Is Online Poker Rigged? The Evidence-Based Answer (2026)

The Short Answer — What the Data Actually Says

The “online poker is rigged” argument usually follows one of two patterns: either someone has run bad over a session or a month and wants an explanation, or someone has read about a real scandal and generalised it to the entire industry. Both are understandable reactions. Neither survives scrutiny when applied to licensed rooms.

PokerStars, the largest online poker room in history, has published data covering tens of billions of dealt hands. Independent academic researchers — including studies cited in regulatory submissions to the Australian Parliament — have run chi-square goodness-of-fit tests on starting hand distributions from PokerStars hand histories. The statistical conclusion every time: card distribution matches theoretical probability within acceptable variance. Pocket aces are dealt approximately once every 221 hands. Suited connectors appear at their expected frequency. There is no detectable bias in the dealing algorithm across sample sizes that dwarf anything a live cardroom has ever tracked.

That matters because a biased RNG would be statistically detectable at scale. You cannot hide a skewed distribution inside 50 billion hands — the chi-square deviations would be enormous. The fact that independent researchers have not found those deviations is meaningful evidence, not a reassurance from a marketing department.

The second thing data tells us is this: bad beats are exactly as common online as probability says they should be. When your AA loses to 72o, that hand has roughly a 12% chance of winning before the flop. Run that spot 10,000 times and 72o wins approximately 1,200 times. Online poker players see that spot far more often than live players because the deal rate is three to four times faster. More hands means more instances of every improbable outcome, including the ones that feel like they could not possibly be random. They can, and they are.

Variance is not a bug. It is the feature that keeps recreational players at the table long enough to give skilled players a profitable edge. Understanding variance at a mathematical level is, in my view, the single most important mental shift any serious player can make.

How Online Poker RNG Actually Works

When you click “deal” on a licensed poker site, the outcome has already been determined by a Pseudorandom Number Generator — a PRNG. The most widely used algorithm in this context is the Mersenne Twister (MT19937), which produces sequences of numbers with a period of 2¹⁹⁹³⁷−1. That is a number with approximately 6,000 digits. There is no practical mechanism by which this sequence repeats in a way that could be exploited during play.

But a PRNG is only as unpredictable as its seed — the initial value that starts the sequence. This is where hardware entropy enters. Reputable operators seed their PRNGs from multiple true-entropy sources: hardware random number generators (HRNGs) that measure physical phenomena such as thermal noise, atmospheric noise feeds, and high-resolution CPU clock timing data. PokerStars, for example, has documented the use of 249 random bits drawn from combined entropy sources including quantum randomness. The seed is functionally unknowable in advance.

Once a random number is generated, the deck is shuffled using the Fisher-Yates algorithm (also called the Knuth shuffle). This algorithm produces a uniformly distributed permutation of 52 cards — meaning every possible deck ordering has exactly equal probability. The mathematics of Fisher-Yates is well understood and has been the academic standard for decades. Any competent implementation produces a fair shuffle. Certification testing specifically verifies that the implementation is competent.

What eCOGRA and iTech Labs Actually Test

eCOGRA (eCommerce Online Gaming Regulation and Assurance) and iTech Labs are the two most widely recognised independent testing laboratories for online gaming RNG certification. GLI (Gaming Laboratories International) and BMM Testlabs also operate in this space. These are not rubber-stamp organisations — they are accredited testing labs that perform rigorous statistical analysis before issuing a certificate.

A standard RNG audit includes: uniformity testing (does each possible output appear with equal frequency?), independence testing (does the current output have any statistical relationship to previous outputs?), cycle length verification (confirming the period of the PRNG is too large to be exhausted), and chi-square analysis of actual card distribution across simulated billions of deals. The source code of the RNG implementation is reviewed, not just its outputs.

Certificates are not issued once and forgotten. eCOGRA requires periodic re-certification, and any material change to the RNG system triggers a new audit. You can find published compliance certificates on the websites of PokerStars, GGPoker, and 888poker — look in their “About Us” or “Fair Play” sections, or request them from their support teams. The existence of a current, valid certificate from a recognised lab is the single most reliable indicator that a room’s dealing algorithm is sound.

