What to Do If You Suspect Your Casino Account Has Been Hacked
The Resorts boardwalk used to smell like carpet and possibility. Now your casino account is the boardwalk, and if someone has breached it, you need to know exactly what to do first.
The deal
I remember the Resorts casino when it first opened in 1978. The smell of that carpet, the endless chime of the slots, the way the light hit the poker room at three in the afternoon. I was young then, in my twenties, with more hope than sense.
Fastforward to today, and the casino exists mostly online. The smell is gone, replaced by notifications and two-factor authentication codes. But the stakes are the same. Your account is your access point, and if someone gets into it, they can drain your balance in minutes.
You notice something wrong. A withdrawal you did not authorize. A password that no longer works. An email confirmation for activity you did not start. This is the moment to act. Panic is the wrong response; clarity is the right one.
Round 1: The First Hour
Do not panic. Do not try to log back in repeatedly. Do not post about it on forums or Reddit yet. Do this instead:
Go directly to the casino's website and attempt to log in from a device you trust (a phone or computer that has never been used for gambling, if possible). If the login fails, the attacker may have changed your password. If it succeeds, check your account immediately for unauthorized activity. Look at the transaction history, any pending withdrawals, and any change-of-address requests.
If you cannot log in, navigate to the "Forgot Password" page and attempt a reset. Use an email address you control and a phone number associated with your account. If the attacker has changed these, you will hit a wall immediately, and that is when you pick up the phone.
Round 2: Contacting Support
Call the casino's support line. Not email, not chat. Call. Speak to a human being. Tell them you suspect unauthorized access. Provide your account number, your full name, and the last deposit and withdrawal you authorized. A competent support agent will immediately flag your account and begin an investigation.
The better casinos (DraftKings, FanDuel, licensed operators in the UK and Malta) have fraud departments that can freeze your account instantly. They can reverse recent transactions if they happened within the last 24 hours. They can confirm whether a withdrawal attempt was made and stop it.
Round 3: Change Everything
Once your account is secured, change your password. Make it long, random, and completely different from any other password you use. The old Atlantic City password, the one you have been using for the last fifteen years, is now compromised. Treat it as such.
Enable two-factor authentication if you have not already. Use an authenticator app (Google Authenticator, Authy, Microsoft Authenticator), not SMS if the casino offers the choice. SMS-based 2FA is vulnerable to SIM-swap attacks, but app-based authentication is considerably stronger.
Check your email account's security settings. If the attacker accessed your casino account through a compromised email, they had access to your email account. Review recent login activity on your email provider. Change that password too.
Round 4: The Investigation
The casino will investigate. This takes time, sometimes days. They will examine login patterns, IP addresses, and whether the unauthorized withdrawal actually left your account or was still pending. Modern casinos (unlike the Atlantic City joints of the 1980s, where a problem meant arguing with the pit boss) have clear audit trails.
Be patient but persistent. Follow up with support every 24 hours. Ask for a case number and a timeline. The best-regulated casinos are transparent: they will tell you what they found and what they are doing about it.
Round 5: Prevention
The Atlantic City of my memory had physical security; you had to walk into the casino and stand at the cage. Online gambling is frictionless, which means it is also vulnerable. Treat your casino login like you treat a bank login: unique password, strong 2FA, regular account reviews.
Do not use public Wi-Fi to log into your casino account. Do not share your login details with anyone, ever. Do not click links in unsolicited emails claiming to be from the casino. These are the old sins, dressed in new clothes, and they work as well on the digital boardwalk as they ever did on the physical one.
