Key Takeaways
- Lottery insider fraud is what happens when somebody inside a gaming business uses the access their job gives them to learn a game’s outcome before anybody outside can. Italy’s accounting court is pursuing five former employees of the company that runs the Gratta e Vinci scratchcard game on exactly that basis.
- On 23 October 2026 the Guardia di Finanza in Rome seized property and accounts worth more than €25 million from the five, on the order of the Corte dei conti regional prosecutor for Lazio, to secure money owed to the Italian gaming regulator, the Agenzia delle Dogane e dei Monopoli.
- Four tickets are in issue, two carrying a €7 million prize and two carrying €5 million. No ticket was tampered with. Investigators say the five logged into their employer’s servers with their own credentials, read which shop each winning ticket had been sent to, and had relatives and friends go and buy it.
- The concessionaire is not named in the court material and is recorded as having nothing to do with the alleged conduct, so the cost here is not a regulatory fine. It is a civil claim for public money, a concession that runs out on 30 September 2028, and four jackpot claims that traced back to staff with nothing inside the business picking it up.
1. What happened in the Gratta e Vinci case?
On 23 October 2026 the Guardia di Finanza in Rome, acting for the regional prosecutor of the Corte dei conti for Lazio, served five former employees of Italy’s Gratta e Vinci concessionaire with a citation and took precautionary seizure of assets worth more than €25 million. [1] The list runs to 25 properties across the provinces of Rome, Viterbo, Treviso, Taranto, Grosseto and Reggio Calabria, plus five cars and motorcycles and a set of bank accounts. [2]
Nobody is accused of printing a fake ticket or altering a prize table. Investigators say the five used their own credentials, issued to them for their jobs, to reach the concessionaire’s servers and identify four high-value winning tickets before those tickets went on sale, then traced the shop each one had been distributed to and sent relatives and acquaintances to buy them. [1] [2] Two carried a €7 million prize and two carried €5 million, so €24 million of prize money went to people who knew where to stand.
The prosecutor had already put the allegations to the five in a notice of charges in March and judged the replies insufficient, which is why the case moved to a citation and a seizure rather than closing. [1] A judge will now decide in chambers whether to confirm, vary or lift the seizure while the accounting case runs. None of it is proven, and the five are entitled to the presumption of innocence.
One name is missing from the court material, and it is the concessionaire’s. The company is recorded as unconnected to the alleged conduct. [1] [2] Some English language coverage attached the Lottomatica name anyway, which is understandable, since the Gratta e Vinci concession belongs to Lotterie Nazionali S.r.l., the joint venture in which IGT’s subsidiary Lottomatica Holding took 64 per cent, Scientific Games 20 per cent and Arianna 2001 the remaining 16 per cent when the partners accepted a nine-year extension in December 2017 and paid €800 million upfront. [3] That extension runs to 30 September 2028.
2. Why is the claim for the full €24 million rather than a margin?
Because the prosecutor is not arguing that the prizes were inflated, it is arguing that the money should never have left the state at all. The case put to the court is that advance knowledge of where the winning tickets had gone took the chance out of the game, and that without it those four tickets might well have sat unsold or unclaimed, so the prize money would have stayed in the public purse. [1] [2]
For a gaming board, the arithmetic is the point. Operators tend to budget for lottery insider fraud as a small percentage loss, something an audit catches and a provision absorbs. The Italian prosecutor is valuing it at the gross worth of every outcome the insider could steer, which in a pre-printed instant-win game with a published prize table is a figure the finance team can work out in an afternoon. Run that number on last year’s biggest game before anybody else does.
3. How does this compare with earlier lottery insider fraud cases?
Lottery insider fraud takes one of two shapes, either somebody who can see or set the outcome, or somebody who can intercept the claim, and Italy is the first kind. The closest precedent is the Multi-State Lottery Association in the United States, where Eddie Tipton, the association’s own information security director, wrote code into the random number generator that made draws predictable on certain dates, took prizes through his brother and an associate across five states, confessed in June 2017 and was sentenced to 25 years. [4] Ontario is the second kind, where the provincial Ombudsman’s report A Game of Trust, published on 26 March 2007, found the lottery had paid millions of dollars in questionable prize claims to its own retailers and recommended moving lottery oversight away from the operator, which the province and OLG accepted along with all 23 recommendations. [5]
| Market and date | Who held the access | What the access was worth | What the state did |
| Italy, case opened 2026 | Five employees of the Gratta e Vinci concessionaire, using their own credentials to read pre-sale distribution data | Four tickets totalling €24 million | Civil claim for public money in the accounting court, more than €25 million in assets frozen on 23 October 2026 [1] |
| United States, draws 2005 to 2011 | The information security director of the Multi-State Lottery Association, altering the random number generator | Prizes across five states, including a $14.3 million Iowa jackpot that was never paid out | Criminal conviction, 25-year sentence in August 2017, about $3 million in restitution ordered [4] |
| Ontario, exposed 2006 | Lottery retailers claiming customers’ prizes | Millions of dollars in questionable claims over several years | Ombudsman investigation, 23 recommendations accepted, oversight moved away from the operator [5] |
None of the three was a technology failure. The access was legitimate in each case, the logging existed, and what exposed the scheme came from outside the operator every time: a rejected anonymous claim and a convenience store camera in Iowa, a television investigation and an ombudsman in Ontario, a public prosecutor in Italy.
