Casino account hacked: what should you do first? 

Has your casino account been hacked? Secure your access, notify the operator and your bank, and document suspicious transactions with this practical step-by-step guide. 

You log into your casino account and notice a withdrawal you didn’t request. Or you receive a notification that your password has been changed, even though you haven’t done anything. Perhaps you suddenly can’t log in at all. Your first reaction is often panic: is my money still there, and who can access my personal information? 

If you notice these warning signs, don’t wait until you know exactly how someone gained access. You can report a suspected account takeover before the investigation is complete. Your first priority is to prevent further unauthorized access and limit financial damage. Documenting and investigating what happened comes next. 

This risk is real. Our article about hacked gambling accounts and the police warning explains why player accounts are attractive targets for cybercriminals. Below, we explain the steps you can take yourself without interfering with the operator’s or police investigation. 

First actions to take if you suspect an account takeover 

Contact the operator through a verified communication channel and ask for your account to be temporarily secured. Also check your email account and change any compromised passwords. If your banking details have been misused or you notice unfamiliar payments, contact your bank immediately. You don’t need to complete one action before starting another. 

What have you noticed?	What should you do immediately?
An unfamiliar withdrawal is pending	Urgently ask the operator whether the withdrawal can still be stopped.
Your password or email address has changed	Report a suspected account takeover and use only the official recovery process.
You notice unfamiliar activity in your mailbox	Secure your email account and check your recovery information.
There are unknown bank or card payments	Contact your bank or card issuer immediately.
You’ve only received a suspicious email	Visit the genuine website yourself to verify the notification.

An unexpected email alone does not prove that your account has been hacked. It could also be a phishing attempt designed to lure you to a fake login page through a false security warning. Always verify the message without using the link it contains. 

Step 1: open the official website and use a trusted device 

Don’t click on buttons in unexpected messages about account restrictions, withdrawals or mandatory identity verification. Open the official app or manually enter a previously verified web address. Use the same trusted route to find customer support. 

This is consistent with the Belgian Federal Police’s security advice for gambling accounts. A message may look convincing because criminals already possess some of your personal information. Knowing your name does not prove that the sender is trustworthy. 

Have you recently installed unfamiliar software, a browser extension or a supposed support tool? If possible, use another trusted device to change your passwords. Have the suspicious device checked before using it again to access sensitive accounts. 

Don’t immediately wipe your entire device. You want to stop further damage, but you should also preserve available evidence. First, make a note of what you installed or opened and when the problems began. 

Step 2: ask the casino to secure your account and transactions 

Clearly tell customer support that you suspect unauthorized access. A message such as “something is wrong with my balance” is less useful than a specific report mentioning the relevant time and transaction. 

Ask the operator to assess which immediate protective measures are possible. These may include temporarily locking the account, ending active sessions and stopping withdrawals that have not yet been processed. Not every operator offers the same options, and a completed payment cannot necessarily be reversed. 

Provide your username or customer number, the last time you personally logged in, and the activities you don’t recognize. Ask for a case reference number and written confirmation of your report and the measures taken. 

For example, you could write: 

I suspect unauthorized access to my player account. I did not request the withdrawal of [amount] on [date and time]. Could you please secure the account, check whether this withdrawal can still be stopped, and preserve the relevant information for investigation? 

Step 3: secure your linked email account too 

Your email account deserves particular attention. An attacker with access to your mailbox may also be able to receive password recovery messages for other services. Changing only your casino password may therefore be insufficient. 

Check your email provider’s recent security activity, signed-in devices and recovery details. Remove any unfamiliar access according to the provider’s instructions. Also check for forwarding rules or filters you didn’t create, as these can silently forward or hide messages. 

Change your password and enable two-factor authentication if available. Verify that the linked phone numbers and recovery email addresses still belong to you. If you can no longer log in, use your email provider’s official recovery process. These checks are also recommended in email providers’ account recovery guidance. 

This is especially urgent if the casino informs you that your email address has been changed or if you unexpectedly stop receiving security emails. Don’t immediately draw a definitive conclusion, but include these details in your incident report. 

Step 4: replace reused passwords and check active sessions 

Choose a new, unique password for your player account. Making a small change to your old password, such as adding an extra digit, is not a good solution. If you use the same password elsewhere, change it on those accounts as well. 

