It is not the machine that gets broken into, it is the account
The outcome of a spin is decided by a random number generator, and nobody can reach into that from the outside. Anyone who does want to cause harm therefore takes a far simpler route: they try to obtain your login details.
In practice that is good news. Your account, the email address attached to it and your phone are all points where you genuinely have a say, unlike the maths of the game.
The sections below run through those points, starting with the most important. None of the steps requires developer knowledge, but each is worth doing once, calmly and properly, rather than at the moment something has already gone wrong.
A password that cannot be guessed
With passwords it is length that counts first, not a complicated mix of characters. A phrase put together from four or five random words, longer than twenty characters, is stronger protection than an eight-character word stuffed with symbols.
The second rule is uniqueness. If the same password protects a gaming account and an old forum profile, then once the forum's database leaks, your account is open too.
This is why a password manager is worth using. The program generates and stores a separate long password for every site, and you only have to keep one memorable master password in your head.
Password managers have a less well-known advantage as well: they only offer to fill in credentials on the address the entry belongs to. On a convincingly similar fake page they simply suggest nothing, and that in itself is a warning sign.
The second step after the password
The point of two-factor authentication is that a second piece of proof is needed alongside the password. This is typically a short-lived code that is generated on your phone or arrives there.
The strength of the protection lies in the fact that a stolen password alone will not be enough. An attacker would also need access to your device, which is a far harder task.
If you get to choose between methods, a code-generating app is more reliable than SMS. Redirecting text messages is a known form of abuse, whereas an app running on your phone is tied to the device.
When you switch it on you also receive backup codes. Write them down on paper and keep them at home, because if you lose the device or change phones this is your only way back in. Switch the same protection on for the email account you registered with: your mailbox is the key to password resets, which makes it exactly as valuable a target.
Phishing: the message that rushes you
A phishing message does not attack the system, it attacks you. The aim is for you to click in a moment of alarm or excitement and hand over your login details with your own hands on a fake interface.
The pattern is almost always the same: a heightened tone, a tight deadline, and a link leading to a sign-in page that looks indistinguishable from the real one. The table below sums up the most common signs.
| Suspicious sign | What it means in practice | What to do |
|---|---|---|
| Pressure, an immediate deadline | they want to take away your thinking time | set it aside and look at it later with a clear head |
| A request for your password or login code | genuine support never asks for these | do not reply, delete the message |
| A misspelled or odd sender address | there is a spoofed domain behind it | open your own bookmark instead |
| A shortened or hidden link | it conceals the real destination | do not click, type the address by hand |
| An unexpected prize notification | bait, often with an advance fee | check it against your account history |
| An attachment sent as an invoice or a certificate | it may be a malicious file | do not open it, ask through an official channel |
One habit follows from all of this. Never try to sign in through a link that arrives in a message: type the address or use your saved bookmark, and only then compare the message with what you see in your account.
What can be asked of you, and what never can
There are a few pieces of information that genuine customer support will not ask for under any pretext. Your password, the code from two-step login, your card PIN and the verification number on the back of the card all fall into that category.
What can legitimately be asked for: your name, date of birth, address and payment method details, because without them there is no way to establish who owns the account. The difference is not in how sensitive the data is but in whether it serves identification or access.
It is standard practice for the payment method and the account to be in the same name. A card or a bank account issued to someone else will usually fail the check, and the withdrawal is delayed as a result.
Screenshots deserve caution too. A win picture posted in a group often shows the account identifier and the transaction number, which is already enough of a starting point for a targeted approach. We have set out what data this site handles in the privacy notice.
Verification is a shield rather than an obstacle
Identity checks after registration feel inconvenient to many people, yet they serve the same purpose as your password: making sure that you alone can reach the account. An identity document and a proof of address tie a person to what was until then merely an email address.
This step also enforces the age limit and makes it harder for anyone to run an account on someone else's details with someone else's money. And even if an attacker did get in, the withdrawal is still tied to a previously verified payment method in your name.
Always upload documents through the dedicated interface inside your account. An identity document sent around in a messaging app or a plain email is an unnecessary risk, and you cannot take it back afterwards.
It is worth getting it out of the way before your first withdrawal, so that the checking time does not land inside the waiting time for your money. The settings with which you define your own exposure belong in the same category: deposit and time limits also cap the damage that can be done from a compromised account.
Phones, shared computers and public networks
The phone is the most common gaming device, and also the one most often left behind somewhere. A PIN lock or biometric unlock is therefore not a matter of convenience: without one, every saved login belongs to whoever finds the device.
On a shared laptop or a family tablet, switch off automatic password filling and always sign out at the end of a session. A private browsing window is a good compromise, because it leaves no live session behind.
Do not start a deposit or a withdrawal on a public network. Mobile data is the safer choice in that situation; leave the cafe wi-fi for reading the news.
Two small things improve the picture considerably: turning off message previews on the lock screen and updating your browser regularly. The first means your login code cannot be read off the screen from your pocket, and the second closes off flaws that have already been fixed. We have written about how the mobile interface works on the mobile version page, and about keeping playing time and budgets in hand in the responsible gaming overview.