What to Do If You Suspect Your Casino Account Has Been Hacked

Your casino balance is gone. Money withdrawn to an unknown address. You don't remember authorizing it. Here's what to do in the first hour, then the next 24 hours.

Account security breach notification with transaction history list

SonicBet Odds Bulletin

7 May 2026 · 14:25

4 min read

I covered a poker scandal in 2006. Not cheating (that's the boring story). Account hacking. A player's PokerStars account drained while he was asleep. Twenty thousand gone. This is the playbook.

The First Hour

You log in. Your balance is zero. Money missing. DO NOT TAKE MORE TIME TO PROCESS THIS. Act now.

First action: change your password. Do it immediately from a different device (not the computer that might be compromised). Use a strong password (16+ characters, mixed case, numbers, symbols).

Second action: check your account activity log. PokerStars, DraftKings, all licensed casinos, maintain transaction history. Look for withdrawals you didn't authorize.

Third action: check your email. If someone accessed your account, they might have tried to change the contact email or password. Look at login activity. Most casinos show you where and when your account was accessed (IP address, browser, device).

If you see logins from a different city or country, you've been hacked.

The Next Hour

Contact the casino. Use the support chat or phone line. Tell them: "My account was accessed without authorization and money was withdrawn. I need to freeze my account pending investigation."

Be specific: give them the withdrawal amount, the date, the time if you have it.

The casino will:

Freeze your account (prevent further unauthorized withdrawals).
Request documentation (usually a photo of your ID, proof of address).
Pull the transaction details (where the money went, which payment method).

Don't wait on this. Call them. Chat is slow. Phone is faster.

The Investigation (Hours 2-24)

The casino's security team will review the transaction. If the withdrawal went to a registered payment method (your own e-wallet, your bank account), this is complicated. You authorized that method once; proving the withdrawal was unauthorized is harder.

If the withdrawal went to an unregistered method or crypto address, it's clearer. The casino will likely reverse it and lock the receiving account.

Crypto withdrawals are tricky. Bitcoin is irreversible. If your hacker moved it quickly and converted it to another currency, it's gone. The casino can't recover it.

Fiat withdrawals (to bank accounts, e-wallets) are more reversible. The casino can halt the transaction at the processor level.

The Documentation You Need

Gather this immediately:

Your login history (download from your account if available).
Screenshots of the unauthorized transactions.
The IP addresses that accessed your account (your casino should provide these).
Emails from the casino confirming your normal payment methods.
Evidence of your usual location (IP address from your normal gaming sessions).

If the transaction went to a crypto address, the blockchain is immutable. But you can provide that address to the casino as evidence it wasn't yours.

The Likely Outcomes

Scenario 1: The casino freezes the withdrawal before it's processed. You get the money back. This happens in maybe 40% of cases.

Scenario 2: The withdrawal completes but goes to a method you once registered. You file a charge-back with your bank or payment processor. Your bank investigates. You might get the money back, but it takes weeks.

Scenario 3: The withdrawal goes to a crypto address. The casino tracks the address, but Bitcoin is irreversible. You might get a settlement from the casino (if they accept liability), but recovery is unlikely.

Prevention

After this happens (if it does):

Enable two-factor authentication (2FA). Every login requires a code from your phone.
Use a password manager (1Password, Bitwarden) to generate unique passwords per site.
Check your registered payment methods monthly. Remove any you don't recognize.
Use reputable casinos with MGA or UKGC licensing (they have better security).
Don't reuse passwords across sites.
Don't log in from public WiFi.

The Real Story

The player I covered in 2006 got his money back. PokerStars froze the withdrawal before it completed. He changed his password and added 2FA. He played for ten more years without incident.

Most hackers aren't sophisticated. They're using stolen credentials from data breaches. If your casino password is unique and strong, you're probably safe. If you've reused a password from a different site, you're exposed.

This is why 2FA matters. It's not flashy. It's just effective.

Markets in this line