Sheep To Be Shorn
In Warsaw, the statute meant to keep Polish consumers out of offshore casinos has become the casinos’ most loyal collaborator. In 2009, Poland adopted a piece of legislation designed to protect Polish consumers from illegal online gambling. Fifteen years on, the law has revealed an interesting aspect of itself. It does the opposite. It protects illegal online casinos from Polish consumers.
The hinge of the paradox can be drawn in a single line. A consumer who loses money to an unlicensed operator — through a confiscated balance, a withheld withdrawal, a fictitious “administrative fee” — is himself liable, under Article 107 § 2 of Poland’s Penal Fiscal Code, for the bare fact of having played a foreign gambling game on Polish soil. A construction designed as a tool of prevention has become, for the operators, an instrument of retention finer than anything their own lawyers could have drafted. A victim who cannot come forward is an ideal victim. He can be robbed in full knowledge that he will not complain — because he fears the fine from the Polish revenue service more than he resents the loss of forty thousand zloty.
This is not a side effect of imperfect legislation. It is a product. The ecosystem of unlicensed operators — casinos licensed in Curaçao, in the Comorian sub-jurisdiction of Anjouan, in Costa Rica, in Kahnawake — has organized itself around this peculiarly Polish regulatory feature with the unobtrusive thoroughness of contractors who know the building code in seven languages. The ecosystem has at least six layers, each of which earns on every link in the chain and each of which independently maintains that it is responsible for nothing. The first layer is the operator itself, which deploys what its consumer-protection critics call selective scamming — the targeted confiscation of winnings above a defined threshold — not as the conduct of a bad actor but as a line item in the business model. The second is the retention department, which spends six to twenty weeks working psychologically on each player, cultivating a relationship of trust that it later collects on. The third is a specialized payment infrastructure that routes money through three to five jurisdictions in such a way that, at the end of the chain, nobody is accountable. The fourth, fifth, and sixth — the affiliate network, the reputation-management firms quietly weaponizing the D.M.C.A., the mediation portals that double as gatekeepers and salesmen — maintain the operator’s visibility in Google and the invisibility of its victims. Everybody knows what is being serviced. Nobody is liable.
What follows is an account of this ecosystem, layer by layer. The argument is straightforward: as long as the Polish justice system aims its instruments of coercion at the consumer instead of at the enablers, the economics of the sector will keep functioning as designed. This is not an argument against gambling. It is an argument against a structure in which the Polish consumer is the only party in the chain who bears the risk.
I. The Trap
Polish gambling law is restrictive in a way that most Polish online gamblers do not learn about until it touches them personally. Online casinos in Poland may be operated only by Totalizator Sportowy — a state-owned company that runs the lottery and, in recent years, a single sanctioned online casino. Every other operator, whether licensed in Malta, Gibraltar, Curaçao, or under the fictitious arrangements of Anjouan, is illegal with respect to Polish consumers. This much is widely known. The second half of the equation is not.
Article 107 § 2 of the Penal Fiscal Code — the statute, technically a criminal one, that polices the tax-related aspects of certain offenses — provides that any person who, on the territory of the Republic of Poland, participates in a foreign gambling game is subject to a fine of up to one hundred and twenty daily rates. This is not a penalty for breaching a state revenue monopoly. It is criminalization per se: the bare act of logging in to a foreign domain from a Polish I.P. address, of making a deposit, of spinning a slot. The standard commentary on the article by Leszek Wilk, a fixture of Polish penal-fiscal practice, makes the point without ornament: the unlawfulness of the gambler’s act derives from the bare fact of its criminalization.
From the perspective of a victim who has just lost the equivalent of ten or twelve thousand dollars to a manual deduction posted in his account history, this construction produces a precisely inverted moral situation. A player who wishes to report a fraud must first confess, to a Polish prosecutor, to a fraud-adjacent crime of his own. The mechanism is layered on top of the well-documented stigmatization of gambling as a barrier to disclosure — global meta-analyses suggest that only about twenty per cent of people with a gambling problem ever seek help, with stigma a powerful independent predictor of silence. The Polish peculiarity is that on top of the universal stigma sits an actual criminal sanction, raising the threshold of disclosure to a level not comparable to jurisdictions where the consumer is a victim rather than a perpetrator. The Polish revenue service does not publish statistics on how often it has actually brought a charge against an end-stage player rather than an operator. The deterrent effect can be argued analytically; it cannot be quantified, because the necessary data is locked inside a state agency that has no interest in releasing it.
