Player protection flags for operators

Flag a stake climbing past this player's own norm

A player whose stake has sat near the same figure for a month is betting far above it tonight, and the last few bets are each bigger than the one before. The scheduled risk review reads this session after it ends, so the pattern reaches your team as history. Against the whole player base this stake may look ordinary. Against this player's own month it is a change, and the moment to see it is while the bets are still going in.

What Signals knows

mean_stake_1h: Mean stake over the last hour of this session
mean_stake_30d: Mean stake over the last 30 days
bets_1h: Bets placed in the last hour

What your team and tooling do

Compares the two means and, when this hour's stake passes the ratio your protection policy sets for a marker, opens a case in your player protection tooling with both figures attached. Your team decides what, if anything, happens next.

protection.ts · 17 lines

from datetime import timedelta
from snowplow_signals import Attribute, Event, EventProperty, StreamAttributeGroup, user_id

bet_placed = Event(name="bet_placed", vendor="com.example", version="1-0-0")
stake = EventProperty(vendor="com.example", name="bet_placed", major_version=1, path="stake")

mean_stake_1h = Attribute(
    name="mean_stake_1h",
    type="double",
    events=[bet_placed],
    aggregation="mean",
    property=stake,
    period=timedelta(hours=1),
)

mean_stake_30d = Attribute(
    name="mean_stake_30d",
    type="double",
    events=[bet_placed],
    aggregation="mean",
    property=stake,
    period=timedelta(days=30),
)

bets_1h = Attribute(
    name="bets_1h",
    type="int32",
    events=[bet_placed],
    aggregation="counter",
    period=timedelta(hours=1),
    default_value=0,
)

# Bets are sent from your server, so the player id is the key both windows share.
game_protection_stakes = StreamAttributeGroup(
    name="game_protection_stakes",
    version=1,
    attribute_key=user_id,
    owner="you@example.com",
    attributes=[mean_stake_1h, mean_stake_30d, bets_1h],
)

// In the service that checks protection markers after each bet
const player = await signals.getServiceAttributes({
  name: "game_protection_stakes",
  attribute_key: "user_id",
  identifier: playerId,
});
// { mean_stake_1h: 42.5, mean_stake_30d: 8.1, bets_1h: 37 }

const rising = player.mean_stake_1h >= player.mean_stake_30d * policy.stakeRatio;

if (player.bets_1h >= policy.minBets && rising) {
  protection.openCase({
    playerId,
    marker: "stake_rising",
    evidence: { thisHour: player.mean_stake_1h, usual: player.mean_stake_30d },
  });
}

Flag a session running long past this player's usual length

This player's sessions have run about forty minutes for as long as you have records, and tonight's has passed three hours. A session length reaches a review once it has a start and an end, so the long one is counted after the player has logged off. Your own records hold what is usual for this player. Signals supplies how long this session has run so far, while it is still running.

What Signals knows

minutes_in_session: Minutes since this session started
sessions_today: Sessions started in the last 24 hours

What your team and tooling do

Checks minutes in session against the usual length your own records hold for this player, and when it passes the margin your policy sets, surfaces the session to your team or shows the prompt your tooling runs. Which of those, and whether either, is your rule.

protection.ts · 17 lines

from datetime import timedelta
from snowplow_signals import Attribute, Event, StreamAttributeGroup, user_id

session_start = Event(name="session_start", vendor="com.example", version="1-0-0")

# Time since the most recent session_start is how long this session has run.
minutes_in_session = Attribute(
    name="minutes_in_session",
    type="double",
    events=[session_start],
    aggregation="time_since_last",
    time_unit="min",
)

sessions_today = Attribute(
    name="sessions_today",
    type="int32",
    events=[session_start],
    aggregation="counter",
    period=timedelta(days=1),
    default_value=0,
)

game_protection_session = StreamAttributeGroup(
    name="game_protection_session",
    version=1,
    attribute_key=user_id,
    owner="you@example.com",
    attributes=[minutes_in_session, sessions_today],
)

// In the job that checks open sessions every few minutes.
// usualSessionMinutes is your own figure for this player, from your warehouse or risk platform.
const player = await signals.getServiceAttributes({
  name: "game_protection_session",
  attribute_key: "user_id",
  identifier: playerId,
});
// { minutes_in_session: 186.4, sessions_today: 2 }

if (player.minutes_in_session > usualSessionMinutes * policy.lengthRatio) {
  protection.flag({
    playerId,
    marker: "long_session",
    minutes: player.minutes_in_session,
    usual: usualSessionMinutes,
  });
}

Flag a day of deposits out of step with this player's month

A player who deposits a modest amount a few times a month has deposited three times today, and the total has passed what they put in across the rest of the month. Deposits are read in the next scheduled pass, so a heavy day surfaces once it is over and the money has been staked. The comparison is this player's day against this player's month, and it is available at the third deposit rather than the next morning.

