BetMGM deposit/withdraw scam targeting poker pros

https://pokerfraudalert.com/forum/showthread.php?24327-Fraudster-stole-up-to-10-000-each-from-poker-pros-likely-due-to-a-legalized-betting-payment-processor-breach-I-was-one-of-the-victims

- Create BetMgm acct using victim's Full name, address, last 4 digits of the social security number, and date of birth
- Deposit $10k into betmgm from victim's checking acct
--> He does not need the victim's bank account number.
A payment service called "VIP Preferred", offered by Global Payments Gaming Solutions, allows the scammer to access previously used bank account information

- withdraw $ same day to Venmo Debit Mastercard
- etc

Didn't even know Venmo had a debit mastercard

Thanks. I was not even aware of this until PartyCasino sent me an e-mail. Party is an MGM affiliated casino. Party does not admit the scope of the problem and tries to minimize the risk to me in their e-mail warning.

I do not understand how anyone can create an account using just the last four digits of the SS#. The hackers probably have the other bits of ID information about almost every adult and sell to the highest bidder. They probably have full SS#s on many of us, especially older folks. This used to be easy to obtain from unredacted public documents.

I also don't understand how a new customer can withdraw to a different account so easily. Does anyone know how long they waited to withdraw? Did they do some token play first? This should have raised concerns at the risk department of the affected sites.

The "VIP Preferred/Global Payments is a huge security hole. I hope they are taking very concrete steps to plug this hole. When you sign up for an account at most casinos, they check and see if you have an account at "VIP Preferred". If you do, the site populates the deposit page with a drop-down or radio menu with all of the banking accounts that you have ever used to deposit. This is an outrageous security loophole driven by the online casino's desire to make it very easy to fund a new account. At the very least, each new customer should be required to enter the routing number and checking account number to activate the VIP Preferred deposit method for that specific online site.

I regard this as callous disregard for customer security all in the name of greed by the casinos.

VIP Preferred is a popular payment method for online poker players because it offers a quick way to deposit and withdraw eChecks.

The nature of the system is such that a user’s bank account details can be stored so the user doesn’t need to enter them each time they want to make a payment.
BetMGM and aren’t to blame. The issue appears to be with VIP Preferred, a product owned by Global Payments. I believe the fraudster is stealing money from poker players by doing the following:
The fraudster steals the personal details of various poker players, including name, address, date of birth, and Social Security Number.

Quote: Prioned

VIP Preferred is a popular payment method for online poker players because it offers a quick way to deposit and withdraw eChecks.

The nature of the system is such that a user’s bank account details can be stored so the user doesn’t need to enter them each time they want to make a payment.
BetMGM and aren’t to blame. The issue appears to be with VIP Preferred, a product owned by Global Payments. I believe the fraudster is stealing money from poker players by doing the following:
The fraudster steals the personal details of various poker players, including name, address, date of birth, and Social Security Number.
link to original post

A new scam player at any site, including BetMGM, does not to need to know the the bank account information because the site's client software populates fields with the bank account information. The gambling sites are all equally at fault. Global Payments is happy to forward your bank information to a online gambling site without doing the least bit of verification themselves. The sites do fairly lax verification that the account is being opened by the real person whose credentials were submitted. Then, they provide all of your bank information to the scammer with no challenge whatsoever.

I actually hold the sites more responsible. Global Payments gives your banking info to a trusted partner. The trusted partner gives it to a criminal. This is totally irresponsible. I do think the regulators need to clean this loophole up. We cannot wait for the sites to protect us. We are only as safe as the site with the worst security policies.