The result is that Polish players, from the operator’s perspective — to borrow an image from the industry’s own internal slang — are sheep to be shorn. They can be emotionally worked up. They can be coached, by helpful chat agents, on how to circumvent the bank’s gambling blocks. They can have their winnings confiscated. And one can know, with a kind of actuarial certainty, that they will not complain — because they fear the fine more than they regret the loss.
II. Selective Scamming as a Business Model
There is a term in the literature for what happens to these players, though the Polish legal commentariat has yet to absorb it. In the cybersecurity world, “selective scamming” originally described a dark-web vendor who delivered to most customers and robbed a chosen few. Eastern European consumer-protection writers have extended the term to its more lucrative cousin in the licensed-but-grey-market online casino industry. The extension is accurate — and it carries with it a further claim that the consumer literature has not quite been willing to make out loud.
Selective scamming is not a pathology of this sector. Selective scamming is this sector. It is the principal revenue model of a substantial portion — probably the majority — of online casinos licensed in Curaçao, Anjouan, Costa Rica, and Kahnawake. Not the deviation of a single bad operator. A structural feature of the product. The claim warrants a qualification: it applies to grey-market operators in jurisdictions with weak or fictitious supervision. It does not extend to operators in jurisdictions whose regulators actually function — Malta, Gibraltar, the United Kingdom, Sweden — where the balance-confiscation maneuver carries the practical risk of license loss and is therefore disused. What is being described is an analytical thesis about the offshore segment, reconstructed from publicly available estimates of the segment’s cost structure. The operators’ internal documents, which would settle the matter empirically, are not available in the academic literature.
Why the arithmetic forces it
The numbers are the engine of the analysis. According to circulating industry estimates — not independently audited — an online casino with a Curaçao license pays between two hundred and four hundred thousand euros annually for the license itself plus its structural overhead. It pays between twenty and forty per cent of revenue in affiliate commissions. It pays between five and twelve per cent of transaction value to the payment processors that handle deposits from Polish cards and Polish BLIK (the country’s ubiquitous instant-payment system, more or less Poland’s answer to Venmo). It pays game providers like Pragmatic Play, Amatic, and Endorphina another twelve to eighteen per cent of revenue. There is hosting, support, marketing, the periodic resurrection of domains after Polish authorities have blocked them, legal services in three jurisdictions, and a security budget calibrated to the assumption that someone, somewhere, is always trying to break in.
After all that, the acquisition cost of a typical Polish player drawn through SEO advertising is somewhere between four hundred and eight hundred euros, before the first deposit clears. For that player merely to repay the cost of his own acquisition, he has to lose several thousand euros net. Under any normal distribution of outcomes — some players win and withdraw, some lose everything, most end near zero — the operator does not recover its costs. It goes bankrupt in its second or third year.
Selective scamming is a mathematical condition of the model’s survival. The operator has to generate, somewhere, an additional ten to twenty per cent of margin that R.T.P. arithmetic does not supply. It does so by confiscating winnings above a calibrated threshold. The threshold is set so that the great majority of users never cross it and never notice anything is wrong, while the few who do supply enough capital to fund the acquisition of all the others. The unattractive consequence — for the model and for any moral accounting of it — is that the most exposed player is not the addict who loses everything, the figure most legible to the public conscience. The most exposed player is the careful one. The one who plays within a budget, sometimes wins, and tries to take the money out. That player is a net loss to the operator if the system functions honestly. He is the player the operator has to rob in order for the model to close at all.
