Polymarket and Kalshi are accelerating their efforts to turn a wide range of significant events into bettable markets. Wagers can be placed on everything from the daily high temperature during a New York heatwave to the latest contestant eliminated from the popular reality show Love Island.
This type of innovation has positioned these emerging prediction markets as closely watched barometers of market sentiment, while also generating substantial revenue: Kalshi's annualized revenue reached approximately $1.5 billion in May, while Polymarket's annualized revenue, based on trading volume, is about a quarter of that figure. However, rapid expansion comes with significant potential risks. Earlier this year, Polymarket was mired in a proliferation of fraud, partly due to the platform's extremely low barriers to creating new accounts. According to sources familiar with the matter, bad actors used stolen credit cards and identity information to register accounts in bulk on Polymarket and repeatedly created fake accounts to exploit the platform's new-user sign-up bonuses.
Rampant Fraud Forces Payment Security Overhaul
The massive fraud attacks led to a sharp spike in chargebacks and transaction failure rates, which alarmed Visa, the card network providing payment clearing services for Polymarket. Sources indicate that Visa subsequently instructed Polymarket's payment processor, Checkout.com, to crack down severely on suspicious and fraudulent payment transactions.
To resolve the crisis, Checkout.com pressured Polymarket to tighten controls on non-compliant transactions. Polymarket then brought in the risk management firm Riskified Ltd., a company that helps online merchants identify and block fraudulent operations before false transactions occur.
Following the relaunch of its US operations in late 2025, Polymarket has seen its trading volume continue to climb, and it is not the only major prediction market platform recently bolstering its payment security. An official spokesperson for Kalshi confirmed that the platform introduced Riskified's risk management services at nearly the same time as Polymarket.
The spokesperson stated that adding Riskified alongside other third-party service providers was due to its superior data and analytical capabilities, noting that bringing in a professional risk management provider is a "standard and critical practice in this industry."
Compared to traditional gambling software or online stock trading, the appeal of prediction markets lies in users being able to make simple yes/no bets on trending events and hot social topics as they unfold in real-time. Both platforms have streamlined the process as much as possible, even allowing users to place bets before funds have settled, while also offering new-user sign-up bonuses and referral rewards, providing multiple cash incentives for traders.
Sources indicate that the combination of low-barrier registration, placing bets before settlement, and various cash rewards directly led to a surge in chargebacks and fraudulent transactions on both Polymarket and Kalshi, with the platforms forced to bear the full cost of refunds to payment institutions.
Excessively high fraud rates can severely erode trust between platforms and their payment service providers, partner banks, and card networks. Industry standard risk control metrics typically require merchants to keep fraud and chargeback rates below 1.5%. Exceeding this threshold can result in fines from card networks like Visa and Mastercard against payment processors and merchants, along with demands for remediation plans; in severe cases, card networks can cut off a platform's payment access entirely.
The introduction of Riskified as a risk management provider signals that the payment infrastructure for prediction markets is still being refined. Previously, it was reported that Polymarket had already faced banking partnership issues: partner Bank of Montreal closed all the platform's accounts last year, though the platform continues to use financial services from other banks. On the payment processing side, both Polymarket and Kalshi use London-based Checkout.com to handle credit card payments, an institution with experience serving high-risk sectors like cryptocurrency.
Both platforms have also implemented alternative payment solutions designed to bypass card network rules, utilizing Aeropay to enable direct bank transfers from users to the platform.
While payment risks have come to a head, both platforms are also under regulatory scrutiny for other compliance issues. These include the potential for platforms to be used for trading on insider information and weak controls on user access from sanctioned countries. Recently, Kalshi began requiring some betting users to disclose their employers, and Polymarket has started requiring some users on overseas sites to submit identity documents like passports.
Currently, both companies are still building the risk management infrastructure that traditional financial institutions have long had in place. Their US operations are registered with and regulated by the Commodity Futures Trading Commission, with contracts on the platforms classified as financial derivatives rather than traditional sports betting. Historically, derivatives trading has been conducted through large, licensed financial institutions like brokerages, which serve major clients and have mature experience in monitoring for suspicious activity.
Many fast-growing fintech and cryptocurrency companies have faced similar large-scale payment fraud. For instance, platforms like Chime and Gemini, which relied on sign-up bonuses and rapid new product launches for user growth, attracted organized fraud rings and widespread abuse by ordinary users seeking to exploit rewards. Fraud rings also share platform vulnerabilities in various communities and online forums, allowing fraudulent methods to spread rapidly.
Evolving Attack Methods
Third-party risk management firms like Riskified act as intermediaries between merchants and payment systems, providing outsourced risk control services commonly required by card networks. These risk service providers aggregate vast amounts of merchant transaction data to accurately identify stolen identities and track fraud rings operating across multiple platforms.
Riskified notes that the emerging prediction market industry lacks mature user identity and credit databases, making it difficult for platforms to perform precise risk assessments based on user historical transaction data. In contrast, traditional financial firms have accumulated extensive historical data on user behavior.
Current major fraud tactics targeting prediction markets also include account takeovers and rapid cash-out schemes: criminals steal user accounts, exploit weaknesses in platform payment controls to quickly transfer funds, and cash out before the platform can freeze the accounts. Last month, Riskified hosted an industry conference in New York, inviting representatives from Polymarket and Kalshi to discuss these security threats.
The online, digitally instant deposit model of prediction markets inherently makes them more vulnerable to various new types of fraud attacks. A Riskified spokesperson stated: "Because the platforms support real-time digital deposits, criminals are constantly evolving their attack methods, including BIN attacks, regional organized crime, and identity laundering for cash-outs."
Significant Risk from BIN Attacks
Riskified highlights BIN attacks as a major security threat for prediction markets. This fraud method exploits the fact that the first few digits of a card number are fixed for cards issued by the same bank. Attackers generate all possible card numbers for that bank, test their validity with small transactions, and then use the valid numbers to move funds on the platform.
Riskified disclosed that earlier this year, a fraud ring launched a BIN attack against a prediction market platform, targeting the Bank Identification Number for Arvest Bank in Arkansas. The ring illicitly profited over $200,000 in just 10 days. The bank stated it continuously monitors for fraudulent transactions and that financial fraud is a challenge faced by the entire industry.
Comments