The Belgian Federal Police specifically warns against password reuse: stolen login credentials can be tested on other websites. An account takeover therefore does not automatically mean that the casino website itself has been hacked. Your credentials may have been stolen elsewhere. 

Check whether the casino provides a list of connected devices or active sessions. End unfamiliar sessions or ask customer support to invalidate all active logins. Don’t assume that changing your password automatically ends every existing session without confirmation. 

Enable two-factor authentication if the operator supports it. Never share login codes, recovery codes or authentication approvals with someone who contacts you. Approving another person’s login attempt defeats the purpose of this additional security measure. 

Step 5: carefully document suspicious activity 

Create a short timeline once the most urgent security measures are underway. Record when you last accessed your account yourself, when you first noticed something unusual and when you reported the incident. 

Preserve available information about unfamiliar deposits, bets, game rounds, withdrawals and profile changes. Where possible, record the amount, status, time and transaction reference number. A withdrawal marked “requested” is different from one marked “completed”. 

Keep emails and conversations with customer support in their original form. Only share screenshots publicly after hiding personal information. Original files may be important for an investigation, so preserve them separately. 

Ask the operator to retain relevant login and transaction records. You don’t need to conduct your own technical investigation or attempt to access internal systems. Describe what you observed and leave the assessment of internal records to the appropriate parties. 

Step 6: check your bank account and payment methods 

A missing casino balance and an unfamiliar bank payment are two different problems. Check both your player account and your bank and card statements. Look for completed transactions as well as any pending authorizations you don’t recognize. 

If you notice suspicious financial activity or have shared banking or card details, contact your bank immediately. Discuss whether your card or payment method needs to be blocked and what procedure applies to disputed transactions. 

Safeonweb’s guidance on what to do if your account has been hacked emphasizes the importance of changing passwords, adding extra login security and notifying your bank if payment details have been stolen. 

A refund is not automatically guaranteed. The bank, payment service and operator must investigate what happened. Report unfamiliar transactions as accurately as possible. Don’t describe a payment you knowingly authorized as one you never approved. 

Step 7: understand the difference between security measures and obstruction 

After your report, an operator may temporarily restrict your account while investigating your identity or suspicious activity. As a result, you may also be unable to log in or request a withdrawal yourself. 

Such a restriction does not, by itself, mean that your money is permanently lost. Ask what the restriction involves, which documents are required and how you will receive updates. Our guide to dealing with a blocked casino withdrawal helps distinguish between the different possible causes. 

An identity verification request may be legitimate during account recovery. However, always verify the sender and the document upload channel. Don’t send documents through an unexpected WhatsApp number. For more information, read our guide to identity verification and KYC at online casinos. 

Step 8: report financial damage and have your case reviewed 

If theft, financial loss or identity misuse has occurred, file a police report. Bring your timeline, transaction details, correspondence and the operator’s case reference number. Even if some details remain unclear, you can report what you currently know. Safeonweb also recommends reporting the incident to the police when money has been stolen from your bank account. 

Ask the casino for a reasoned written response if a disagreement arises over how the incident is handled. Explain which activities you dispute and what information supports your position. The fact that a transaction appears under your account does not, by itself, establish who performed it. 

Conversely, reporting an account takeover does not automatically mean that every loss must be reimbursed. That depends on the investigation and the circumstances. Keep any responses you disagree with so that your case file remains complete. 

Don’t continue gambling during the investigation in an attempt to recover missing money. Doing so will not resolve the unauthorized access and could lead to further financial consequences. 

Watch out for a second scam attempt 

An incident may be followed by new suspicious messages. Someone may claim to work for the security department, ask for a code or promise to recover your balance in exchange for an upfront payment. 

Don’t let a countdown timer or threats that your case will be closed pressure you into acting. Verify unexpected requests through a contact channel you’ve already confirmed. Never install software that allows an unknown person to control your device. 

Don’t pay so-called activation fees to release your existing balance either. Our guide to recognizing online casino scams covers additional warning signs. 

Your account is only properly recovered when you have regained control not just of your password, but also of your contact information, recovery options and account access. Ask the operator which security measures have been completed and continue monitoring your transactions afterwards.