Top Ball Machine Anti-Cheat System — Detecting Score Anomalies in Gaming Centers
A gaming center operator in São Paulo reached out to me in January with data that didn’t add up. His venue had four Top Ball machines—the type where players launch physical balls onto a spinning wheel with numbered scoring zones—positioned near the entrance as attract-mode revenue generators. These machines had been steady performers for two years, each bringing in roughly R$380-450 per day in a mid-traffic shopping center location. Then, over a three-week period in December, one machine started posting daily scores that were consistently 60-70% higher than its neighbors. Same player traffic. Same number of balls dispensed per credit. Same wheel speed. But the score totals were radically different. The machine was awarding enough tickets to buy premium redemption prizes—Bluetooth speakers, branded backpacks, the high-value items that cost the venue real margin. The prize counter was losing money on every play from this machine, and the operator couldn’t figure out why.
When I examined the machine’s sensor logs remotely (the operator connected a laptop to the diagnostic port while we were on a video call), the cause was immediately visible. The machine’s primary ball-detection sensor—an infrared break-beam array that counted which scoring zone each ball passed through—was being fooled. Someone had discovered that inserting a thin reflective strip through the ball-return slot at a precise angle could trigger specific sensor elements in the high-score zone array, generating a score signal without a ball ever passing through. The exploit was elegant in its simplicity: a piece of aluminized mylar, cut from a snack wrapper, positioned at 45 degrees relative to the sensor plane. It reflected the IR emitter back into the detector and registered as a “ball in zone 100” event. The machine logged it as legitimate because, from the sensor’s perspective, the signal pattern was identical to a ball passing through. This is the challenge with electromechanical scoring games like Top Ball: the sensors can’t distinguish between a real ball and a carefully calibrated fake signal. And across Latin America, operators are discovering that these machines—often treated as simple, robust, “unhackable” mechanical games—have a surprisingly wide attack surface.
Reading the Signs: When a Top Ball Machine’s Scores Stop Making Sense
Top Ball score manipulation produces a distinctive anomaly pattern that, once you know what you’re looking at, is hard to miss. The key indicator is score distribution that violates the physics of the machine.
In a normally functioning Top Ball machine, the score distribution across zones follows a roughly bell-shaped curve centered around the zones that are physically most accessible from the ball launch position. The highest-score zones—typically the 100-point positions at the extreme edges of the wheel—should account for perhaps 5-8% of all scored balls, because launching a ball accurately enough to hit those narrow targets is genuinely difficult. The mid-range zones (30-60 points) should account for 60-70% of scores. The low zones (10-20 points) account for the remainder as overshoots, undershoots, and deflections off the zone dividers.
When this distribution inverts—when the 100-point zones suddenly account for 25% or more of all ball scores—the physics explanation is impossible. A human player cannot suddenly become that accurate, and the machine’s ball launch mechanism (typically a spring-loaded plunger or a motorized flipper) has a fixed mechanical range. The scores are being generated by something other than balls landing in zones.
Other diagnostic signs: the score-per-ball ratio climbing beyond the machine’s theoretical maximum. If the highest possible single-ball score is 100 points (landing in the 100 zone) and a player’s 10-ball session scores 1,800 points, they’re averaging 180 points per ball on a machine whose maximum is 100. That’s not a skill issue—it’s a sensor issue. Ball-count mismatch between what the machine dispensed (tracked by the ball hopper’s dispense solenoid count) and what the scoring system registered. If the machine dispensed 200 balls in a day but registered 350 scoring events, 150 of those events weren’t real balls. And time-pattern anomalies: scoring events that occur when the ball launch mechanism hasn’t been activated (no solenoid trigger in the preceding two seconds) or that occur in impossibly rapid succession—three 100-point scores within 200 milliseconds, when the physical minimum time between consecutive ball launches from a human player is roughly 1.5 seconds.
Top Ball Sensor Architecture: The Gap Between What the Sensor Sees and What’s Real
Top Ball machines use one of three sensor architectures, and each has different vulnerabilities. Understanding which one your machines use tells you where to look first.
The most common type, found in machines manufactured in China and Taiwan over the past decade, uses an infrared break-beam array. Infrared LEDs are mounted on one side of each scoring zone channel, with phototransistor receivers on the opposite side. When a ball passes through the channel, it briefly interrupts the IR beam, and the receiver’s output drops. The control board interprets this drop as a scoring event and logs the corresponding zone value. The vulnerability here is that anything that interrupts or reflects the IR beam in the right pattern will be counted as a ball—a piece of reflective material, a precisely-aimed external IR source (like a TV remote control with the IR LED exposed), or even a strong flashlight at close range in machines with poorly-shielded sensors.
