3 posts tagged with "ciV-52"

Source. May 26, 2026 weekly sync.
Ticket. CIV-52: Ontario — mkodo / GeoLocs — Compliance Failures & Retest.

What we tested​

Whether the OLG iOS app (GeoLocs / mkodo geolocation) would correctly refuse to operate when device location services were turned off — i.e. the most basic compliance pre-condition (no location signal → no wager).

What happened​

• ✓ Session was terminated immediately on detection of disabled location services.

Why it matters​

The baseline check works. A platform that allows wagering with no location data is unambiguously non-compliant; this vendor correctly refuses, on iOS, at session start.

That said — pair this with the OLG / GeoLocs VPN gap recorded the same week: the vendor does enforce when the device claims to be unable to locate, but falls down when the device claims to be located somewhere it isn't. The two findings together describe the shape of the gap: GeoLocs trusts the device's location signal too uncritically when that signal is present.

Cross-reference​

• OLG ON (GeoLocs / mkodo) — VPN-from-Ontario allowed + Netherlands VPN late detection (May 26) — same vendor, same operator, opposite outcome.
• High Flyer Casino TN (GeoLocs / mkodo) — iOS + Android spoofing bypass (May 26) — vendor failure pattern on a second operator the same week.

GeoLocs profile → · May 26 weekly sync →

Source. May 26, 2026 weekly sync.
Ticket. CIV-52: Ontario — mkodo / GeoLocs — Compliance Failures & Retest (Casumo, High Flyer, OLG).

What we tested​

Two VPN scenarios against the OLG (Ontario Lottery and Gaming) web app, geolocated by GeoLocs / mkodo:

1. Ontario-based VPN — exit-node inside the licensed jurisdiction.
2. Netherlands-based VPN — out-of-jurisdiction exit node.

In both cases device location services were left active so the system had a real GPS signal alongside the VPN IP.

What happened​

• ✗ Ontario-based VPN was authorised when location services remained active. Unrestricted gameplay and wagering were permitted — the VPN itself was not flagged.
• ✗ Netherlands-based VPN did not trigger any immediate session termination. The user was able to keep playing.
• ✗ Detection only fired on re-entry — when the user exited a game and tried to come back in, the system finally prohibited access.
• ✗ No explanatory error notification was shown to the user at the point of block. Silent failure on a compliance event.

Why it matters​

Two distinct failure modes in one test:

1. VPN-tolerance when device GPS agrees. A VPN with an in-state exit-node is fine, even though VPN-detection is a normal column of any modern compliance stack. Anyone wanting to obscure their network identity inside Ontario faces no friction.
2. Late, silent block on out-of-state VPN. The system does eventually detect the Netherlands VPN, but only at a session boundary — and tells the user nothing. From the user's perspective the platform "just stopped working."

This combines into a UX-and-compliance double failure: the wrong thing is allowed, the right thing is detected too late, and the user is never told what happened.

Cross-reference​

• High Flyer Casino TN (GeoLocs / mkodo) — iOS + Android spoofing bypass (May 26) — same vendor, second operator failure in the same week.
• OLG iOS (GeoLocs / mkodo) — location services off → session terminated (May 26) — positive counterpart.

GeoLocs profile → · May 26 weekly sync →

Source. May 26, 2026 weekly sync.
Ticket. CIV-52: Ontario — mkodo / GeoLocs — Compliance Failures & Retest (Casumo, High Flyer, OLG).

What we tested​

Whether High Flyer Casino (Tennessee) could be accessed and wagered on from outside the licensed state using common consumer-grade spoofing combinations:

• iOS — Safari + iAnyGo location-spoofing tool + VPN.
• Android — equivalent setup.
• iOS Emulator — for comparison against the native iOS path.

What happened​

• ✗ iOS path succeeded. Bets placed from outside Tennessee with no website-level block.
• ✗ Android path succeeded. Same outcome.
• ✗ iOS Emulator test produced identical results to native Android — the platform does not differentiate the emulated environment.
• ⚠ Some individual games returned location errors — but this enforcement comes from the game providers themselves, not from the sportsbook integration. Coverage is therefore inconsistent and per-title rather than per-jurisdiction.

Why it matters​

The geolocation controls at the platform level are effectively absent for this operator on the most common consumer spoofing toolchain (VPN + commodity iOS spoofer). When detection does fire, it fires from game providers rather than from the operator's compliance layer — meaning enforcement depends on which game the user happens to open, not on a coherent jurisdictional decision.

Cross-reference​

• OLG ON (GeoLocs / mkodo) — VPN allowed + Netherlands VPN late detection (May 26) — same vendor, similar pattern (active location services masking VPN use).
• OLG iOS (GeoLocs / mkodo) — location services off → session terminated (May 26) — vendor does enforce when the device lies about being unable to locate; falls down when the device claims to be located somewhere it isn't.

GeoLocs profile → · May 26 weekly sync →