4. What does the case reveal about insider access controls in gambling?
The control that fails in lottery insider fraud is reconciliation rather than access management. Somebody could have asked whether the people collecting the largest prizes had any connection to the people who could see where those prizes were. In all three markets nobody did.
That question has quietly become harder to force. The World Lottery Association revised its security control standard in October 2024, and the WLA-SCS:2024 changes document records that the fraud detection control on claims review, L.4.1.5, was narrowed to cover retailers rather than personnel, where the 2020 version reached both. [6] The logging requirement did not move, so G.4.1.2 still requires every action by a human or system account to be logged, monitored and reviewed, and personnel vetting with monitoring of staff activity stays at G.2.1.6. [6] The standard still expects the records to exist. It no longer names anybody whose job is to run the biggest claims against the staff list, which is the exact comparison this case turns on.
Two other changes in the same revision matter to anyone running a lottery or instant-win operation through a supplier. The standard added segregation of duties for electronic draws at L.8.1.4, and it moved managed and cloud environments under ISO/IEC 27001:2022, adding requirements on tenant separation and on the operator’s own ability to monitor a managed service at G.5.3.5. [6] So where prize file generation, ticket printing or distribution routing is handled by a third party, the monitoring obligation belongs to the licensee rather than the supplier.
Then there is the tender. The Gratta e Vinci concession expires on 30 September 2028, and ADM will run a competition for it while this case is still in front of the accounting court. [3] An incumbent that cannot show what changed after four jackpot claims traced back to its own former staff goes into that process with a question it would rather not be asked.
5. How should a board run an insider access review?
An insider access review starts with the data that reveals an outcome, not with the people, and finishes on a reconciliation rather than a policy. The five steps below are about a month of work for one person with the right permissions, and the order matters.
- List every account that can see an outcome before the public can: prize files for pre-printed games, ticket distribution and shipment routing, draw records, random number generator seeds and configuration, and any test or staging copy of production prize data. Include contractors, printers, test laboratories and anybody on a managed service, because the 2024 revision puts the monitoring of a managed environment on the operator.
- Cut the list. For each account, decide whether read access is needed at all, and where it is, whether it should only work inside a two-person control. Expect the list to be longer than anybody predicts, mostly because of leavers’ accounts and reporting tools nobody has looked at since they were built.
- Turn the logging into detection. The logs almost certainly exist already. Set an alert on any query that joins a prize file to a distribution destination, and on any access to outcome data from an account outside a named and dated list, then give that alert to somebody who does not report through the technology line.
- Reconcile the claims backwards. Take the highest-value claims of the last 36 months and run claimant name, address, bank details and telephone numbers against employee, contractor and known related-party records. This is the control the 2024 revision stopped naming, and the one that would have caught all three cases above.
- Write down what you found and when. A dated record of the review, the accounts removed and the claims checked is what answers a regulator or a tender panel two years later. The Italian concessionaire’s position is that it had nothing to do with the conduct, and a dated review is how a business proves that rather than asserting it.
Steps 1 to 3 have a ready-made structure in TGB’s Fraud Prevention and Payment Security Review Framework, which carries the control review, the RAG rating and the evidence trail. It is built around external and payment fraud rather than insider claims, so step 4 is still a sheet somebody has to build.
Boardroom Questions
- Which named accounts in our business can read a game outcome, a prize file or a distribution route before a customer can, and when did we last take one of them away?
- If a member of our staff had collected a jackpot through a relative last year, what in our current process would have shown it, and who would have seen the result?
- Have we ever run our largest prize claims against our own employee and contractor records, and if not, what is stopping us doing it this quarter?
- Our security standard requires every account action to be logged and reviewed. Who in our business actually reads those logs, and what happens to what they find?
- Where prize generation, printing or distribution is handled by a supplier, which of us is monitoring it, and does the contract say so in writing?
- If a prosecutor valued an insider case against us at the gross prize value rather than our own loss, what would the exposure be on last year’s biggest game?
Sources
- Sky TG24, “Truffa gratta e vinci: ex dipendenti segnalavano biglietti vincenti ai parenti, sequestrati 25 mln”, 23 October 2026.
- QuiFinanza, “Truffa dei Gratta e Vinci da 24 milioni: sequestrati beni per 25 milioni a 5 ex dipendenti”, 23 October 2026.
- International Game Technology PLC, Form 6-K exhibit 99.1, “IGT-led joint venture Lotterie Nazionali accepts nine-year extension for the Italian Scratch & Win concession”, filed with the US Securities and Exchange Commission, 4 December 2017.
- CNN Money, “Ex-lottery worker who rigged winnings gets 25 years in prison”, 22 August 2017.
- Office of the Ombudsman of Ontario, “A Game of Trust”, and accompanying press release, 26 March 2007.
- World Lottery Association, “WLA-SCS:2024 Changes”, October 2024.