III. How the Player Is Worked
Between the moment a Polish consumer notices the first Google advertisement for an unlicensed casino and the moment his balance is confiscated as an “administrative fee,” somewhere between six and twenty weeks of manipulation unspools. The labor does not perform itself. It is delivered by a specialized retention department, in real time, by humans and by algorithm, working from scripts that have been refined on tens of thousands of previous players. A case that came into our firm in May of 2026 — a client whom, for the sake of the narrative, we will call Tomasz — makes the work legible phase by phase.
Acquisition: the money that doesn’t exist
The first contact is always a number. The advertisements that show up to a Polish Google user promise a welcome package of ten thousand zloty plus five hundred free spins. “Activate code VOXMAX and claim up to 10,000 PLN.” “No-deposit bonus — enter code NO-DEP-VOX.” A table of “best codes” spread across four, five, seven separate SEO pages, each recommending the same casino, each with its own promotional code and its own variation on the headline (“Vox Casino Promo Code 2026 — up to 250 Free Spins,” “Vox Casino Poland — Official Bonus Page,” “Vox Casino Promo Code — No Deposit Bonus”), so that whichever search the Polish user runs, the figure ten thousand lands on the retina.
The money doesn’t exist in the sense the player understands it. A welcome bonus of a hundred and twenty-five per cent with a wagering requirement of thirty-five times means that the player who has just been given five hundred euros must wager seventeen and a half thousand euros before withdrawing anything. On a slot with a nominal R.T.P. of ninety-six per cent, the expected loss on that volume of play is seven hundred euros. The bonus the player has just received is not free. It is, in the average case, a structured instrument for extracting more than it provides. None of the advertisements visible in the Google index performs the arithmetic.
The reviews on pseudo-independent industry portals repeat the message. “Vox Casino offers a deep game library, generous bonuses, and quick withdrawals.” “Attractive loyalty promotions.” “Friendly customer service.” “If you’re looking for a licensed casino that prioritizes player satisfaction.” Each of these sentences has been engineered to survive a lawyer’s reading and to produce, in the lay reader, an impression that no lawyer would call false. “A license from an international regulatory body” is, in the strictest sense, accurate — Curaçao does issue licenses — but it produces in the reader the impression of something that Curaçao is not. “Prioritizes player satisfaction” is a phrase from which no party in interest can demand anything specific, which is why it appears.
The Agent: Wojtek, Oliwia and others
After registration, the second layer activates. A live chat opens immediately, staffed by a “consultant” with a first name and a photograph. Wojtek. Oliwia. Anna. Marek. The names are Polish, the language is Polish, the conventions are those of a Polish office. “Welcome, sir.” “One moment — let me check on that.” “Thank you for your patience.” This produces an impression that the Polish player does not, at first, interrogate: that on the other end of the line sits a person in a Polish call center, presumably in Warsaw, presumably subject to the relevant Polish regulator.
The consultant is in fact most often in Tbilisi or Limassol, juggles seven to twelve conversations at a time, follows a script keyed to specific situations (“player asks about a withdrawal,” “player deposited but the game didn’t load,” “player won above threshold X,” “player asks about licensing”), and has access to a C.R.M. dashboard that displays the entire history of the account in real time: how much he has deposited, how much he has lost, when he last played, which games he favors, which bonus he responded to, whether the gambling block on his Polish bank card is engaged, whether his card has expired. Empirical studies document that online operators hold detailed behavioral data on every player, that the C.R.M. enables personalized real-time messaging, and that the tooling is, in published research, observed to be aimed at problem players or players who have just suffered a loss. The asymmetry of information is the load-bearing wall of everything that follows.
The consultant congratulates the first deposit. Welcomes the player to the club. If the player deposited above the minimum, additional spins arrive, framed as a personal gift “from my own budget, sir, just for you.” If the player wins, Wojtek sends a flame emoji and asks what Tomasz plans to spend the winnings on. If the player loses, a reactivation bonus appears within the hour. “I see today didn’t go your way, but I have something special for you — a fifty per cent boost on your next deposit, valid for twenty-four hours.” The player who has just lost three thousand zloty is, psychologically, at maximum vulnerability, and the operator knows, with the precision of a behavioral A/B test, exactly when to send the message.