Why Rigging the Deck Makes No Business Sense

Set aside the technical and legal arguments for a moment and consider the economics. Poker rooms do not profit from who wins the pot. They profit from rake — a percentage of each pot or a fixed tournament fee. A poker room’s income is entirely indifferent to whether the best hand or the worst hand wins. Rigging outcomes to favour recreational players over regulars would increase the complexity and legal exposure of the operation without adding a single dollar of rake revenue. The incentive to rig is, in economic terms, essentially zero. The incentive to maintain certified fairness — because it is required by regulators who can revoke a licence worth hundreds of millions of dollars — is enormous.

Real Scandals That Actually Happened

I will not pretend the industry has a spotless record. Real cheating happened on online poker sites, and the people who uncovered it deserve credit for rigorous analytical work. But the nature of those scandals matters enormously for understanding the current risk landscape.

Absolute Poker and UltimateBet: The Superuser Accounts (2007–2008)

This is the most significant documented cheating scandal in online poker history, and it is worth understanding precisely what happened and how it was caught.

In September 2007, players on Absolute Poker noticed statistically improbable win rates from a single account — specifically a tournament player going by the screen name “POTRIPPER.” The suspicion crystallised when a player named CrazyMarco accidentally received a complete tournament hand history that included the hole cards of all players at the table, not just his own. This was a data export error that exposed a superuser-level view of the game.

Community analysts — working in forums, not at the company — ran a statistical analysis of POTRIPPER’s decision-making and found that the fold and call frequencies were only explicable if the player could see opponents’ hole cards. They had been making near-perfect exploitative decisions in spots where a normal player could not possibly know the correct play. Absolute Poker eventually admitted an employee had used a backdoor function built into the platform that allowed a superuser to see all cards in real time. The Kahnawake Gaming Commission fined Absolute Poker $500,000 and ordered $1.6 million in restitution to affected players.

UltimateBet had an almost identical scandal, running from at least January 2005 to December 2007. The main perpetrator was identified as Russ Hamilton, a former World Series of Poker Main Event champion. Six accounts and 18 screen names were involved. The Kahnawake Gaming Commission issued UltimateBet a $1.5 million fine and ordered $22 million in restitution. The total scope of the cheating across both sites ran to tens of millions of dollars extracted from players over several years.

Both sites operated under the Cereus Network and were, critically, not among the tier-one regulated rooms in major licensing jurisdictions at the time. The cheating was not algorithmic manipulation of the RNG — the cards were dealt fairly. The cheating was insider access: employees who could see information they should not have seen and weaponised that against players. That distinction is important.

Full Tilt Poker: Fraud, Not Rigging (2011)

Full Tilt Poker was seized by the US Department of Justice on April 15, 2011 — a day the poker community calls Black Friday. The initial charges related to illegal gambling, bank fraud, and money laundering. But in September 2011, the DOJ amended its complaint and alleged something far worse: that Full Tilt Poker owed approximately $390 million to players worldwide while holding only around $60 million in accounts. Player deposits had been used to pay distributions to owners, managers, and sponsored pros rather than being held in segregated accounts.

Full Tilt Poker was not rigging card outcomes. The games themselves appear to have been fair. The fraud was financial — the company was running what the DOJ characterised as a Ponzi scheme with player funds. PokerStars eventually acquired the company and compensated players, with payouts completed in 2016. The lesson from Full Tilt is not about RNG integrity; it is about financial segregation and the importance of playing on sites licensed in jurisdictions that require audited player fund protection.

Distinguishing Rigging from Variance

Neither scandal involved a manipulated RNG. Absolute Poker and UltimateBet involved insider information access. Full Tilt involved financial mismanagement. These are real and serious forms of dishonesty, but they are categorically different from the claim that a site’s algorithm is designed to produce bad beats or favour certain players in the deal.

If you believe you are experiencing rigged card outcomes, the test is statistical. Track your actual all-in equity versus results over a minimum of 10,000 all-in confrontations. At sample sizes below that, variance will produce results that feel impossible but are entirely normal. Poker tracking software such as PokerTracker or Hold’em Manager will calculate this for you automatically.

Licensed vs Unlicensed Rooms — Where the Real Risk Lives

The honest answer to “is online poker rigged” depends entirely on which poker site you are talking about. The risk profile of a UKGC-licensed room and an unlicensed offshore room with no public operator information are not remotely comparable.

