Marketing, Finance, and Risk suspected that a non-trivial share of promo spend and withdrawal volume was being captured by organized studios operating multiple synthetic accounts. There was no unified view of how these accounts linked together, no way to size the leak, and no actionable list the operations team could execute against.

• Designed a tiered cluster-detection framework linking accounts via shared withdrawal channels, name hashes, and phone fingerprints, ranking each cluster by suspiciousness (P0 / P1 / P2).
• Built an 11-category fraud-type classifier so each cluster routes to the right downstream team.
• Joined cluster output to deposit, withdrawal, promo cost, and game-level betting data to compute per-cluster net P&L.
• Produced multi-dimensional Top-30 actionable lists — each cluster a self-contained case file.

• Two promo rules accounted for 67% of arbitrage outflow; rule-fix projected to save ≈ ₱20.6M / month (≈ ₱247M annualized).
• Top-30 actionable list used by Risk to freeze withdrawals, by Marketing to rewrite promo rules, by Finance to recover ≈ ₱50K / month.
• Mapped leak across 18 banking / e-wallet channels — first end-to-end view of organized activity.

During cluster review, one cluster of 53 accounts showed a withdraw-to-deposit ratio of 7.82× — three standard deviations beyond the population. The challenge: prove systematic fraud or rule it out, and if fraudulent, find every other ring like it.

• Verified zero jackpot wins and 51-of-53 player win-rate — statistically impossible under fair play.
• Discovered 99% of betting volume on a single PVP game (Texas Poker) with cluster-level RTP of 1.90.
• Generalized the pattern: flag clusters where size ≥ 3, RTP ≥ 1.5, and poker concentration ≥ 80%.
• Layered batch-registration fingerprints to harden detection against false positives.

• Detection rule adopted into the standard tiering system by the Risk team.
• Sized three distinct victim layers so leadership could prioritize remediation against business cost.
• Recommended immediate actions and longer-term anti-collusion controls for PVP titles.

Marketing, Risk, Operations, and Finance each maintained their own slice of player data, leading to inconsistent definitions of "active user," "deposit cohort," and "marketing ROI." Ad-hoc queries were slow and rarely agreed with each other.

• Designed a 59-field player-profile snapshot table covering identity, lifecycle stage, deposits / withdrawals (lifetime + 1d / 7d / 30d), betting and GGR, channel and game preferences, and marketing-cost attribution.
• Modeled marketing cost as five mutually exclusive categories (rebate, redpacket, mud-chip, free-spin, reward).
• Computed unit-economics ratios (cost-to-deposit, cost-to-GGR) at the player level — surfacing money-losing cohorts Finance previously couldn't see.
• Built daily INSERT-OVERWRITE partitioned ETL with explicit filtering of test accounts; documented all known data gaps.

• Replaced redundant per-team aggregations with one authoritative daily table — upstream join for the fraud-cluster pipeline and churn-prediction model.
• Cut analyst query time from minutes-against-raw-fact-tables to seconds-against-snapshot.