I found a way someone could drain our prize pool without ever depositing a cent

Ehugapy is a skill-based games platform with real cash prizes — pooled entry fees, winner takes the pot. Today I found a hole in that model I hadn't considered.

New accounts get a small free bonus + free first play. Nothing wild on its own. But: create 3 fake accounts, each gets that free bonus, use it to hit the minimum-player threshold that unlocks a round's payout — and now you can win real money that was pooled from real depositors, having deposited nothing yourself.

Nobody had exploited it (yet), but the path was there, and once I saw it I couldn't unsee it.

Fixed the most exploitable piece today (phone number now required + unique per account — ties identity to the same number people already use to cash out). Doesn't kill multi-accounting entirely, but it kills the 'infinite free accounts in 2 minutes' version of it.

Anyone else running anything with pooled/shared prizes — how paranoid do you have to get about this stuff before it's actually a problem, vs. before someone finds it?