A deep dive into court filings, regulatory reports, and investigative journalism that reveals the darker side of the slot machine industry.
Most players understand the house has an edge. That is how casinos work. But what happens when the house is not just winning fairly, but actively rigging the game, denying legitimate payouts, or running pirated software with secretly lowered RTPs?
Investigative writer Hailey Szabo (editor and co-author at classic slots review site OldHagSlots.com) spent months compiling court documents, regulatory filings, and journalism from outlets including CBS News, the Washington Post, and PokerNews into a single comprehensive report. The result is Programmed to Steal: The Dark Side of the Slot Machine Industry, a 10-chapter investigation covering every major fraud case, denied jackpot, and systemic failure in the modern slot machine world.
We are publishing a summary of the key findings here because we believe every player deserves access to this information.
The $43 Million Steak Dinner
In August 2016, Katrina Bookman sat down at a Sphinx penny slot machine at Resorts World Casino in Queens, New York. The screen displayed a figure that would have made her the largest slot jackpot winner in United States history: $42,949,672.76. She took a selfie with the machine. The bells rang. A cash ticket printed.
When she returned the next day to collect, a casino employee told her the machine had "malfunctioned." Resorts World offered her a steak dinner and $2.25.
"I kept thinking about my family. The struggle I've been through; it's hard to cope."
-- Katrina Bookman, speaking to WABC News
Szabo's report highlights a technical detail that makes this case even more troubling. The dollar amount displayed, $42,949,672.76, is nearly identical to 2^32 (4,294,967,296), the maximum value of an unsigned 32-bit integer. This strongly suggests the "jackpot" was caused by a memory overflow bug in IGT's software, where an uninitialized variable displayed its maximum possible value instead of the actual result. A basic programming error that should have been caught in testing.
Bookman was not the only victim. In 2011, 87-year-old Pauline McKee was told she had won $41,797,550.16 on a Miss Kitty penny slot at the Isle Casino in Iowa. She was given $1.85. The slot manufacturer, Aristocrat Technologies, had already sent advisories to casinos recommending they pull the affected machines until a software patch was deployed. The casino ignored the warning. McKee's case went to the Iowa Supreme Court, which ruled in the casino's favor.
Szabo's report documents additional cases: an Oklahoma woman denied $8.5 million, a Florida man denied $167 million, and several others. In nearly every case, courts sided with the casino based on the same six words printed on every machine: "Malfunctions void all pays and plays."
The Superuser Scandal: $50 Million Stolen
In the fall of 2007, players on Absolute Poker noticed something impossible. An account called "Potripper" was winning at a rate that defied mathematics. The account was folding monster hands when opponents had better ones and calling enormous bets with weak holdings when opponents were bluffing. It was statistically impossible without insider information.
A player named "CrazyMarco" requested his hand histories from a suspicious tournament. In what Szabo describes as a "catastrophic error," someone at Absolute Poker accidentally sent him the master hand history file containing every player's hidden cards, IP addresses, and account identifiers.
Analysis confirmed the worst. Potripper was connected to IP addresses at Absolute Poker's headquarters in Costa Rica, using a "God Mode" administrative account that allowed real-time viewing of every player's cards at every table.
Months later, the same pattern emerged on sister site UltimateBet. The Kahnawake Gaming Commission eventually confirmed that 1994 World Series of Poker champion Russ Hamilton was the primary person responsible. In a secretly recorded conversation leaked in 2013, Hamilton admitted to profiting approximately $18 million from the scheme. The total stolen across both sites is estimated at over $50 million.
"The regulator overseeing both sites operated from a few square miles of tribal territory across the river from Montreal. The sites' owner was a former Grand Chief of the Kahnawake. The commission he helped establish cleared him of wrongdoing."
-- Programmed to Steal, Chapter 2
The combined fine for both sites was $2 million, less than four percent of the confirmed theft. Hamilton was never criminally charged. The attorney who helped orchestrate the cover-up, Daniel Friedberg, resurfaced years later as a key figure in the FTX cryptocurrency collapse.
Pirated Games and Criminal RTPs
Perhaps the most alarming section of Szabo's report covers the AffPower network, an Israeli-owned group that operated dozens of online casino brands under a web of shell companies. In May 2016, investigators discovered that AffPower's casinos were running pirated copies of NetEnt slot games. The games looked identical to legitimate titles but were running on AffPower's own servers with secretly modified RTPs.
The evidence was clear. On legitimate casinos, NetEnt progressive jackpots like Hall of Gods displayed network-wide pools in the millions. On AffPower's pirated copies, the same games showed progressives that were a fraction of the legitimate amount, proving the games were running on a completely separate, unaudited system.
AffPower was also connected to industrial-scale website hacking, where thousands of legitimate sites were injected with hidden pages redirecting visitors to their casino brands. The Cartu brothers, connected to AffPower's parent operations, were later charged in connection with a $165 million binary options fraud, revealing the casino operation to be one arm of a larger criminal enterprise.
How Slot Software Actually Gets Rigged
The report identifies three documented methods used by rogue operators to manipulate slot outcomes:
Pirated game replacement. The visual front-end of a legitimate game is copied and connected to a completely different backend. The player sees what looks like a genuine slot, but the actual math is controlled by the rogue operator. The RTP can be set to anything, 70%, 60%, or worse, with no third party testing it.
RTP configuration manipulation. Many legitimate developers offer operators multiple RTP settings for the same game. A slot might be available at 96.5%, 94%, or 92%. Rogue operators select the lowest while advertising the highest. A player researching the game online finds 96.5% published. The casino runs the 92% version.
Post-certification tampering. A game is submitted to a testing lab at its legitimate RTP, passes certification, and receives the official seal. After deployment, the operator modifies the server-side configuration. Unless the testing body conducts ongoing monitoring, the tampering goes undetected.
What Players Can Do
The final chapter of Szabo's report provides a practical checklist for identifying rogue operators before depositing any money. Key recommendations include:
- Verify the casino's license. A license from the UK Gambling Commission or Malta Gaming Authority carries real weight. A Curacao license alone is a warning sign.
- Click certification seals. They should link to the testing body's verification page. A static image with no link may be fake.
- Check game sources. NetEnt games should load from casinomodule.com subdomains. Unknown servers indicate potentially pirated software.
- Research RTPs on the developer's official website and compare them to what the casino advertises.
- Read the Terms and Conditions. Watch for maximum withdrawal caps, excessive wagering requirements, and dormancy clauses that confiscate funds.
- Search blacklists on Casino Listings, Casinomeister, and AskGamblers before depositing.
- Test withdrawals early with a small amount before committing larger deposits.
Read the Full Report
The complete investigation, including all source citations, case references, and detailed analysis, is available for free:
Read "Programmed to Steal" on Issuu
Hailey Szabo is an independent investigative writer based in San Malo, California. More of her work on consumer protection in the gambling industry is available at OldHagSlots.com.
Sources cited in this article are drawn from CNN (2016), CBS News/60 Minutes (2009), Washington Post, Courthouse News Service (2017), Fox News (2017), PokerNews (2022), the Iowa Supreme Court, the Kahnawake Gaming Commission, the New York State Gaming Commission, the US Department of Justice (2017), LatestCasinoBonuses.com, Casinomeister, AskGamblers, and Casino Listings. Full citations are available in the report linked above.
