Rigged RNG and Fake Audit Seals: How to Verify If Your Casino's Games Are Actually Random

Game Integrity 11 min readupdated 2/18/2026

Every online casino claims their games are 'provably fair' or 'independently audited' or 'powered by certified RNG technology.' The footer is dotted with reassuring logos: eCOGRA, iTech Labs, GLI. The marketing copy reads like a regulator wrote it. And in many cases, the logos are completely fake — pasted into an HTML footer with no underlying audit. Here's how to tell which seals are real, what an honest RNG actually looks like, and the specific verification steps that take less than two minutes per casino.

// What an RNG is and what 'fair' means in this context

An RNG — random number generator — is the algorithm that decides the outcome of every spin, card draw, dice roll, or wheel result in an online casino game. Modern online gambling uses 'pseudo-random' number generators: deterministic algorithms that, seeded properly and tested rigorously, produce sequences statistically indistinguishable from true randomness. The technology itself is mature. Cryptographic RNGs that pass standard test suites (NIST SP 800-22, Diehard, TestU01) have been industry-standard since the early 2000s. The problem is not the technology. The problem is that *the operator decides which RNG they ship*, and there is no automated way for a player to verify that the RNG running in their browser tonight is the same one that was tested and approved in an audit two years ago. An honest RNG produces fair outcomes. A biased one tilts the math toward the house. Both look identical to the player.

// The audit ecosystem: who certifies what

Four firms dominate the legitimate online casino RNG audit market. **eCOGRA** (eCommerce and Online Gaming Regulation and Assurance) is the oldest, founded 2003, headquartered in the UK. **iTech Labs**, based in Melbourne, audits the most slots globally. **Gaming Laboratories International (GLI)**, headquartered in New Jersey, dominates the regulated US market. **BMM Testlabs**, also in Las Vegas, handles tribal and state-regulated audits. These firms perform two distinct services: (1) initial certification of the RNG algorithm itself, and (2) ongoing testing of deployed games to verify that the algorithm hasn't been substituted, modified, or tuned. The crucial nuance: certification is point-in-time. A casino that obtained an eCOGRA certificate in 2021 and let it expire in 2023 still has the eCOGRA logo in their footer. Showing the logo costs nothing. Maintaining the underlying audit costs $40,000-$120,000 per year per game catalog.

// How fake or expired seals work in practice

Three common patterns. First, the **lapsed audit**: the casino had a real audit five years ago, never renewed, and never removed the logo. The audit firm doesn't proactively police lapsed certifications — they have no business incentive to. The logo remains in the HTML footer. The player sees it and assumes the audit is current. Second, the **partial scope audit**: the casino has a real, current audit, but only on a subset of games — say, three RNG-based slots from one studio. The footer shows the eCOGRA logo without specifying scope. The other 800 games on the site, including the live dealer products and the third-party slots, have no audit at all. Third, the **fabricated logo**: the casino simply pastes the eCOGRA image into their footer with no underlying relationship. Smaller offshore operators do this regularly. The audit firms don't sue, because cease-and-desist enforcement against a Curacao-licensed operator from a UK-based audit firm is a legal nightmare with no clean jurisdiction.

// The 90-second verification process

Three steps. First, scroll to the casino's footer and find the audit firm's logo. Right-click the logo: does it link to a verification page on the audit firm's domain? A real certification almost always includes a clickable seal pointing to https://ecogra.org/verify or similar. A fabricated logo points nowhere or points back to the casino's own site. Second, visit the audit firm's website directly (don't trust the link from the casino). Each of the four major firms maintains a public, searchable certified-operator list — eCOGRA's is at ecogra.org/verify, iTech Labs at itechlabs.com/certifications, GLI at gaminglabs.com/clients. Search the casino's exact brand name. If it doesn't appear, the seal is invalid. Third, check the date. If the casino appears in the certified list, look for an expiry or last-audited date. Anything older than 18 months should be treated as expired even if the firm hasn't formally lapsed it.

// What 'provably fair' actually proves — and what it doesn't

Crypto casinos market a different verification model called 'provably fair.' The mechanism: each game uses a server seed (chosen by the casino), a client seed (chosen by the player), and a nonce (counter). The casino publishes a hash of the server seed before the game starts. After the player commits to a series of bets, the casino reveals the actual server seed. The player can then verify that the published hash matches the revealed seed — which proves the casino didn't change the seed mid-game. This is mathematically real and useful. But it does *not* prove the game's RTP is what the casino advertises, doesn't prove the casino didn't pre-select a deliberately bad server seed, and doesn't prove the algorithm computing the game outcomes from those seeds is the algorithm the casino claims. Provably fair is a partial fairness guarantee, not a full audit replacement. Treat the 'PF' badge as one piece of evidence, not proof.

