Gaming Machine Seems to Be Controlled Externally Signs and What to Check First
The first sign of external control is usually subtle: a machine that pays out at odd times, a credit counter that jumps without a coin being inserted, or a pattern of wins that correlates with a specific player being present. These signs are easy to dismiss as coincidence or normal variance. But when three or four signs appear together, the probability of coincidence becomes very low. The investigation starts with a systematic check of the external control pathways. This article outlines the signs and the check-first protocol that identifies external control before you spend money on unnecessary mainboard replacements.
Sign 1: Wins Correlated with a Specific Player or Time
The strongest sign is correlation: the machine wins for Player A but not for Player B, and the pattern holds across multiple visits. The correlation is not proof — some players are genuinely skilled — but it is a flag that warrants investigation. Record the player identity (appearance, approximate age, whether they use a player card), the machine number, the time of day, and the win amount. Do this for 5 visits. If the correlation holds across all 5, the probability of a skill-based explanation is low. Proceed to the technical checks.
The time correlation is more suspicious than the player correlation: the machine wins every day at 2:00 PM, or every time a specific staff member is on shift. Time correlation suggests external control via a timer or a scheduled signal. The technical check for time correlation is to review the machine event log (if available) or the revenue report by hour. A spike in payouts at the same time every day is abnormal. The spike may be from a legitimate promotion (happy hour), but if no promotion is scheduled, investigate external control. The time correlation is easier to verify than the player correlation because it does not depend on identifying a specific person.
Sign 2: Credit or Payout Counter Jumps Without Input
The counter jump is the most direct evidence of external control. The machine registers a credit or payout that no player input could have caused. The jump appears in the audit log as an entry with no corresponding button press, coin insertion, or bill acceptance. The audit log is the first place to check. Access the log through the operator menu. Look for entries labeled “Credit Added — Source Unknown” or “Payout Triggered — No Winning Combination.” The entries are rare in normal operation. If you find more than one in a week, the machine is being controlled externally.
The counter jump may also appear as a discrepancy between the physical coin hopper count and the machine-reported payout count. The hopper count is the number of coins physically paid out. The machine report is the number the machine claims to have paid out. A difference of more than 2 percent indicates that the machine is reporting payouts that did not happen (or missing payouts that did happen). The difference may be from a hopper malfunction, but it may also be from external control that manipulates the report without affecting the hopper. The hopper comparison is a simple check that requires no technical skill. Count the coins in the hopper or weigh them. Compare to the report. The discrepancy reveals the manipulation.
Sign 3: Machine Responds to a Remote Signal (RF or IR)
Some external control methods use RF or infrared signals. The signal triggers a relay on the machine that activates a function — adding credits, triggering a payout, or changing the game outcome. The signal is invisible, but the machine behavior is not: the machine responds in the exact moment the signal is received. The test: stand near the machine with a radio or a smartphone set to speaker mode. Listen for a clicking or buzzing sound that coincides with the machine behavior. The clicking is the RF signal being demodulated by the radio or smartphone audio circuit. The sound is not proof, but it is a strong indicator. The next step is to use an RF detector (a small device that lights up or beeps when it detects RF energy). The detector costs approximately 20 dollars online. Sweep the area around the machine while the suspicious behavior is occurring. If the detector lights up, the machine is receiving an RF signal.
The infrared method is less common but still used. The attacker points an infrared transmitter at the machine IR receiver (used for remote control or wireless communication). The receiver is usually a small black dome on the machine cabinet. The check: cover the IR receiver with a piece of black tape. Observe whether the suspicious behavior stops. If it does, the machine was being controlled via infrared. The tape is a temporary measure. The permanent fix is to relocate the machine away from windows or doors where an external IR signal can reach it, or to install an IR-blocking cover over the receiver. The cover allows the manufacturer IR remote to work (it uses a different frequency or code) but blocks generic IR signals.
The First-Check Protocol: 5 Steps Before You Replace Anything
Step 1: Review the audit log for unexplained entries. Step 2: Compare the hopper count to the machine report. Step 3: Check for time or player correlation. Step 4: Use an RF detector around the machine during suspicious behavior. Step 5: Cover the IR receiver and observe. The five steps take approximately 2 hours for 10 machines. The steps cost nothing. They reveal external control if it exists. If all five steps show no evidence, the problem is likely internal (a machine fault or a programming error). The external control investigation stops here. The internal investigation begins (check the mainboard, the power supply, the wiring). But if any of the five steps shows evidence, the machine is being controlled externally. Proceed to install a bus monitor. The bus monitor will detect and block the external signals. The bus monitor is the final confirmation and the protection.
Advanced Check: Using a Spectrum Analyzer to Confirm External Control
A spectrum analyzer is a professional tool that visualizes RF signals across a frequency range. Unlike a simple RF detector that only beeps, a spectrum analyzer shows the exact frequency and signal strength. This distinction matters because different attack devices operate at different frequencies. The analyzer helps you identify not just whether a signal exists, but what kind of device is being used. Rent a spectrum analyzer from an electronics supplier (approximately 80 dollars per day). Sweep the 20 MHz to 2.4 GHz range around the machine during suspicious behavior. If you see a spike at a specific frequency, you have confirmed external control and identified the attack frequency. Share this data with the bus monitor manufacturer so they can tune the monitor to specifically block that frequency, improving protection effectiveness for your venue.
Frequently Asked Questions
The audit log shows no unexplained entries, but I still suspect external control. What else can I check? Check the machine event log (a separate log from the audit log, usually accessible through the technician menu). The event log records all bus activity, including signals that the audit log filters out. The event log may show repeated commands from an unknown source. Also check the revenue report by hour of day. An unusual spike at a specific hour suggests scheduled external control. Check the CCTV footage for the times of suspicious behavior. Look for anyone pointing a device at the machine or loitering near the machine. The CCTV review may reveal the attacker. If all these checks are negative, the suspicion may be unfounded. Consider hiring a technician to perform a full diagnostic.
Can external control happen through the power line instead of RF or IR? Yes. Power line communication (PLC) is a method of sending signals through the electrical wiring. The attacker plugs a transmitter into a power outlet in the same circuit as the machine. The signal travels through the wiring to the machine power supply and couples onto the machine internal bus. The check: plug the machine into a different circuit (if possible) or use a power line filter (a device that blocks high-frequency signals on the power line). The filter costs approximately 30 dollars. Install it between the machine and the wall outlet. If the suspicious behavior stops, the control was through the power line. This method is less common than RF or IR but should be considered if other checks are negative.
I found evidence of external control. What should I do immediately? First, disconnect the machine from the network (if it is connected) to prevent remote access. Second, install a bus monitor on the machine immediately. The bus monitor will detect and block further attempts. Third, review the CCTV footage to identify the attacker. Fourth, change the machine locks and the cabinet access codes. Fifth, notify the police if the financial loss is significant (above the local threshold for theft). The immediate actions protect the machine from further loss while the investigation continues. Do not confront the attacker yourself. The attacker may be armed or may have accomplices. Let the police handle the confrontation. Your role is to gather evidence and protect the machine.