There are several ways to detect collusion play; some more advanced than others, but focusing on online poker the advantage is actually with the operator, as the business is completely digital, and the first step is to ensure that everything is stored per individual player levels and where it is possible to track and trace not only every transaction but also the physical location of players and digital address, IP number.

With a complete trace installed one have grounds for a first level detection of collusion play, to that one require game play expertise in order to analyse collected game data, and based on experience and cross tracing, determine whether collusion is detected or not, and hence act accordingly. The more difficult part in online gaming is to assure that non-wanted players are not given access through "new identities".

The most basic data to store from each player individually is their digital address, and not only shall this be stored on their latest IP number but one need to store each IP number for each login and play session of the same player. Players address and other related data needs to be stored in an equal way and while this is natural, one should also store previous addresses, phone numbers and e-mails, as having access to old data even after a player changes its personal data is useful in collusion detection, especially when one do cross references on player patterns, i.e. same place of work and or living on the same street, apartment etc.

Limit player accounts to one account per player only. This is an important aspect in preventing collusion play, as accounts are easily set up online. Using its real address on one account and partial real address or fake on the second account is an opening to collusion play. Thereby cross references on address and other account data is important.

Further it is recommended that one only allows a limited number of software client installations onto one computer, as this is preventing running multiple clients from one machine, with different identities. However from experience and setting this to one (1) installation, will enhance support matters and complicate matters for the majority of good players, hence allowing several installations are recommended. The control number for this should also have the feature that operators can reset this number for the player, preferable through back office management or either directly by the player through specially designed script. Running multiple clients is however still possible as today most players, internet users, have access to several machines, yet for those who don't, one is making it harder to engage and participate in collusion play. IP number will however be the main function in detecting collusion play on players with several machines and accounts with possible fake addresses.

Additional verifications that operators apply and need to verify  are so called "check-sum" verifications, this to ensure that software is up to date and that clients have not been tampered with, hence any software client not meeting security criteria's should not be allowed to connect towards game servers, or updated and report generated on player. In practice this is done in that one selects one or several files, either individually or by total, and check files size(s) and compare to a pre-determined value. For instance file one will hold a specific value in bytes, file two the same and file three, as well as that three files together will have a predetermined total bytes value, and system access is allowed either by exact match or by some minor variation, dependent on files and system. One can further "plant" security files in the system to give an exact and total value, and naturally check for any other irregularities and virus prior to allowing access.

The third level of trace is focused more on patterns by individual players and their movement within the system/client. It's thereto a grey area as determining denied access is more difficult as random events can easily be incorrectly interpreted.

Game play trace should however in its basic reports be focused on track and trace during low peak hours or towards a dedicated database outside actual live environment. Basic reports would be comparing player patterns and based on search result generate alarms and reports for staff to analyse, and based on outcome perform additional manual or automated actions and per internal routines take action(s).

Basic guidance on track and trace should include, and generate reports on:

a) Players that always plays with one or several other players.

b) Players that has a history of playing at table limits 0.5-1 and 2-4 tables, changes to play table limits 5-10 to 20-40.

c) Accounts that changes any of its registered data.

d) Accounts with multiple changes to payment methods, within a certain time period.

e) Hands played that were folded holding strong hands, par of Kings, Three of a kind, Flush.

f) Accounts with larger deposits, especially if not part of normal pattern.

g) Players holding nothing but goes all in or raises larger amounts with strong flop or community cards.

The list can be made long, the matter discussed in length, however the intent of this article was not to serve as an in-depth piece on the matter, simply to describe collusion play and some basic guidance. Thereto any player being concerned, simply contact your poker room and inquire of collusion policy, as today more or less all brands have policies in place to detect collusion play. 

The key to making the right play, know your opponents.