// Signs your RNG may be tuned against you

An honest RNG produces variance around the mean RTP. A tuned one biases either toward giving you small wins early (to build engagement and trigger deposits) or toward catastrophic losing streaks (to wipe out winnings before withdrawal). Three patterns to watch for. First, **the welcome-streak**: brand new accounts that hit improbably good outcomes in their first 50-100 spins, then revert to losses. The first session is engineered to hook you; the math after that is what the casino actually runs. Second, **the post-deposit drought**: large losing streaks specifically following a deposit. This pattern is consistent with operators using behavioral-trigger algorithms that throttle outcomes based on deposit timing. Third, **bonus-mode misses**: bonus rounds that statistically should trigger every 200-300 spins instead going 1,000+ without hitting. None of these are conclusive on their own — variance is real and small samples lie — but if multiple patterns stack on the same casino, you're either looking at a biased RNG or an extraordinarily unlucky session.

// What to do if you suspect your casino's RNG is tuned

Three steps. First, **document and withdraw**. Take screenshots of your spin history, withdraw your remaining balance immediately, and switch operators. Don't try to 'win it back' — that's exactly the behavioral hook a tuned RNG is designed to exploit. Second, **report the casino to the audit firm whose logo it displays**. eCOGRA, iTech, and GLI all maintain reporting channels for fake-seal usage. The firms may not act in your individual case, but accumulating reports against a specific operator does eventually lead to public delisting, which costs the casino future revenue. Third, **file with the casino's licensing regulator**. UKGC, MGA, and SGA take RNG complaints seriously and can compel an emergency audit. Curacao, Anjouan, and Costa Rica generally don't act on individual complaints, but they do track complaint volume — and a high-volume operator can eventually have their license suspended.

// The casinos that genuinely run honest RNGs

If you want a positive heuristic instead of a negative one: casinos that are publicly listed on stock exchanges (Entain, Flutter, Evolution AB, MGM Resorts, DraftKings) have audited financial reporting, real legal teams, and class-action exposure if their RNGs are caught being tuned. The economic incentive structure aligns with honest math. Operators headquartered in their primary licensed jurisdiction (UK casino, UK headquarters; Malta casino, Malta headquarters) are also more constrained — they can be raided. Operators with anonymous ownership, addresses in Cyprus or Belize, and offshore-only licenses face essentially no legal jeopardy from running a tuned RNG. The single most predictive factor of honest play isn't the audit logo — it's whether the operator has a name and a legal address you could serve a subpoena to.

// Related techniques to read next

RNG tampering is rarely the only issue at a problem casino. It tends to pair with False or Hidden RTP variants (running the lowest-paying certified math configuration), Delayed Withdrawals (so any win you do scrape together never reaches your bank), and VIP Host Manipulation (a sales rep working you back into play after a big-loss session). Read those three, then run a clip of your gameplay through our forensic video analyzer — it can flag bonus-frequency anomalies that suggest RNG tuning.

// Frequently asked questions

How do I check if an eCOGRA, iTech Labs, or GLI seal on a casino is real?

Click the seal directly. A real certification links to a verification page on the audit firm's own domain (ecogra.org, itechlabs.com, gaminglabs.com). If the link points back to the casino's own site or nowhere at all, the seal is almost certainly fabricated. As a second step, visit the audit firm's site directly and search their public certified-operator list for the casino's exact brand name.

Is 'provably fair' as good as an independent audit?

Provably fair proves the casino didn't change the random seed mid-game. It does NOT prove the game's RTP matches what the casino advertises, doesn't prove the algorithm computing outcomes from the seeds is honest, and doesn't prove the casino isn't running multiple seed pools to bias new vs. veteran players. Treat 'PF' as one useful signal, not a complete fairness guarantee. An independent audit by eCOGRA, iTech, or GLI is a meaningfully stronger trust signal.

Can a casino's RNG actually be tuned against me?

Technically yes. The RNG algorithm itself is a piece of software the operator installs and can substitute at will. Without an active, recently-renewed audit, there's no external verification that the algorithm in production matches what was certified. Reputable casinos with current audits and Tier-1 licenses are constrained against doing this; offshore operators without audits effectively are not.

What does 'audit lapsed' or 'partial scope audit' mean for me as a player?

Audits are point-in-time and scoped to specific games or game categories. A lapsed audit means the certification expired and was not renewed — the logo can remain but the underlying audit is no longer current. A partial-scope audit means only a subset of games on the site were ever audited; the rest were not. Either way, the protection you thought the logo offered is significantly weaker than you assumed.

Which casinos have the lowest risk of running a rigged RNG?

Publicly listed operators (Entain, Flutter, MGM, DraftKings, Evolution AB), casinos licensed in Tier-1 jurisdictions (UKGC, MGA, SGA), and operators headquartered in the same country as their primary license. These face real legal jeopardy from running tuned RNGs — class actions, license revocation, share-price impact. Anonymously-owned offshore operators with only Curacao or Anjouan licenses face essentially no legal exposure from doing so.