Casino account security guide

Casino account security: what to protect first

A casino account links several things an attacker wants: your balance, your payment details and copies of your ID. The casino's own systems are only one part of the chain. The parts you control are usually the weak points, so start there.

This guide sits in our casino guides. For phones specifically, see playing on Android.

Setting a strong password for your casino account

1. Use a password manager to create a long, random password used nowhere else.
2. Never reuse your email password, banking password or a variation of either.
3. Don't save the password in a shared browser profile or a notes app others can open.
4. Change it straight away if you ever typed it on a page you're unsure about.
5. Log out on any device you don't own, and don't let the browser 'remember me' there.

A unique password matters most because leaked password lists from other sites are reused against everything. If your casino password is unique, a breach elsewhere can't open it.

Two-factor authentication and casino logins

Two-factor authentication (2FA) asks for a second proof, such as a code from an app, after your password. Two-factor login isn't described in the published partner material summarized on our review pages, so ask live chat whether it's offered and switch it on if it is.

Where a casino doesn't offer 2FA, put it on the accounts around it instead: your email, your password manager and any crypto exchange you use. Those are the accounts that control password resets and money. Our two-factor authentication guide explains authenticator apps and backup codes.

Your email is the master key to your casino account

Password resets, support replies and verification requests all arrive by email. Whoever controls that inbox can usually control the casino account, so treat the email as part of your casino account security.

• Turn on two-step sign-in for the email account and check its recovery phone and backup address.
• Consider a separate email address used only for gambling accounts, which also makes spending easier to track.
• Check which domain support writes from. Silver Oak's contact page (opens in a new tab) gives a help address on a separate mail domain, while a third-party review lists one on the main casino domain; confirm in live chat which is current.
• Be wary of any email asking you to log in through a link. Go to the casino through your bookmark instead.

Casino phishing: fake messages, fake support and lookalike sites

Phishing is the most common way casino logins get stolen. The messages look like bonus offers, verification reminders or 'account locked' warnings.

• Bonus bait. A text or email with an unusually large code and a login link.
• Fake verification. A request to upload ID to a form or address you haven't seen on the casino's site.
• Fake support. Someone on social media offering to speed up a withdrawal for a fee or your password.
• Lookalike domains. Unofficial mirror sites that copy a brand. Some recorded for Planet 7 and Royal Ace listed phone numbers and terms that independent sources contradict.
• Urgency. 'Verify within the hour or lose your balance' is a red flag; genuine casinos give you time to verify.

No genuine support agent needs your password. Read our guides to phishing scams and casino mirror sites for examples.

Sending verification documents safely

Before paying out, casinos ask for ID and usually proof of address. That's normal and protects you too, because it makes it harder for someone else to withdraw your money. The risk is sending those documents to the wrong place.

1. Confirm the documents address or upload route in live chat on the casino's real site.
2. Cover all but the last four digits of any card number, if the casino allows it; ask first.
3. Send only what's requested, from the email address on your account.
4. Keep a note of what you sent, when and to which address.
5. Never send documents to someone who contacted you first on social media or by text.

Our account verification guide and KYC documents page explain the process in full.

Payment and crypto security at online casinos

Card and crypto deposits carry different risks. With crypto, the FTC warns (opens in a new tab) that payments lack credit-card protections and generally can't be reversed, so an attacker who gets into your casino or wallet can move money for good. The CFPB received more than 8,300 virtual-currency complaints from October 2018 to September 2022, and fraud and scams were the most common issue at 40%.

• Lock your crypto wallet app with a PIN and keep the backup phrase offline, never in email or photos.
• Copy deposit addresses from the cashier each time and check the first and last characters.
• Withdraw to the same method you deposited with where the casino requires it; Miami Club's FAQ says the first withdrawal needs a prior deposit with that method.
• Keep your casino profile matching your bank details; SlotoCash's support page says this is needed for card deposits.

See how to set up a crypto wallet and our crypto casino scams guide for more.

Shared devices, public Wi-Fi and VPNs

Log in to casinos only on your own devices. On a shared computer, use a private window and log out when you finish. Avoid public Wi-Fi for cashier pages; mobile data is safer.

Don't reach for a VPN to fix this at a casino. A VPN changes the location your connection shows, which can clash with the casino's location rules and your verification documents. Our guide to VPNs and online casinos explains why switching it off before you play is the cleaner choice.

Casino account rules that affect security

Some casino rules aren't about hackers but still decide whether your money stays safe. Keep one account per casino: a third-party complaint thread reports a Silver Oak cashout refused over an alleged duplicate account. Don't share logins with family, even to help.

The short dispute windows matter. If you spot a game or transaction you don't recognize, report it at once. Our dormant accounts guide explains how to protect an old balance.

What to do if your casino account is hacked

1. Contact the casino's live chat at once and ask them to freeze withdrawals and logins.
2. Change your casino password, then your email password, from a device you trust.
3. Turn on two-step sign-in for your email and sign out of all other sessions.
4. Check for changed payout details, new payment methods or pending withdrawals, and report each one.
5. If cards were used, call your card issuer; see our chargebacks guide.
6. If crypto was stolen through a scam, report it to the FTC at ReportFraud.ftc.gov.
7. Save screenshots, chat transcripts and transaction IDs, and follow up in writing.

If the casino won't help, our guide on how to file a casino complaint lists the options that exist for offshore sites.

Account security at offshore vs state-licensed casinos

In New Jersey, Pennsylvania, Michigan, West Virginia, Delaware, Connecticut and Rhode Island, state-licensed casinos answer to a state regulator. Our partners are offshore and not licensed or regulated by any US state, so if your account is compromised there's no state body to escalate to, and the casino's own terms set the rules.

Michigan's regulator says it can't help players recover deposits from offshore sites. It named Silver Oak and Planet 7 in its April 9, 2025 cease-and-desist release (opens in a new tab). Read player protections at offshore vs licensed casinos for the full comparison.

Casinos with published document routes and an offer via our links

These three publish, or are reported to publish, a documents address and verification steps, which makes safe KYC easier. They are offshore casinos, not licensed by any US state; check your state's law before you sign up, and expect no state-backed protection of balances. We earn a commission from these links, and our order is commercial.

Silver Oak Casino: $2,500 Welcome Bonus + 50 Free Spins, via our link (new players, 21+ or 18+ where allowed, terms apply). Its own site shows 30x wagering on the offer page but 40x for slots in its general terms, says there's no max withdrawal and starts deposits at $30; it advertises a different package from our link. Silver Oak's terms (opens in a new tab) name Primrose Media Limited, licensed in Anjouan, while one third-party listing says it has no license.

Planet 7 Casino: $2,750 Welcome Bonus + 45 Free Spins, via our link (new players, 21+ or 18+ where allowed, terms apply). Third-party listings report 30x (bonus + deposit) wagering on slots and a $1,000 max cashout; sources disagree, so the terms at sign-up apply.

Royal Ace Casino: $2,500 Welcome Bonus + 35 Free Spins, via our link (new players, 21+ or 18+ where allowed, terms apply). Third-party listings report 30x (bonus + deposit) on slots, 60x on blackjack and video poker, and a max cashout of 10 times the deposit.

Bonuses are slot-focused; table games are often excluded or weighted lower. If gambling is causing harm, call or text 1-800-MY-RESET (1-800-697-3738). Compare options on our safe casinos list.

21+ (18+ where allowed). Every casino game has a built-in house edge, so over time you should expect to lose what you stake. Set a budget before you play and stop when it’s gone: responsible gambling tools and free help. Gambling problem? Call or text 1-800-MY-RESET (1-800-697-3738).