Two risks come up in every discussion of online poker security: software playing hands, and players sharing information. Both are real, both are older than the current worry about them, and both are manageable.
What decides your exposure is not mainly the platform. It is whether the people running your specific game are willing and able to do something when a problem is reported.
What a bot actually looks like
The image of an unbeatable machine is mostly wrong. Strong solver-driven software exists but is expensive to run, and most of what appears in low and mid-stakes pools is far cruder.
What you will notice is behavioural rather than technical. Identical bet sizing in every equivalent spot, with no variation for opponent or board. Response times that never change, including on decisions a human would think about. Sessions of implausible length, eight or ten hours without a break, at the same hours every day. And a strategy that never adapts, no matter how you adjust to it.
Any one of those is weak evidence. Several together, on the same account, over several sessions, is worth reporting.
Collusion is the more common problem
Two or more players sharing hole cards is simpler to arrange than a bot and harder to spot, and at low and mid stakes it is more common.
The visible signs are structural. The same two accounts appearing together at table after table, across days. One player consistently folding when the other shows interest in a pot. Unusual patterns where a player raises into somebody who then re-raises, squeezing the third player between them repeatedly.
Individually these are all things honest players do sometimes. The signal is the pattern across many hands with the same pair of accounts, which is exactly why it is hard to prove from one seat.
Why club apps are a different case
Club apps do not provide hand histories or tracking software. That cuts both ways for security.
It works against detection, since a player cannot pull a database and analyse suspicious pairs. It works for the honest field, since the same absence makes it harder for anyone to build the profiling operations that push recreational players out.
The more important difference is who is responsible. In a large room you report to a support desk and wait. In a club structure the union running your field can remove an account in a day, because it controls membership directly rather than through a policy process.
That is the practical argument for caring which union your club belongs to, and it is covered in our piece on how clubs and unions work.
What you can do
Note the account names when something looks wrong, and note the specific hands rather than the impression. This is the one area where keeping manual notes pays off beyond strategy. A report saying two accounts squeezed you in eleven hands across three sessions is actionable; a report saying a table felt rigged is not.
Change tables while you gather it. There is no obligation to keep playing a game you distrust, and the cost of moving is a minute.
Then send it to your agent rather than posting it in a chat. The agent can escalate inside the union, which is the level where something can actually be done.
What to be sceptical about
Most accusations of bots and collusion are wrong. Running badly for a session produces exactly the feeling that something is rigged, and that feeling is not evidence.
Before concluding anything, check whether the pattern survives across sessions. A player who beat you three times tonight is probably just a player. Two accounts that have appeared together at your table every evening for a week are a different matter.
Being wrong about this is not harmless. Accusations spread, honest players get pushed out, and the pool gets worse for everyone including you.
What this looks like in our clubs
We hold union positions rather than only referring players onward, which means the security question lands on us rather than on somebody we forward a message to.
The practical form that takes: a union can remove a colluding pair or a bot ring from its fields quickly, because membership is controlled directly. A club with no standing inside its union can report a problem and then wait, which is a materially different experience for the player who reported it.
This is one of the reasons we tell players to ask which union a club belongs to before joining, and to ask what happens when something goes wrong. Those two questions tell you more about a club than any advertised rakeback percentage.
Frequently asked questions
How common are bots in online poker?
Less common than accusations suggest, and more common than operators like to admit. Sophisticated software is expensive to run, so what appears at low and mid stakes is usually crude and behaviourally obvious over several sessions.
How do I recognise a bot?
Identical sizing in equivalent spots, unchanging response times, implausibly long sessions at fixed hours, and a strategy that never adapts to yours. Look for several of those together rather than any one.
What does collusion look like?
The same accounts appearing together repeatedly, one folding whenever the other enters a pot, and repeated squeezes that trap a third player between them. The pattern across many hands is the evidence, not any single hand.
Is it safer to play in a big room or a club?
They fail differently. A room has formal processes and slower responses; a club has direct control over membership and can act faster, provided the union running it is willing to. Ask what happens when something is reported.
What should I do if I suspect something?
Note the account names and specific hands, change tables, and send it to your agent rather than a public chat. Detail makes a report actionable; impressions do not.
Where to start
If a table feels wrong, leave it and write down why in specific terms. If the same names produce the same feeling next week, you have something worth reporting rather than a bad night.
To ask how security is handled in the clubs we run, message @supremaunion, or read how the structure works across the apps we hold unions in.
18+. Play within your means.