The Coaching: how to get around
Polish banks, in response to a rising tide of social problems associated with online gambling, have over the past several years introduced mechanisms for blocking gambling transactions. PKO, Pekao, Santander, ING, mBank — each lets the cardholder turn on a “gambling” category block, after which every transaction tagged with merchant-category code 7995 is automatically declined. The tool is designed to protect the problem gambler from himself.
When the block engages on Tomasz’s account, the chat lights up at once. Wojtek again. “Did your card get declined? Don’t worry. We have alternative methods that will allow this transaction to complete. Try Revolut — they don’t block our payments. Or BLIK — just enter the code on our page and confirm in your banking app. Or, if you’d prefer something faster, we can handle the payment in cryptocurrency — just purchase some USDT on exchange X, and I’ll walk you through it step by step.”
Each of those sentences is at once a helping hand and a snare. A helping hand because it shows the player a way around the block. A snare because each of those routes is a way around a regulatory protection put in place precisely to prevent participation in illegal gambling. The Polish prosecutor who later contemplates charging the player under Article 107 § 2 finds, in the player’s chat history, a written record of the player consciously working around safeguards. The consultant, by then, is in Tbilisi and beyond any plausible reach of Polish law. The player is alone with the evidence against himself.
The Bonuses: an architecture of attachment
The third layer is the bonus structure. First-deposit bonus. Second-deposit bonus. Third. Fourth. A “Magic Bonus” unlocked after the fifth deposit. A weekly cashback for players who have reached the “Experienced” tier or higher, credited every Friday between 6:00 and 7:00 A.M. UTC — hours chosen, surely by accident, in such a way that the player must wait for a specific moment in the morning to receive the notification.
There is a loyalty program in three tiers. VIP Gold — three thousand euros in cumulative deposits. VIP Platinum — six thousand. VIP Diamond — twelve thousand. Each tier brings expedited withdrawals, a dedicated account manager, a unique avatar and account skin. A player who has reached twenty-five hundred euros in deposits receives a chat from Wojtek: “You’re only five hundred euros away from VIP Gold status, sir. Early access to new games and exclusive tournaments are waiting.” A bonus that does not yet exist — because it won’t be offered until the player puts down the next five hundred — becomes the engine for a deposit the player would not, in another context, make.
None of this is accidental. It is the product of decades of behavioral research conducted by the R&D departments of game providers and C.R.M. platforms. Slot machines are designed with near-miss patterns — a loss visually structured to look like a near-win, an effect supported by the dominant scientific consensus, though the literature is not unanimous; an experimental study by Strickland and colleagues failed to reproduce the reinforcement effect on operant response frequency, which suggests the mechanism is real but more nuanced than the standard account allows. There are losses disguised as wins — the player gets the visual and auditory feedback of victory for a payout smaller than his own stake; in a study on a sample of nine hundred and forty subjects, participants exposed to L.D.W.-designed games overestimated their actual wins, and EEG studies show a reward-positivity event-related potential after an L.D.W. identical to the one after a real win. There is variable-ratio reinforcement — rewards arriving at unpredictable intervals, the classic schedule from B. F. Skinner’s reinforcement experiments, the schedule that produces behavior the most resistant to extinction of any thus far measured. The bonuses are calibrated against expected value such that the player, on average, loses, while subjectively feeling that he “nearly won.” The consultant’s communications are tuned to the moment of maximum psychological vulnerability — which is to say, immediately after a loss.
The Threshold
All of this produces a player who has reached the threshold. On the day Tomasz filed a request to withdraw the entire balance of his account, a line appeared in his transaction history that had never been there before.
Administrative fee. Status: Successful.
The figure matched the balance of winnings Tomasz had tried to withdraw down to the penny. No such fee existed anywhere in the casino’s terms and conditions. When Tomasz asked the customer-service representative why a transaction in which he had received no money could possibly be designated successful, the same Wojtek — or another consultant working from the same script — replied that the club’s specialists had reviewed his account and identified irregular play. “We are not obligated,” he added, “to disclose every loophole that could be used to violate the rules of the club.” When Tomasz pressed for specifics — which game, which loophole, which moment — he was told that, if he continued to ask, the casino would automatically report him to the police for attempted fraud.
