Guardian AI for iGaming
The first cross-operator player intelligence network built for Mexico's regulated gaming market.
1. Executive Summary
Guardian AI is Tonder's proprietary fraud intelligence engine, purpose-built to protect iGaming transactions across Mexico's regulated gaming ecosystem. Unlike generic fraud tools that treat gaming as just another vertical, Guardian was designed from the ground up to understand the unique patterns of player deposits, withdrawals, bonus cycles, and multi-operator behavior.
At its core, Guardian serves a dual purpose: it is both a real-time pre-authorization fraud shield and a long-term player intelligence network. Every transaction processed through Tonder feeds Guardian's cross-operator intelligence, creating a compounding network effect where each new operator makes the system smarter for every other operator on the platform.
Coverage
SEGOB-regulated
operators
Transactions
Millions
monthly
Operators
Dozens
active gaming
Position
Leading
gaming processor in MX
2. The iGaming Fraud Landscape in Mexico
Mexico's iGaming market operates under SEGOB regulation with a growing number of licensed operators. This rapid growth creates a complex fraud landscape that generic payment processors are not equipped to handle.
Why Generic Fraud Tools Fail in iGaming
Unpredictable deposit velocity
A legitimate player may deposit 10 times in a single session during a live sports event. Generic velocity rules would flag this as suspicious, but in gaming it's normal.
Asymmetric deposit-to-withdrawal ratios
Players deposit frequently in small amounts and withdraw less frequently in larger amounts. Standard e-commerce fraud models don't account for this.
Multi-operator players are the norm
A single player may be active across 5–10 operators simultaneously. Without cross-operator visibility, each operator sees only a fragment.
Systemic bonus abuse
Professional bonus abusers create multiple accounts across operators, exploit welcome bonuses, and extract value through coordinated patterns.
Money mule networks target gaming
Gaming platforms are attractive for laundering because deposits and withdrawals can be framed as legitimate gaming activity.
Fraud Types Guardian Addresses
3. How Guardian AI Works
Guardian operates as a three-phase intelligence system that wraps around every card transaction processed through Tonder. Each phase builds on the previous one, creating a layered defense that gets smarter with every transaction.
Pre-Authorization
200+ signals analyzed in milliseconds
Smart Routing
Tokenization, intelligent routing, retry optimization
Post-Auth Monitoring
Continuous monitoring, model retraining
Phase 1: Pre-Authorization (Real-Time)
When a player initiates a card deposit at any operator on Tonder's platform, Guardian intercepts the transaction before it reaches the bank. The entire evaluation happens in milliseconds.
Signal Collection — 200+ risk signals per transaction:
BIN, issuer, brand, country of issuance, card type
Fingerprint, device ID, browser/OS, screen resolution
IP address, ASN, VPN/proxy detection, geolocation
Velocity, amount patterns, time-of-day, session behavior
Cross-operator history, previous scores, chargeback history, KYC
Blacklist lookup (blocked cards, flagged devices) + whitelist lookup
Risk Score Thresholds:
Score 0 – 29
Pass through without 3DS 2.0. Transaction proceeds directly to bank authorization.
Frictionless. Player deposits instantly.
Score 30 – 79
Pass through with 3DS 2.0 challenge. Player authentication required before processing.
Minimal friction. Player completes OTP or biometric.
Score 80 – 100
Auto-block. Transaction declined immediately. Card/device may be added to blacklist.
Transaction rejected. No bank call made.
Phase 2: Smart Routing & Authorization
Once a transaction passes Guardian's pre-authorization checks (GREEN or YELLOW), it enters Tonder's secure processing pipeline:
Secure Tokenization
Card data tokenized through a PCI-DSS compliant vault. Sensitive payment information is never exposed during processing.
Intelligent Routing
Transaction routed through the optimal banking partner based on card brand, BIN, amount, and merchant category — with automatic fallback rules.
Bank Authorization
Transaction sent to selected bank. If declined with a recoverable error, Tonder automatically retries through an alternative partner.
Retry Optimization
If 3DS was already completed, it is never repeated on retry. Routing decisions optimized per BIN and issuer to maximize approval rates.
Phase 3: Post-Authorization Monitoring
Guardian's intelligence doesn't stop at authorization. Every successful deposit enters a continuous monitoring pipeline that feeds back into the scoring engine.
Velocity Monitoring
Tracks deposit frequency, amount escalation, and session-level patterns. Triggers dynamic session limits.
Collusion Ring Detection
Identifies networks of accounts with coordinated behavior — same device, overlapping IPs, correlated timing.
Bonus Abuse Detection
Flags players depositing minimum qualifying amounts across multiple operators to exploit welcome bonuses.
Money Mule Detection
Detects accounts that receive deposits and rapidly withdraw with minimal gaming activity.
Dynamic Limits
When anomalies are detected, Guardian applies dynamic deposit limits or locks sessions pending review.
Model Retraining
ML models retrained weekly using latest outcomes, chargeback data, and confirmed fraud cases.
4. The Network Effect: Guardian as a Player Credit Bureau
This is Guardian's most powerful differentiator and Tonder's deepest moat. Because Tonder processes payments for a significant share of SEGOB-regulated gaming operators, Guardian has unprecedented cross-operator visibility — transforming it into a “buró de crédito de jugadores” for Mexico's gaming ecosystem.
Multi-Operator Player Identification
When a player deposits at Operator A, Guardian has visibility into their deposit history at Operators B, C, and D. A fraudster flagged at one operator is immediately flagged across the entire network.
Cross-Operator Behavioral Patterns
Guardian detects patterns no single operator could see alone — like a player depositing at 8 operators on the same day using different cards but the same device.
Dynamic Player Scoring
A player's risk score is not static. It evolves based on their behavior across all operators, creating a comprehensive reputation profile.
Ecosystem-Wide Blacklists
When a card, device, or player is confirmed as fraudulent, that intelligence is immediately available to every operator on the network.
The Compounding Flywheel
5. Key Takeaways
Purpose-built for iGaming.
Guardian understands deposit velocity during live events, bonus cycles, multi-operator players, and every pattern unique to the industry — something generic fraud tools simply cannot do.
The network effect makes everyone safer.
Every operator on Tonder's network makes Guardian smarter. Your fraud intelligence improves simply because you're part of the largest gaming payment network in Mexico.
Intelligent friction, not blanket friction.
Three risk thresholds: GREEN (frictionless), YELLOW (3DS challenge), RED (auto-block). Low-risk players deposit instantly. Only suspicious transactions face additional verification.
End-to-end intelligence, not a bolt-on.
Guardian is deeply integrated into Tonder's payment infrastructure — from routing decisions to retry logic to post-transaction monitoring.
Building toward a player credit bureau.
The long-term vision is Guardian as the definitive source of player risk intelligence in Mexico's regulated gaming market — a "buró de crédito de jugadores" that benefits every operator.
Ready to protect your gaming platform?
Activate Guardian AI and join the largest gaming payment network in Mexico.