What Signals knows

deposited_24h: Total deposited in the last 24 hours
deposited_30d: Total deposited in the last 30 days
deposits_24h: Separate deposits in the last 24 hours

What your team and tooling do

Sets today's total against the rest of the month and, when today passes the share your policy names, opens a review in your protection tooling with both totals. Your rules decide whether that means a case, a message from your team or nothing.

protection.ts · 17 lines

from datetime import timedelta
from snowplow_signals import Attribute, Event, EventProperty, StreamAttributeGroup, user_id

deposit = Event(name="deposit", vendor="com.example", version="1-0-0")
amount = EventProperty(vendor="com.example", name="deposit", major_version=1, path="amount")

deposited_24h = Attribute(
    name="deposited_24h",
    type="double",
    events=[deposit],
    aggregation="sum",
    property=amount,
    period=timedelta(days=1),
    default_value=0,
)

deposited_30d = Attribute(
    name="deposited_30d",
    type="double",
    events=[deposit],
    aggregation="sum",
    property=amount,
    period=timedelta(days=30),
    default_value=0,
)

deposits_24h = Attribute(
    name="deposits_24h",
    type="int32",
    events=[deposit],
    aggregation="counter",
    period=timedelta(days=1),
    default_value=0,
)

# The cashier sends deposit from the server, keyed on the same player id as the bets.
game_protection_deposits = StreamAttributeGroup(
    name="game_protection_deposits",
    version=1,
    attribute_key=user_id,
    owner="you@example.com",
    attributes=[deposited_24h, deposited_30d, deposits_24h],
)

// In the service that runs after each deposit is confirmed
const player = await signals.getServiceAttributes({
  name: "game_protection_deposits",
  attribute_key: "user_id",
  identifier: playerId,
});
// { deposited_24h: 900, deposited_30d: 1150, deposits_24h: 3 }

const restOfMonth = player.deposited_30d - player.deposited_24h;

if (player.deposits_24h >= 2 && player.deposited_24h > restOfMonth * policy.depositRatio) {
  protection.openCase({
    playerId,
    marker: "deposit_spike",
    evidence: { today: player.deposited_24h, restOfMonth },
  });
}

Flag a return to play minutes after a limit ended

A player set a loss limit and reached it, and the break they chose has just ended. Twelve minutes later they are placing bets. Your limits tooling records the limit being reached, and a review reads the quick return as a line in tomorrow's report, after the session it belongs to. The gap between the break ending and the first bet is a figure your team may want in front of them tonight, with your rules deciding what it means.

What Signals knows

minutes_since_limit: Minutes since a self-set limit was last reached
bets_10m: Bets placed in the last ten minutes

What your team and tooling do

Takes the break length from your limits tooling off the minutes since the limit was reached, and when the first bets land inside the window your policy names, puts the return in front of your team with the gap attached. Whether that leads to a conversation, a prompt or nothing is your call.

protection.ts · 18 lines

from datetime import timedelta
from snowplow_signals import Attribute, Event, StreamAttributeGroup, user_id

# Your limits tooling sends limit_reached when a player hits a limit they set.
limit_reached = Event(name="limit_reached", vendor="com.example", version="1-0-0")
bet_placed = Event(name="bet_placed", vendor="com.example", version="1-0-0")

minutes_since_limit = Attribute(
    name="minutes_since_limit",
    type="double",
    events=[limit_reached],
    aggregation="time_since_last",
    time_unit="min",
)

bets_10m = Attribute(
    name="bets_10m",
    type="int32",
    events=[bet_placed],
    aggregation="counter",
    period=timedelta(minutes=10),
    default_value=0,
)

game_protection_limits = StreamAttributeGroup(
    name="game_protection_limits",
    version=1,
    attribute_key=user_id,
    owner="you@example.com",
    attributes=[minutes_since_limit, bets_10m],
)

// In the service that checks protection markers after each bet.
// breakMinutes is the break length this player chose, from your limits tooling.
const player = await signals.getServiceAttributes({
  name: "game_protection_limits",
  attribute_key: "user_id",
  identifier: playerId,
});
// { minutes_since_limit: 1452.0, bets_10m: 4 }

const minutesSinceBreakEnded = player.minutes_since_limit - breakMinutes;

if (player.bets_10m > 0 && minutesSinceBreakEnded >= 0 && minutesSinceBreakEnded <= policy.returnWindowMinutes) {
  protection.flag({
    playerId,
    marker: "quick_return",
    minutesAfterBreak: minutesSinceBreakEnded,
  });
}

Flag a change in play while the session is still running.

Raise the flag while the player is still in the session.

Flag a stake climbing past this player's own norm

Flag a session running long past this player's usual length

Flag a day of deposits out of step with this player's month

Flag a return to play minutes after a limit ended

Try it on your own site.