The same channel through which warmth and congratulation and emoji had flowed for six weeks had become, in a single afternoon, a channel of intimidation. Tomasz, who had treated Wojtek as someone he sort of knew, received the message that he would be reported to the police.
And then the cashback. After the confiscation, a balance labeled “cashback” appeared in Tomasz’s account. The consultant wrote that the money would “pay out on Friday.” The cashback came, of course, with conditions — a wagering requirement of three times before any withdrawal could occur, so that no actual payout would have materialized. This is the retention mechanism in its purest form. The operator understands that the player who has just lost forty thousand zloty is in a psychological state in which anything resembling a chance of recovery operates with disproportionate force on his judgment. The cashback is a small bright object dangled, with calculated insouciance, in front of a man who has just been robbed.
From the operator’s perspective, this is the cheapest and most scalable layer in the whole chain. A consultant in Tbilisi costs six to twelve hundred euros a month and handles thousands of players. The C.R.M. remembers everything. The scripts are refined through A/B testing — which phrasing produces a higher retention rate, which most reliably converts a player after a first loss.
From the player’s perspective, this layer is what converts an objective fraud into a subjective sense of personal failure. The first reaction was not rage. The first reaction was to wonder what he had done wrong. Had he accidentally exploited some loophole in some game? Was the consultant telling the truth? The operator had invested six weeks in the cultivation of a relationship of trust precisely so that, in the moment of confiscation, the player would interpret the event through the lens of that relationship. So that he would think: Wojtek knows me, Wojtek wouldn’t lie without a reason, so I must have done something wrong.
The Analogy
This is, at first glance, the dynamic that psychologists describe in patterns of intimate-partner manipulation involving abuse. Lenore Walker’s classic 1979 model of the cycle of violence identifies four phases: tension building, the explosion, reconciliation (the so-called honeymoon phase, in which contemporary clinicians have come to detect the techniques of love bombing), and calm — with the honeymoon phase doing the central work of forging the emotional bonds that make it impossible for the victim to leave. The structure is the same. A long phase of relationship-building and affection. A sudden pivot in which the victim is told: this is your fault. The connection to the earlier phase makes the victim believe it.
The analogy is heuristically apt — it helps a reader recognize the mechanism in categories he already knows intuitively. The more precise criminological reference, however, is the romance scam, and in particular the variant the Chinese-language press calls pig butchering — sha zhu pan: the prolonged scheme in which a perpetrator spends weeks or months building a fictitious relationship of trust on a dating site or messaging app, leads the victim onto a fraudulent investment or gambling platform, lets her see her first small gains, and then takes everything. The romance-scam literature documents the sequence with notable precision: staged trust-building, fraudulent platform, total loss. The difference between pig butchering and the case we are describing comes down to the fact that, in the online-casino version, the platform already exists — the operator is in Curaçao, with a real license number that can be printed in court — and requires no simulation. The rest of the mechanics, including the trust-building phase, the early small payout, the moment in which the tone of the communication shifts, are reproduced by the same template. Not every player walks into the trap. But enough do for the model to close.
IV. The Infrastructure
None of this works without an infrastructure that pushes the money through the European financial system. This is the layer the Polish reader generally doesn’t see, because from his vantage point he “pays with BLIK” and “receives a wire to Revolut.” Underneath that ease sits a specialized ecosystem of at least twenty distinct kinds of entity, each of which earns on every transaction and each of which has its own narrow compliance alibi.
The story of a single BLIK deposit
A Polish player enters a BLIK code on the casino’s page and deposits a hundred zloty. What happens next is complicated in a way that is not accidental. The complexity is functional. Each link in the chain dilutes the connection between the original transaction (a Polish consumer pays an unlicensed casino) and the final recipient (an operator in Curaçao).
The casino’s website doesn’t have its own integration with BLIK. BLIK serves only Polish banks and Polish merchants holding the relevant agreements. The casino uses a payment service provider, which integrates BLIK as one of the payment options in its checkout. The P.S.P. is not called “casino.” It is called, for instance, a Cypriot or Maltese company whose name suggests e-commerce and which officially provides “platform services for high-risk industries.” The P.S.P. takes a commission from the casino of between five and twelve per cent.
The P.S.P. does not handle BLIK directly. It has agreements with payment aggregators — most often in Lithuania, Latvia, or Estonia — holding payment-institution licenses from their respective central banks and accredited with the relevant domestic payment operators. A Lithuanian aggregator has an agreement with a Polish acquirer (often part of an international group such as Worldpay, Adyen, or Nuvei), which holds direct integrations with BLIK and the Polish card networks.
The Polish acquirer sees the transaction as “payment to a Lithuanian payment aggregator,” with a generic descriptor on the order of “e-commerce purchase” or “digital services.” The Lithuanian aggregator sees the transaction as “payout to a P.S.P. in Cyprus,” descriptor “platform services.” The P.S.P. in Cyprus sees the transaction as “commission from operator in Curaçao” or “payout to beneficial owner.” Each link sees a different description, in a different country, in a different currency, under a different merchant-category code. When the Polish revenue service wishes to establish that “X PLN deposited from a Polish BLIK reached an unlicensed casino,” it has to traverse at least three jurisdictions and at least four independent entities, each of which is entitled to answer only as to its own slice of the chain.
The architecture did not arise by accident. It required decades of investment by the gambling industry in payment-routing infrastructure. Industry conferences in Cyprus and Malta (SiGMA, iGB) are half devoted, in any given year, to precisely this — networking between operators and payment specialists. There are specialized consulting firms whose entire business model is helping gambling operators find “banking solutions,” a term of art in the trade that means processors willing to accept their money despite the absence of a license in the consumer’s jurisdiction. Lithuania is the limit case. Since 2017, when the United Kingdom left the European Union, the Bank of Lithuania has pursued a policy of liberal E.M.I. licensing under the banner of becoming a “payment fintech hub.” The number of licensed payment institutions registered in Lithuania has risen from a dozen-odd to more than a hundred and fifty in the space of six years. Most of them serve legitimate businesses. A meaningful minority — estimated at thirty to fifty institutions — service the lines of business no European bank will touch: unlicensed online casinos, forex brokers registered in St. Vincent and the Grenadines, the adult-entertainment sector, K.Y.C.-free crypto, the prescription-drug grey market.
Knowledge in the chain
The crucial observation about this infrastructure is also the simplest. Every link in the chain knows. The casino’s name is in the domain, in the transfer descriptions, in the transaction memos. The Polish-language user interface is on the site, in the chat, in the correspondence. The volumes coming off Polish cards are in the transaction data. The IP addresses of Polish consumers are in the logs. There is not a single link in this chain that does not, in fact, know that it is servicing an unlicensed casino targeting the Polish market. They all know.
What there isn’t, in this chain, is a link with a motive to act on the knowledge. Each entity collects a commission on each transaction. Each entity has a compliance alibi, drafted by lawyers in its home jurisdiction, resting on the technical observation that it services only the payment transaction and is not responsible for the economic substance of the contract between service provider (the casino) and consumer. The mechanism by which responsibility gets diffused across a many-link chain is among the most thoroughly studied phenomena in social psychology: neuroscientific work on diffusion of responsibility shows that the mere presence of other potentially responsible agents reduces the subjective sense of one’s own agency and impairs the internal monitoring of outcomes. Each entity also knows that, in the event of trouble, it can always pick up the phone, call the next link in the chain, and explain that the next link is where the stop should have been.
