Unexpected Results in Gaming Machines That Cannot Be Explained by Normal Variance
Every machine produces variance. The payout percentage will be higher one week and lower the next. The audit log will show occasional anomalies — a coin jam here, a communication error there. These are normal. The question is: when does normal variance become abnormal? When is the variance so large that it cannot be coincidence? The answer requires statistical analysis. This article explains how to apply statistical methods to machine data and determine whether the results are within normal bounds or whether they indicate manipulation.
Understanding Normal Variance: The Manufacturer Specification
Every machine has a manufacturer-specified payout percentage with a tolerance range. For example, a machine may have a designed payout of 85 percent with a tolerance of plus or minus 2 percent. This means the payout will vary between 83 percent and 87 percent over a large sample of games. The variance is normal. It is caused by the random nature of the game outcomes. No two samples of games will produce exactly the same payout percentage. The tolerance range is the manufacturer guarantee. If the payout percentage falls outside the range, the machine is malfunctioning or being manipulated. The range is determined by the sample size: the larger the sample, the narrower the range. After 100,000 games, the payout should be within 1 percent of the designed rate. After only 1,000 games, it could vary by 5 percent. The sample size matters for the analysis.
Track the machine payout percentage weekly. Compare to the manufacturer specification. Over 4 weeks (a reasonable sample), the average should fall within the tolerance range. If it does not — for example, the 4-week average is 78 percent when the range is 83 to 87 percent — the variance is abnormal. The abnormal variance has three possible causes: a machine fault (hardware failure), a configuration error (wrong payout setting), or manipulation (external control). The investigation to distinguish among the three is the same as described in the previous articles. The key point is that the statistical analysis tells you when to investigate. The manufacturer specification is the threshold. If the variance crosses it, the machine needs attention.
Statistical Test: Standard Deviation Analysis
The standard deviation measures how much the weekly payout varies from the average. A normal machine has a standard deviation of approximately 2 to 3 percent (meaning the weekly payout varies by 2 to 3 percentage points from the average). A standard deviation above 5 percent is abnormal. It suggests that something external is pushing the results. Calculate the standard deviation using the last 12 weekly payout measurements. The calculation takes 5 minutes in a spreadsheet. The result tells you whether the machine is more variable than normal. High variability is suspicious because it suggests external influence. The attacker may be manipulating the machine on some days but not others, creating high variance that the standard deviation captures.
The standard deviation is more sensitive than the average because it measures the consistency, not just the level. A machine can have a normal average (the 4-week average is within the tolerance) but an abnormal standard deviation (the weekly results are all over the place). The normal average hides the problem. The operator who only checks the average misses the manipulation. Check both the average and the standard deviation. The combination provides a complete picture. A machine with a normal average and a normal standard deviation is probably operating normally. A machine with an abnormal standard deviation needs investigation regardless of the average. The standard deviation is the red flag that catches intermittent manipulation.
Player-Specific Variance: The Signature of Targeted Manipulation
Targeted manipulation produces player-specific variance. Player A wins 90 percent of the time. Player B wins 50 percent of the time. The overall machine payout is normal (a weighted average of 90 and 50), so the average analysis misses the manipulation. The player-specific analysis requires tracking individual player results. Many modern machines track this data and display it in the operator menu. Export the data for all players over the past 30 days. Sort by win rate. Look for players whose win rate is significantly above the expected rate (more than 2 standard deviations above the average of all players). Those players are flagged for further investigation.
The player-specific analysis also identifies patterns in the winning. The flagged player may win only at specific times (2:00 PM), only on specific days (Tuesdays), or only when a specific staff member is working. The pattern narrows the investigation. It tells you when to review CCTV footage and when to deploy the bus monitor. The pattern also reveals the manipulation method. For example, if the player wins only when they use a specific machine, the manipulation may be a device attached to that machine. If they win on multiple machines but only at a specific time, the manipulation may be an RF signal scheduled for that time. The pattern analysis is as important as the statistical analysis. The combination of statistics and patterns builds a strong case for manipulation.
Revenue Per Hour Analysis: Detecting Time-Based Anomalies
A machine that generates normal total daily revenue may have abnormal hourly revenue. The hourly analysis reveals anomalies that the daily total hides. For example, the machine may generate normal revenue from 10:00 AM to 2:00 PM, then zero revenue from 2:00 PM to 4:00 PM, then normal revenue from 4:00 PM to closing. The daily total is normal. The hourly breakdown reveals the abnormality. The hourly analysis requires exporting the machine revenue data by hour. Most modern machines provide this data. Compare the hour-by-hour revenue for the suspect machine to other machines of the same type. The comparison identifies the hours where the suspect machine deviates from the norm.
The hourly analysis may also reveal a pattern of high revenue at odd hours. If the machine generates unusually high revenue from 1:00 AM to 3:00 AM (when the venue is empty), someone is manipulating it. The high revenue at empty hours is a classic sign of manipulation. The excess revenue is added via unauthorized credits or payouts. The machine records it as revenue, but no player actually put money in. The daily total appears normal because the excess at night offsets the shortage during the day. The hourly analysis catches this. It is one of the most powerful tools for detecting invisible manipulation. Every operator should check the hourly revenue at least monthly.
Error Log Frequency Analysis
An increased frequency of error log entries can indicate manipulation. The error log records events such as “coin jam,” “bill reject,” “communication error,” and “sensor fault.” These events happen occasionally in normal operation. But if the frequency increases suddenly, the machine is being tampered with. The attacker may be triggering errors to mask manipulation, or the errors may be side effects of the manipulation. For example, RF injection can cause “communication error” entries because the injected signal interferes with normal bus communication. The increased error frequency is an indirect indicator of manipulation. It should be investigated even if the cause appears to be a normal fault.
The error log frequency analysis: count the number of error entries per day for the past 30 days. Chart the counts. Look for a sudden increase. The increase may coincide with the start of the revenue decline. The coincidence is strong evidence of manipulation. Also look at the error type distribution. If a specific error type suddenly dominates (for example, “communication error” entries increase from 2 per day to 20 per day), the error type suggests the manipulation method. Communication errors suggest RF injection. Coin jam errors suggest coin mechanism tampering. The error type distribution guides the investigation. It tells you what kind of manipulation to look for.
When to Escalate: Calling in a Professional
If the statistical analysis indicates abnormal variance, but you cannot find the cause, escalate to a professional. The professional options are: a gaming machine technician (who can perform deeper diagnostics), a security consultant (who can review the physical security and the data), and a bus monitor manufacturer representative (who can install and analyze the bus monitor). The professional escalation costs money (approximately 500 to 2,000 dollars for the initial investigation). The cost is justified if the abnormal variance is causing significant revenue loss (more than 5,000 dollars per month). The professional investigation is also faster than the amateur investigation. The professional has seen similar cases before. They know what to look for. They can identify the cause in hours rather than days. The speed of professional investigation is valuable because the revenue loss continues every day until the cause is found.
The professional investigation should produce a written report. The report documents the findings, the evidence, and the recommended corrective actions. The report is useful for: filing insurance claims (the report is evidence of the loss cause), filing police reports (the report is evidence of the crime), and making a business case for security upgrades (the report quantifies the loss and justifies the upgrade cost). The written report is the durable output of the professional investigation. It protects your interests in any subsequent legal or insurance proceeding. Always request a written report from the professional. Do not accept an oral summary. The oral summary is not admissible as evidence. The written report is.
Frequently Asked Questions
How much data do I need before I can reliably determine if the variance is abnormal? At least 30 days of data with at least 100 games per day. The 30-day window smoothes out daily fluctuations and captures the weekly and monthly patterns. The 100-game minimum ensures that each day has enough data points for statistical significance. If the machine generates fewer than 100 games per day, extend the window to 60 days. The larger window compensates for the smaller daily sample. The larger window also catches manipulation that occurs infrequently. The data collection requires no additional effort if the machine automatically records the data. The effort is only in exporting and analyzing the data. The analysis takes 1 hour per machine. The effort is well spent considering the potential loss from undetected manipulation.
Can normal variance and abnormal variance overlap? Can a machine have both? Yes. A machine can have normal average results but abnormal player-specific results. The average hides the player-specific abnormality. This is why multiple analysis methods (average, standard deviation, player-specific, hourly, error frequency) are necessary. Each method detects different types of abnormality. Relying on a single method risks missing the manipulation. The comprehensive analysis using all five methods is recommended. The comprehensive analysis takes approximately 3 hours per machine. The time is significant, but the revenue protection justifies it. Start with the highest-risk machines (highest revenue, most player complaints, largest unexplained fluctuations). Expand to all machines as time permits. The comprehensive analysis is the gold standard for machine health monitoring.
The statistical analysis shows abnormal variance, but the bus monitor shows no attacks. What does that mean? It means the cause is something the bus monitor does not detect. The possible causes are: a hardware fault that does not generate abnormal bus signals (for example, a failing random number generator), a configuration error that was not caught (for example, the payout percentage was set incorrectly), or a manipulation method that the bus monitor model does not cover (for example, manipulation via the power supply or the display interface). The next step is to run the full manufacturer diagnostic and to check the configuration against the specification. If both are normal, consider swapping the bus monitor for a different model that covers more signal types. The different model may detect the manipulation that the current model misses. The swapping test is recommended before accepting the machine as normal.