UKGC and MGA Licensed Rooms

The UK Gambling Commission and the Malta Gaming Authority are the two most demanding licensing jurisdictions for online poker. Both require mandatory independent RNG certification from an accredited laboratory before a licence is issued, and ongoing compliance audits thereafter. Both require player funds to be held in segregated accounts. Both have enforcement powers and track records of using them. PokerStars (currently licensed under both MGA and UKGC), 888poker, and partypoker all operate under these frameworks. If an RNG issue were detected at a UKGC-licensed room, the regulator has the authority to suspend the licence immediately.

Curacao Licensed Rooms

Curacao eGaming is a lighter-touch jurisdiction — licensing fees are lower, regulatory oversight is less intensive, and enforcement actions have historically been slower. That said, major sites operating on the GGPoker Network and similar platforms hold Curacao licences alongside MGA or Isle of Man licences, and still maintain independent RNG certification. The Curacao licence alone is not a guarantee, but it does not automatically indicate fraud either. The presence of a published RNG certificate from eCOGRA or iTech Labs matters more than the licence jurisdiction in most cases.

Unlicensed Rooms — Genuine Risk

Sites that display no licence information, list no verifiable operator entity, and cannot produce a current RNG certificate from a named independent laboratory represent a genuinely different risk category. Without regulatory oversight, there is no external check on the dealing algorithm. This is where the superuser-style risks are most plausible — not at rooms operating under the scrutiny of a major gaming authority.

Red flags worth taking seriously: no visible licence number or link to a regulator’s website; inability to produce RNG certification documentation on request; no named operator company; withdrawal problems or pattern of unresolved player complaints on independent forums; ownership structure that is deliberately obscured.

My personal rule: I do not deposit on a site that cannot show me a current RNG certificate from eCOGRA, iTech Labs, GLI, or BMM Testlabs. That filter eliminates essentially all of the serious fraud risk while leaving a large number of playable sites.

Common “Rigging” Myths, Addressed Directly

“I Always Lose with Pocket Aces”

Pocket aces win approximately 85% of the time heads-up against a random hand before the flop. In a nine-handed game, aces win the pot roughly 31% of the time because they are up against eight opponents. If you are playing 50 hands per hour online and getting aces once every 221 hands, you are seeing aces roughly twice per hour. At that frequency, losing with aces multiple times in a single session is not only possible — it is statistically expected over any honest sample. The human brain is wired to remember losses more vividly than wins. This is not a character flaw; it is cognitive architecture. Your aces probably win close to the rate they should. You are just not tracking the wins with the same attention.

“The Board Always Favours the Fish”

This is survivorship bias in its clearest form. When a recreational player catches a two-outer on the river, you remember it because it costs you money and feels outrageous. When you crack a recreational player’s aces with your suited connectors — which happens at exactly the rate probability predicts — you remember it as a nice pot, not as evidence of manipulation. The sample you are mentally tracking is heavily weighted toward the painful observations.

“Bad Beats Happen More Online Than Live”

They do — in absolute frequency. But not in percentage terms. A live game deals approximately 25 to 30 hands per hour. A standard online table deals 70 to 80 hands per hour. Multi-tabling adds another multiplier. In the time it takes to play one live session, an online grinder can play the equivalent of a week’s worth of live hands. More hands means more instances of every statistical outcome, including all-in coolers and river bad beats. The percentage of hands that produce a bad beat is identical. The raw number of bad beats experienced per hour of play is much higher online, simply because more hands are dealt per hour. This is one of the most common misunderstandings among players transitioning from live to online poker.

“The Site Controls Who Wins to Keep Fish Playing”

This theory requires the poker site to sacrifice rake from winning pots on manipulated hands in order to keep recreational players from going broke. But the room takes rake from every pot regardless of who wins. If anything, keeping a skilled player at the table generates more rake than protecting a recreational player, because the skilled player plays more pots and stays longer. The economic model of rake-based income makes manipulation designed to influence outcomes actively counterproductive. There is no version of this that makes financial sense for a room operating at scale.

“My Hand History Analysis Proves Something Strange Is Happening”

It is possible to analyse hand histories rigorously, and I encourage it. Download your histories into PokerTracker or Hold’em Manager and examine your all-in adjusted equity versus actual results over your full database. If you have fewer than 50,000 hands, you do not have a statistically significant sample — variance can produce very large swings over that volume. If you have 200,000+ hands and your EV line and results line are diverging by more than two or three buy-ins, look first at your own play in spots where you thought you were a large favourite. The most common cause of EV versus results divergence is not rigging — it is overestimating equity in multiway or borderline spots.