The second type uses microswitch gates—physical levers at each scoring zone entrance that a ball pushes aside as it enters. These are mechanically more difficult to fool because you need physical access to the switch actuator. But they’re vulnerable to wire tampering: if someone accesses the wiring harness that connects the microswitches to the control board, they can short the switch contacts to ground with a piece of wire, simulating a switch closure. This is harder to do surreptitiously because it requires opening the machine or reaching through the ball-return slot, but I’ve seen it done in venues where the machines are positioned against walls that have access panels on the rear.
The third type, used in higher-end Japanese and Korean machines, uses a camera-based vision system. A small camera mounted above the wheel captures images of the scoring zones and uses simple computer vision to detect ball positions. This is harder to fool with IR or mechanical tricks, but it introduces its own vulnerability: the camera feed can be blocked, redirected, or replaced. I’ve seen cases where an attacker placed a printed image of a ball over the high-score zone on the physical wheel, and the camera, unable to distinguish depth, counted it as a ball present in that zone continuously, generating unlimited score accumulation until the image was discovered.
The São Paulo machine used an IR break-beam array. The reflective mylar strip was positioned to bounce the emitter’s output back into the 100-zone receiver. From the control board’s perspective, this produced exactly the same voltage drop as a ball interruption—the phototransistor’s collector voltage dropped from 5V to roughly 0.2V for approximately 30 milliseconds, which is within the expected pulse width range for a ball (15-50ms depending on ball speed and zone width). The machine had no way to know the signal didn’t come from a physical object passing through the beam.
Detection Through Statistical Profiling and Sensor Validation
Catching Top Ball manipulation requires looking at the data from multiple angles. A single metric can be anomalous for legitimate reasons—a lucky player, a calibration drift, a sensor that needs cleaning. Multiple metrics diverging simultaneously almost always indicates manipulation.
Build a per-machine score distribution profile over a minimum four-week baseline period. Record the percentage of balls landing in each scoring zone, the average points per ball, and the standard deviation of session scores. This becomes your normal operating envelope. When any of these metrics exceeds two standard deviations from the baseline for three consecutive days, investigate. One anomalous day might be a tournament or a skilled group of regulars. Three consecutive anomalous days is a pattern worth investigating.
Implement cross-validation between the ball dispenser counter and the scoring event counter. The ball dispenser has a solenoid that fires once per ball released, and every solenoid activation should correspond to a scoring event within the next three seconds (the time it takes a ball to travel from launcher to wheel to scoring zone). If the dispenser fires 500 times and the scoring system registers 580 events, those extra 80 events came from somewhere other than dispensed balls. This cross-check alone would have caught the São Paulo exploit on day one.
Monitor the inter-event timing of scoring events. A physical ball takes a minimum time to travel from launcher to scoring zone—typically 0.8 to 1.2 seconds depending on launch velocity and wheel distance. Scoring events that occur with inter-event gaps shorter than 500 milliseconds cannot be real ball landings, because the ball hasn’t had time to reach the wheel. An automated sensor-fooling device can generate pulses at microsecond intervals. Flagging sub-500ms inter-event gaps catches both sensor fooling and electronic pulse injection.
For IR-based sensor arrays, install ambient light sensors near each scoring zone receiver. A phototransistor designed to detect IR beam interruption will also respond to visible light at high intensity. If the ambient light level at a scoring zone sensor spikes at the same moment a scoring event is registered—particularly if it happens consistently for high-value zones—someone may be using an external light source to trigger the sensor. This detection layer costs about $2 per zone in additional components and catches optical attacks that the primary sensor can’t distinguish from legitimate balls.
Building a Multi-Layer Defense for Top Ball Machines
Preventing Top Ball score manipulation requires changes at the sensor, signal processing, and monitoring levels. The good news is that most of these measures are additive—you can implement them one at a time, starting with the highest-impact changes, without replacing the entire machine.
The highest-impact single change is adding pulse-width discrimination to the sensor signal processing. A physical ball passing through an IR beam produces a signal dropout with a specific duration range—typically 20-60 milliseconds for the ball diameters used in Top Ball machines (roughly 25-35mm) at normal wheel rotation speeds. A reflective surface or external IR source typically produces either much shorter pulses (under 5ms for a quick flash) or much longer ones (continuous reflection as long as the material is in position). Adding a simple timing circuit or firmware check that rejects scoring pulses outside the 15-80ms window eliminates most optical fooling attacks. This modification requires either a firmware update (if the manufacturer provides one) or an inline signal conditioning board between the sensor array and the control board—roughly $25 in components and two hours of installation labor per machine.
