Tiltproof Incorporated Document No. Effective Date Revision Date Approval 5.16.

2 02/28/2007 GN

Hoax Investigation Process

1.0 Purpose:

This document establishes how to proceed with a hoax investigation.

Tiltproof Incorporated

2.0 Persons Affected:

1) Hoax Team

Tiltproof Incorporated

3.0 Forms, Checklists, Flowchart:

Response Procedures to our Players for Hoax Accounts

CSR sends follow up Hoax email to Fraud Queue

Investigator checks to see if account has been compromised See note 1

NO

YES

NO

Were funds moved?

YES

Investigation Process

1. Send player (acct.comp.moneymoved). 2. Pause Account

1. Send player (hotkey: acc.nocomp) 2. Notate account 2. Reset Pswd Finish

1. Send Player hotkey (acc.comp.noloss) 2. Notate account 3. Reset Pswd Finish

Goto Hoax Investigation Process PR

POC performs hoax fund transfer

NOTES: 1. Review know100 logins - review players serial and IP Address - Foreign serial or IP Address indicates account may have been compromised

1. POC sends email to all victims (hotkey: acc.comp. moneygiven) 2. notate account 3. Reset pw Finish

1) Printable version: \\tpfs1nw\workflow$\HANDBOOK-FRAUD\Print Versions\Fraud Handbook\5.16.2 Hoax Investigation Process.doc

Tiltproof Incorporated

4.0 Policy:

1) Only hoax certified investigators may perform these procedures. 2) All new hoax cases should be placed in the appropriate folder located on [s:\hoax team], with the appropriate date Hoax Site Dec 06 This will ensure that all related information, know100s, and spreadsheets are placed in a centralized folder for easy access and reference. 3) A scammer is an account that receives illegal funds (via p2p or chip dump) and is storing the funds waiting for retrieval or withdrawal. a) This does not mean the account owner is a scammer. This just means that the hoax scammers used a stolen account to funnel funds 4) A victim account is one where funds are transferred or lost to other players (either via p2p or chip dump). A) Take Ownership of the Case 1) Check [S:\HOAX TEAM] to see if a new folder for the scam has been created. 2) Create a folder and name it if one has not been created yet. Hoax Site Jan. 8, 2007 Scam. 3) Take ownership of the case or delegate ownership to an available Hoax Team member. 4) In WAT, on the affected players account notate: FYI: I, _____, have taken ownership of this case. All information can be passed on via _____@Tiltproof.ca

5.0 Procedure:

a) If there is already ownership, pass on information through your Tiltproof email address. 5) Keep all information (Know100s, Hand Histories, and other notes) in the proper folder for reference. B) Review Transaction Histories 1) In MIT, perform a Processor Account Lookup to review all the accounts that share the same processor. 2) Note the sum of successful and failed transactions a) Pause any new accounts that have used the processor since the player first emailed us, regardless if the deposit or withdrawal was successful. 3) Review players that have received a Player Transfer since we received the email from the player. C) Review Know100 1) Review account information changes a) Name b) Email address c) Mailing address

Tiltproof Incorporated 2) Review account balances and totals to see money that has been moved in and out of the account. 3) Review tournament balances and totals to see the amount of money won and lost during real money tournament play. 4) Review table balances and totals to see the amount of money won and lost during real money table play. 5) Review login information a) Notate any suspicious IP logins that have been used after the time the player claims that their account has been compromised. b) Review any accounts that are IP related. c) Notate any suspicious serials that have appeared after the time the player claims that their account has been compromised. d) Review any accounts that are serial related. e) Notate any recent foreign logins or serial numbers as this can be an indication that the players account has been compromised.

f) Review if the player has ever been trapped. Find out where the trap originated and how they became trapped. g) Review any accounts associated with the trapalyzer. D) Review Table Play 1) Review real money tournaments that the player has played. a) In MIT, complete a Player Tournament Report and note any Heads Up Sit & Gos. b) In MIT, run a Tournament Opponents report to find any uneven distribution. c) Review the top tournament opponents in the Tournament Opponents report. d) Take note of any suspicious hands that were won or lost by the player. e) Review opponents involved in the suspicious hands. 2) Review the cash games that the player has played. a) Take note of any suspicious hands that were won or lost by the player.

Tiltproof Incorporated E) Review Overall Threshold Balance 1) This will help in determining who the player has played against. a) Notate players that have few logins and review their accounts. 2) This will also determine what a player wins or loses while at tables with the player being investigated. F) Determine if the Account is a Scammer or Victim Account 1) Verify, through IP addresses in the Know100, the time of the login and the time of table play and or fund transfer if the main account user is using the account, or an outside person. 2) If the account is a scammer account, check and document how much funds are stored in the scammers account and can be retrieved. 3) If the account is a victim account, check and document how much funds were stolen from the victims account. 4) Email the POC investigator with an update report on your findings. 5) Notate the account with a summary from the report
Player Iliketogethacked is a victim of a hoax scam from Jan. 15, 2007. Findings suggest that $1000 was deposited from a foreign NT processor and then $1200 ($1000 from the foreign deposit + $200 of his own money) was lost in clean table play. The funds are non-retrievable. An email has been sent to Mike who is the POC Investigator for this case in attempts to reimburse the players with any funds retrieved from any other accounts.

G) POC Investigator 1) Transfer the hoax funds as per Hoax Fund Transfers. 2) Unpause and notate the accounts. 3) Reset the passwords. 4) Email all the victims template acc.comp.moneygiven.

6.0 Definitions:

7.0 Revision History: