal win rate is flagged and investigated before the losses accumulate.
Our guide includes a suspicious player investigation form.
Common Questions
What if I have no evidence but I am certain the player is cheating?
You do not need evidence to deploy protection. Install bus monitors on all machines. If the player is cheating electronically, their equipment stops working and they leave. If the player is not cheating (genuinely lucky), the bus monitors have no effect on them and they continue playing normally. Either way, you win — the cheating stops if it was cheating, and you have protection for future even if it was luck.
Should I ban the player?
Banning a player without evidence can lead to: the player complaining publicly (bad reviews), the player escalating (legal threats), and the player just going to another unprotected venue (the problem moves, not solved). Instead, deploy bus monitors. The player’s cheating stops. They leave voluntarily. No confrontation, no complaints, no drama.
What if the player is a regular customer who spends a lot of money?
A player who spends money but wins more than they spend is not a customer — they are a liability. They cost you money every session, not make you money. Do not hesitate to stop their cheating because they “spend money.” Their net effect on your revenue is negative. A player who plays $100 and wins $300 costs you $200. A player who plays $20 and loses $20 earns you $20. The spending amount is irrelevant — only the net effect matters.
Your Machine Is Not Lucky. It Is Exploited.
The machine does not “lose to certain players.” Certain players make the machine lose — through electronic control, exploitation, or collusion. Identify which explanation applies. Deploy bus monitors. Close the exploitation gaps. Eliminate the collusion. The player will stop winning. The machine will stop losing. The laws of probability will operate as designed.