The second layer is physical shielding of the sensor array. The IR emitters and receivers in most Top Ball machines are exposed to the ball channel with minimal shrouding, which allows external light sources and reflective materials to interact with them. Adding narrow-aperture shrouds—small tubes or channels that restrict the sensor’s field of view to only the ball path—dramatically reduces the angle from which an external source can influence the sensor. The shrouds should be matte black on the inside to absorb scattered light. This is a 3D-printable modification: the shroud dimensions are a tube roughly 8mm in diameter and 12mm deep, positioned directly over each sensor element.
The third layer is dual-technology zone confirmation. Use two different sensor technologies for each scoring zone and require both to agree before counting a score. For example, pair the existing IR break-beam with a simple capacitive proximity sensor that detects the dielectric change when a physical ball (as opposed to light or air) passes nearby. Or pair the break-beam with an acoustic sensor—a small microphone that listens for the distinctive sound of a plastic ball hitting the zone divider. A ball physically entering a zone produces a mechanical sound that a reflective mylar strip does not. Cross-referencing optical and acoustic signals eliminates nearly all single-technology fooling attacks.
The fourth layer is randomized sensor polling patterns. Most Top Ball control boards poll their scoring zone sensors in a fixed sequence at a fixed frequency, which makes it easy for an attacker to synchronize their exploit device’s output with the polling cycle. Randomizing the polling sequence and adding variable inter-poll delays makes it significantly harder to inject fake signals at the right moment—the attacker can’t predict when the control board will sample each sensor. This is a firmware-level change that requires manufacturer support or a replacement control board, but it’s a powerful countermeasure against sophisticated electronic attacks.
FAQ
Q: Can a Top Ball machine’s high scores be caused by a calibration problem rather than manipulation?
A: Yes, and calibration drift is actually more common than deliberate manipulation. If the IR emitters have weakened over time (LEDs do dim gradually), the receivers become more sensitive to small disturbances and can false-trigger. If the scoring zone dividers have bent or shifted, balls may deflect into high-score zones more often than intended. Before assuming tampering, run the machine’s built-in sensor test (most machines have one accessible through the service menu), clean all sensor lenses with isopropyl alcohol, and check zone divider alignment. If scores return to normal after cleaning and recalibration, it was a maintenance issue, not an attack.
Q: Are camera-based Top Ball systems inherently more secure than IR-based systems?
A: They’re secure against different threats. Camera-based systems resist IR fooling and reflective material attacks because they analyze actual images. But they introduce new vulnerabilities: the camera lens can be obscured (a small piece of tape changes the image), the lighting can be manipulated (a laser pointer aimed at the camera saturates the sensor), or a printed decal can simulate a ball in a fixed position. Neither technology is categorically more secure—each requires different defensive measures. The most robust approach is combining both: a primary vision system with IR break-beam backup.
Q: What should I look for during a physical inspection of a suspected compromised Top Ball machine?
A: Open the main access door and examine the sensor array area with a flashlight. Look for foreign objects—pieces of tape, foil, paper, or plastic—anywhere near the scoring zones or sensor elements. Check the wiring harness between the sensor array and the control board for splices, added connectors, or wires that don’t match the factory color coding. Look at the ball-return slot and any other openings in the cabinet exterior that could allow access to the sensor area. Examine the control board for any components that appear newer, cleaner, or differently soldered than the rest. Take photos of anything that looks unusual. Even if you can’t identify the exact exploit, physical evidence of tampering tells you where to focus further investigation.
Q: How do I explain score auditing to my floor staff without making them feel like I suspect them of cheating?
A: Frame it as machine health monitoring, not fraud investigation. Tell staff: “We’re tracking score patterns to identify machines that need maintenance before they break down. If a machine starts showing unusual scores, it usually means a sensor needs cleaning or a component is wearing out.” This is true—most score anomalies are maintenance issues—and it accomplishes the security goal without creating a hostile atmosphere. Staff who understand they’re helping maintain equipment, not watching for thieves, are more likely to report unusual patterns they notice during their shifts.
What to Do Next
Start with a quick audit of your Top Ball machines’ score distribution. For each machine, record 50 consecutive ball launches (play them yourself or have a staff member do it) and note which zone each ball scores in. If the 100-point zone accounts for more than 12% of those 50 balls, investigate further. That distribution is outside the normal range for properly functioning machines.
Photograph the sensor array area of each Top Ball cabinet with the main door open, paying attention to the scoring zone channels and the ball path. Note the machine model and the type of scoring sensor (IR break-beam, microswitch, or camera). If your machines have a diagnostic port or test mode that displays raw sensor readings, capture those values as well—a sensor that’s reading differently from its neighbors is your first clue.
Send the photos and score distribution data through the site contact form. The sensor configuration in your specific machine determines what prevention measures will work best, and a photo tells me what I need to know to make useful recommendations. Top Ball machines are electromechanical systems with predictable failure modes and predictable attack patterns. The data to find the problem is already inside your machines. It just needs to be looked at.