Most players encounter identity verification at the worst possible moment. They’ve been playing at a sweepstakes casino for a while, have built up a balance of Sweeps Coins and have clicked the button to claim a prize. The site responds by asking for a photo of their driving licence, a selfie and a recent utility bill. The request seems like an obstacle standing between the player and their money, and many interpret it as a sign that the operator is stalling. In reality, verification is precisely what makes it possible to pay out a prize to a stranger. The logic behind it applies to almost any transaction where two parties interact solely via a screen.
The same logic explains why some online businesses inspire trust easily, whilst others do not. It also shows why a business manager with editorial discretion does for companies much the same as a KYC check does for players. Both come up against the same stubborn reality of the internet: a new identity costs next to nothing.
The economics of a free name
In 2001, economists Eric Friedman and Paul Resnick published an article in the Journal of Economics and Management Strategy whose title still aptly describes the internet today: ‘The Social Cost of Cheap Pseudonyms’. Their starting point was simple. When anyone can open a new account in a minute, anyone who behaves badly can abandon their compromised name and start afresh. The bad reputation remains attached to the discarded identity and never reaches the person who earned it.
Friedman and Resnick then modelled a large population of players who meet at random, interact repeatedly, have a finite lifespan within the system, make mistakes from time to time, and can change their identifiers whenever they wish.
They demonstrated that, in such a framework, no equilibrium supports significantly more cooperation than one in which newcomers ‘pay their dues’, accepting poor treatment from established members until they build up a track record. Distrust of outsiders becomes the rational policy, and honest newcomers end up paying for the misdeeds of the dishonest, who keep reappearing under new names.
The paper discusses two solutions. An entry fee makes new identities expensive, which allows the community to trust newcomers again, although it also excludes honest people for whom the fee outweighs the benefit of joining. The second option, for which the authors have outlined a working mechanism, is a free identifier that cannot be replaced.
A trusted third party issues each person a single pseudonym, and standard encryption allows that person to remain anonymous to everyone else, whilst also making it impossible to return under a second name. A year later, computer scientist John Douceur, of Microsoft Research, reached a similar conclusion regarding peer-to-peer networks in his paper on what he termed the Sybil attack. Without a central authority to verify identities, he showed, a system cannot reliably prevent a single participant from posing as multiple users.
The model has limitations that are worth stating openly. It assumes random encounters between strangers, so it leaves aside friendships, shared employers and information from outside the system, which allow real people to vouch for one another. It also treats the trusted third party as reliable by definition. In practice, this party must in turn earn that trust and ends up holding exactly the sort of data that attracts thieves. As a lens through which to understand why verification exists, the paper remains hard to beat, however, and fits very well with what a sweepstakes casino requires of its players.
What a KYC verification entails for a sweepstakes casino
Sweepstakes casinos operate on a two-currency model: Gold Coins, for play with no monetary value, and Sweeps Coins, which can be exchanged for prizes once the player has met the operator’s conditions. The free coins received upon registration, on a daily basis or via postal requests are part of how the model remains within the bounds of US legislation on promotional contests. They are also the reason why cheap pseudonyms become a direct financial problem for the operator. Anyone who opens five accounts collects five welcome bonuses. Know Your Customer checks, usually triggered by the first claim request, are the casino’s version of the ‘irreplaceable identifier’ proposed by Friedman and Resnick. A passport or driving licence links each account to a single living person, and a second account in the same person’s name will not pass verification.
Document verification also clarifies other issues. The first is age, as operators impose a minimum age of 18 or 21, depending on the brand and the country. An identical name on the account used for payment closes off the most obvious route for money laundering via prize claims. Self-exclusion also gains real teeth, because someone who has requested to be blocked cannot simply return with a new email address, and this is the problem with cheap pseudonyms in its most personal form.
Location matters more in 2026 than it did two years ago. The Californian bill AB 831, signed in October 2025, bans two-currency online sweepstakes in the state from 1 January 2026. California has followed the example of Connecticut, Montana and New Jersey, which passed legislation against this model earlier in 2025. An operator that pays out a prize to someone located in an excluded state is taking a legal risk. That is why proof of address and continuous geolocation have become almost as central to the verification process as a photo ID.
For players keen on the practical side of things, Sportzino’s guide to online casino verification explains what needs to be prepared before the first withdrawal request and is well worth reading before impatience sets in. Delays usually stem from minor discrepancies, such as an account name that differs slightly from the one printed on a driving licence, or a document that expired last month without anyone noticing.
Verification works both ways
KYC protects the operator from players who aren’t who they claim to be. The player faces the opposite risk and has far fewer tools to manage it. Sending a website a scanned copy of your passport and a selfie is a serious act of trust, and those who exploit this trust have become very adept at appearing to be legitimate businesses.
Figures from the US Federal Trade Commission (FTC) show just how much the problem has grown. In testimony before Congress in March 2026, the agency reported that, in 2025, consumers filed 3 million fraud complaints and reported losses of $15.9 billion. A year earlier, the figures had stood at 2.6 million complaints and over $12 billion. Since 2020, identity theft scams have been the most frequently reported category each year. The FTC points out that these totals only include what victims chose to report, so the actual losses are higher.