V. Advertising, Mediation, and the D.M.C.A.
Around this payment infrastructure other layers of enablement have grown up. The affiliate network and the wider SEO advertising ecosystem. Each affiliate site earns via revenue share — typically twenty-five to fifty per cent of the player’s long-term losses — or via C.P.A., a flat fee of fifty to two hundred euros per player who deposits at least twenty. Every zloty Tomasz deposited was a zloty on which an affiliate had collected its commission. The affiliate does not ask the operator whether the operator intends to honor withdrawals. The affiliate asks only what the revenue share is. Research on wagering affiliates documents that affiliates are systemically incentivized to target high-loss-potential players and to engage in deceptive practices designed to maximize conversion for the operator.
Then there are the reputation-management firms. At the bottom of the Google results page for a typical operator, a small line of grey text appears: “In response to multiple complaints we received under the U.S. Digital Millennium Copyright Act, we have removed three results from this page.” The D.M.C.A., enacted in 1998 to police copyright infringement on the Internet, has been converted into a reputation-management tool with the same casual ingenuity that the Internet has applied to almost every other piece of legislation written before broadband. The operator’s lawyers file mass takedown notices alleging copyright infringement in unfavorable reviews. Google, operating under the statute’s safe-harbor provisions, removes the results without independent review. The reputation-management firms charge between five hundred and five thousand dollars per takedown. Google has won at least one default judgment in California against parties who industrialized this abuse, but the scale of the practice substantially outpaces the scale of the response.
And there are the mediators. Casino.guru, the most prominent of them, returned roughly $5.3 million to players in the first quarter of 2026 through successfully mediated complaints. It is also an affiliate portal earning a revenue share from many of the same operators whose conduct it ostensibly monitors. Whether the conflict of interest translates into preferential treatment of paying operators in complaint adjudication is, in the absence of an internal leak, structurally plausible but empirically unproved. From the consumer’s perspective, however, the observation suffices: the portal is, at once, the gatekeeper and the salesman of the same industry.
Then Trustpilot and its clones. Fabricated profiles with twenty-eight reviews averaging 4.1 stars. Bots writing in the small hours. Paid reviewers from micro-task platforms. Stock photographs of authors. Each element has its own narrow business rationale and its own narrow moral alibi.
VI. Where the Punishment Belongs
From the standpoint of Polish criminal law, this entire chain — the operator, the consultant in Tbilisi, the retention department, the ten entities of the payment infrastructure, the affiliate network, the mediation portal, the network of fake Trustpilot reviews, the reputation-management firms abusing the D.M.C.A. — remains essentially untouched. What is prosecuted is the player.
One can imagine a system in which the Polish (and European) justice apparatus would aim its instruments of coercion where they are, economically and logically, owed. One can imagine it. As of the present writing, one does not have it.
The first change that would matter would be the decriminalization of a Polish consumer’s participation in a foreign gambling game. Article 107 § 2 is a relic of an architecture in which online gambling did not exist and in which the state defended its fiscal monopoly by criminalizing the individual participant. In the world of 2026, the provision protects no one but the operators themselves — because it manufactures the conditions under which the victim cannot come forward.
The second change — and the most consequential one, from the perspective of the economics of the entire sector — would be real liability for the payment infrastructure. The instruments exist. Directive 2018/1673, known as 6AMLD, provides sanctions for payment institutions that knowingly service transactions deriving from illegal activity, extends criminal liability for money laundering to legal persons, and strengthens the prosecution of aiding and abetting. A single referral to the Lithuanian financial supervisor concerning one specific E.M.I. servicing a Polish casino could potentially block dozens of operators at once, because many of them use the same E.M.I.s.
The third change would be liability for advertisers. An affiliate network that collects a revenue share from an operator targeting Polish consumers without a Polish license is a party deriving financial benefit from a prohibited act. Article 29 of the Polish Gambling Act forbids the advertisement of gambling in the Polish language. Enforcement against Polish affiliates promoting unlicensed casinos is, to put it gently, sporadic. Enforcement against foreign affiliates is essentially nil, despite the fact that the Brussels I bis Regulation permits Polish consumers to sue them in Polish courts.
