Why accounts rotate
Operators collect deposits through bank accounts, e-money accounts and merchant accounts that are often rented from third parties. When an account is frozen or flagged, it is replaced. In the anonymised composites behind this note, the payment details shown on a single site changed every few days.
Where the details appear
Deposit instructions are published where players can see them: on deposit pages, in support chats, in public channels and on mirror sites that move between domains. We capture these pages as an ordinary visitor would — without opening accounts, making deposits or talking to operators.
Linking one account to the next
A single account number says little on its own. Repeated page layouts, shared payment-gateway pages, the same channel announcing new details, and the same crypto deposit addresses shown next to the bank details let us link successive accounts to one operation. Every link carries a confidence level and the captures it rests on.
What each institution sees
A bank, payment or e-money institution sees only the instruments held at that institution: the account, the typology, the dates it was seen and the sealed captures showing where it was advertised. It never sees other institutions' customers. We do not look up who holds an account; the institution already knows its customer.
Acting on a sighting
The institution decides what to do under its own review and reporting procedures. Timing matters: an account advertised today may receive deposits for only a few days before it is replaced. This note names no institution, site or account, and it describes patterns rather than any single case.