An identity fraud scam is the problem of cheap pseudonyms viewed from a business perspective. A fraudulent operator can register a domain, copy a design template, invent a company name and be ready to collect documents by the afternoon. When complaints pile up, they drop the name and start all over again – exactly the tactic described by Friedman and Resnick. The defence available to the public is the one proposed in their paper: a record of identity that a business cannot shake off by changing its name, maintained by someone who has no interest in making the business look good.
A business directory with editorial vetting does exactly this when managed correctly. An editor checks whether the listed company exists, whether it operates in the sector it claims to, and whether the address, registration details and contact information all match up. The listing then remains in place for years on end, so that the business builds up a visible track record, in one place, which a renamed copy cannot inherit. In this arrangement, the cost is paid in time and editorial control – a far better price than the poor treatment of newcomers predicted by the balance in the paper. Anyone assessing a website before uploading documents to it can look for the same indicators that make a business listing trustworthy. What matters is consistent contact details across all platforms, an address that corresponds to a real location, verified profiles and recent activity.
Who checks the verifier?
A verification is only as good as the standard to which the verifier adheres. In the United States, the most frequently cited reference is the work of the National Institute of Standards and Technology (NIST). The Institute published the final version of SP 800-63-4, its guide on digital identity, on 31 July 2025, replacing the 2017 edition after nearly four years of draft versions and public consultations. The guide was written for government systems, and private companies are adopting it on a large scale. It assesses identity verification, authentication and federation across separate assurance levels and requires organisations to match the level to the risk of the transaction. Viewing a public web page and opening a bank account require very different amounts of evidence.
Anyone asked to send a selfie should be aware of what the 2025 revision has changed. It extends anti-fraud requirements for identity verification and adds controls against injection attacks and forged materials – in layman’s terms, deepfake-generated faces and fake video streams fed directly into the verification software. The selfie, which once seemed like solid proof, has become a prime target for attackers, and the revised standard treats it as such. This matters for anyone who still considers a quick face scan to be the end of the verification process. NIST also requires organisations to balance privacy protection and user experience alongside security. A verification process that is too cumbersome to complete drives honest people away, whilst determined fraudsters simply try again.
This is where the limitation of Friedman and Resnick’s solution becomes apparent. Their ‘irreplaceable pseudonym’ requires a trusted issuer, and every KYC provider, casino or administrator that collects identity data becomes a repository for that data. A player who decides where to upload their licence is fully entitled to ask which legal entity will hold the file and for how long. A firm choosing where to be listed should ask what checks the directors of that directory carry out before approving anyone.
What a verified identity does not tell you
Verification answers a narrow question and should be interpreted as such. A passed KYC check confirms that the player is a real adult, located in an eligible area, who holds a single account, and says nothing about how that player will behave. A verified listing in a directory confirms that the company exists, holds the registration it claims, operates in the sector it states, and can be found again next year. It does not assess the quality of service, does not recommend the company over its competitors, and does not replace a regulatory authority’s own register.
In the case of online gaming in particular, a listing in any directory does not prove that an operator is legally authorised to serve you. US state regulations regarding sweepstakes casinos have changed several times over the past two years.
The reliable answer for your state comes from the list of excluded states published by the operator itself, which you should read on the day you sign up and verify with your state’s Attorney General or gambling regulatory authority. A directory can tell you that the company behind a website is genuine. Whether its games are legal where you live is a separate question, requiring a separate source.
Verified identity also leaves open the question of how fair the product itself is, including how prizes are calculated and how quickly claims are paid out. These questions relate to the published terms and conditions, independent reviews and, when things go wrong, your state’s consumer protection agency or the FTC.
Treating a verification badge as a guarantee of good conduct repeats exactly the mistake that the badge exists to prevent: trusting a name before checking what lies behind it.A quick checklist for both sides of the screen
For players, a few minutes spent before signing up can prevent a claim from being blocked later on.
- Register using your legal name, exactly as it appears on your ID, and keep your address up to date in your account settings.
- Read the operator’s list of excluded countries before purchasing any coin package.
- Check the company behind the site, starting with the legal name in the terms and conditions, a physical address and a listing in an editorially selected directory or a state commercial register.
- Only upload documents via the account page on the operator’s website; never in response to an email or chat message asking you to do so.
For businesses, the procedure is the same process carried out in reverse. Keep the company name, address and telephone number consistent across every platform and claim every profile bearing the company’s name. Choose directories whose editors review listings, as those listings build a track record that an imposter cannot forge overnight.
Friedman and Resnick wrote their paper in the late 1990s, when Resnick was also studying reputation systems, such as eBay’s feedback forum. Selfie matching, geolocation and editor-verified directories now form a large part of what their cryptic pseudonyms merely sketched out.
Their central finding remains valid: wherever a new identity costs nothing, honest newcomers end up paying for the dishonest ones. Verification on both sides of the screen shifts this cost back onto those who cause it and, in my view, is worth the few extra minutes of effort it adds.