The fourth change would address the manipulation layer itself. Polish criminal law recognizes the concept of grooming — Article 200a, oriented to the protection of minors — as a category of offense centered on the systematic cultivation of trust for the purpose of exploiting the victim. The equivalent legal construction for digital consumer manipulation, in which an operator systematically cultivates trust with an adult player in order to confiscate his balance more effectively at a defined moment, does not exist in Polish law. There is no reason that it shouldn’t. The point isn’t to extend Article 200a automatically — that provision is reserved for minors, and properly so — but to construct an analogous category for the digital adult consumer. The consultant who coaches a player on how to circumvent a banking block is an accessory to the player’s own offense under Article 107 § 2, but he is also — and this is the more important framing — a participant in a designed fraudulent scheme under Article 286 § 1 of the Penal Code, the ordinary criminal statute against fraud. The Polish prosecution service has not, to date, advanced this characterization.
None of these changes will restore to victims what they have lost. But each of them, in combination, would begin to shift the burden of punishment from the point at which it is absurd (the victim) toward the points at which it is logical (the enablers, who collect a margin at every link in the chain).
Epilogue
From the operator’s perspective, every operation of the kind described concludes successfully. From the perspective of the consultant in Tbilisi, who performed weeks of grooming labor to the script and received his retention bonus accordingly — successfully. From the perspective of the Lithuanian payment processor, the Cypriot P.S.P., the Polish acquirer, the affiliate, the mediation portal — successfully. From the player’s own perspective, the operation also concluded successfully. Successfully in the way that any well-executed industrial process of value extraction is successful — as designed, with margin, and with the clear conscience of every participant.
Selective scamming is not a market failure. It is the market’s principal product. It is what makes the economic existence of the offshore-casino segment of Curaçao, Anjouan, and the rest possible. Without the targeted confiscation of winnings above a threshold, the segment does not, arithmetically, close. With it, the segment closes — and at a very high margin, which then finances the entire payment, advertising, legal, reputational, and, perhaps most importantly, psychological infrastructure that keeps the segment in motion. The Wojteks in Tbilisi who write to Polish players to tell them they are in the club, and to suggest a way around the bank’s blocks, are as essential a component of the product as the slot with R.T.P. ninety-six per cent.
As long as the Polish justice system prosecutes the consumer instead of the operator, the consultant, the processor, the affiliate, the acquirer, the E.M.I., the P.S.P., and the advertiser who together brought him to the point of his loss — and all of them knew — there will be more victims. These are the conditions we have built. These are the sheep we have raised, ourselves, to be shorn.
Illegal Online Casinos: How to Identify Unlicensed Gambling Sites and Recover Your Money
Robert Nogacki – licensed legal counsel (radca prawny, WA-9026), Founder of Kancelaria Prawna Skarbiec.
There are lawyers who practice law. And there are those who deal with problems for which the law has no ready answer. For over twenty years, Kancelaria Skarbiec has worked at the intersection of tax law, corporate structures, and the deeply human reluctance to give the state more than the state is owed. We advise entrepreneurs from over a dozen countries – from those on the Forbes list to those whose bank account was just seized by the tax authority and who do not know what to do tomorrow morning.
One of the most frequently cited experts on tax law in Polish media – he writes for Rzeczpospolita, Dziennik Gazeta Prawna, and Parkiet not because it looks good on a résumé, but because certain things cannot be explained in a court filing and someone needs to say them out loud. Author of AI Decoding Satoshi Nakamoto: Artificial Intelligence on the Trail of Bitcoin’s Creator. Co-author of the award-winning book Bezpieczeństwo współczesnej firmy (Security of a Modern Company).
Kancelaria Skarbiec holds top positions in the tax law firm rankings of Dziennik Gazeta Prawna. Four-time winner of the European Medal, recipient of the title International Tax Planning Law Firm of the Year in Poland.
He specializes in tax disputes with fiscal authorities, international tax planning, crypto-asset regulation, and asset protection. Since 2006, he has led the WGI case – one of the longest-running criminal proceedings in the history of the Polish financial market – because there are things you do not leave half-done, even if they take two decades. He believes the law is too serious to be treated only seriously – and that the best legal advice is the kind that ensures the client never has to stand before a court.
