How Airplane Mode and VPNs Interact with Casino Apps

In a private baccarat room at Marina Bay Sands, we worked with the kind of clientele who understood system boundaries. A Chinese businessman would sit at the table with a phone in his jacket pocket running a crypto casino app, placed bets during Airplane Mode, then reconnected when the hand was over.

We saw this behavior often enough that it became familiar. The guest understood that the app's geolocation system could not transmit data when the phone was offline. The app could not verify that he was outside a prohibited jurisdiction. The bets were placed in a kind of shadow zone.

This is not unique to casinos. It is a property of mobile applications everywhere. But casinos have unusual constraints around what a player is permitted to do in different locations, so the dynamic becomes visible.

How Airplane Mode Works

Airplane Mode disables all wireless radios on a phone. No cellular signal. No WiFi. No Bluetooth. The phone becomes an isolated device. Any app that requires an internet connection will not be able to send or receive data.

A casino app that requires location verification before allowing play will be blocked by Airplane Mode. The app cannot verify your location if it has no connection.

But here is the thing: the app might allow you to place a bet if you already have a cached copy of the game state. You open the app, the app shows you the game (cached from the last time you were connected), you tap to place a bet, and the bet is stored locally on the phone.

When you turn Airplane Mode off, the app reconnects. The cached bets are transmitted to the server. The server processes them as if they had been placed while connected.

The operator does not know if you were in a prohibited jurisdiction or not. They only know that the bets were transmitted from your account.

VPN Complications

A VPN (virtual private network) reroutes your internet traffic through a different location. If you are in Singapore and you use a US-based VPN, the casino sees your connection as coming from the United States.

Most casinos have geofencing rules that prohibit play from certain jurisdictions. The United States is prohibited for crypto casinos. China is prohibited for most licensed casinos. Certain other countries are prohibited.

A player can use a VPN to appear to be in a permitted jurisdiction. The casino's geofencing system checks the player's apparent location (determined by the IP address routed through the VPN) and allows the play.

The operator knows, intellectually, that VPNs exist. They know that geofencing can be bypassed. But they also know that if a regulator asks, they can claim they checked the player's location and the location was permitted.

The regulator is aware of this game. The regulator does not have the technical resources to investigate every player's real location, so regulators focus on aggregate patterns. If a casino is seeing unusually high play from prohibited countries (detected through payment processor data or blockchain analysis), that is when a regulator investigates.

The Operator's Position

Casino operators are in a delicate position. They are required by their gaming license to prevent play from prohibited jurisdictions. But they cannot, technically, prevent a player from using a VPN or Airplane Mode.

So they create a standard: "We geofence. We check location. We take reasonable precautions." If a player bypasses these precautions, the operator claims they did their due diligence.

In practice, operators know that some percentage of their players are in prohibited jurisdictions. They also know that if those players win big, the operator can refuse the payout by citing jurisdictional prohibition. If the player loses, the operator keeps the money.

This is why a crypto player from a prohibited jurisdiction might prefer an unlicensed operator. A licensed operator has a shield ("We checked location"). An unlicensed operator has no shield, but also no authority to refuse a payout based on jurisdiction.

The Technical Boundary

The boundary between permitted and prohibited is not a wall. It is more like a customs line where you can sometimes walk around the booth.

A sophisticated player knows that a casino app has vulnerabilities. They know that Airplane Mode creates a shadow zone. They know that VPNs can spoof location. They know that if they are clever and careful, they can play from a prohibited jurisdiction without being detected.

The operator knows this too. The operator is playing a game: implement enough controls to claim compliance, but not so many controls that the player experience suffers.

Meanwhile, the regulator is watching the aggregate numbers, hoping to catch patterns of evasion.

The technology creates the loophole. The business incentive maintains it.