Safe online gambling

Securing your account

A casino account holds your money, your identity documents and your payment details. Treat it like a bank account.

Password. Use a password unique to the casino, ideally generated by a password manager. Reused passwords are the most common way accounts are taken over, because leaked credentials from unrelated sites are tried automatically against gambling sites.

Email. The email address on your casino account controls password resets. Protect it with two-factor authentication. If a casino offers two-factor authentication on the account itself, turn it on.

Devices and networks. Avoid logging in from shared computers. On public Wi-Fi, use a VPN or your mobile data. Log out when you finish, particularly on a phone that others might use.

Phishing. Casinos send a great deal of promotional email, which makes them an easy target to imitate. Do not follow links in emails to log in or to "verify" your account. Type the address yourself or use a bookmark. A genuine casino will never ask for your password by email or chat.

Payment details. Prefer methods that do not expose your main bank account, such as an e-wallet or a prepaid voucher. The payments guide covers the options.

Spotting a rogue casino

Most licensed casinos pay what they owe. A minority are run to extract deposits and avoid paying withdrawals. The warning signs are consistent.

Licence problems. No licence number, a licence that does not appear in the regulator's register, or a company name in the footer that does not match the register. See Casino licences explained for how to check.

Discretionary terms. Clauses allowing the casino to void winnings, close accounts or withhold funds "at its sole discretion" without stated grounds. Also watch for very low withdrawal limits (for example 500 € per week regardless of balance), clauses paying large wins in instalments over many months, and dormant-account fees that begin after a short period.

Complaint patterns. Search the casino name with "withdrawal" and "complaint". Individual complaints prove little. A pattern of verification that never completes, winnings confiscated for unexplained "irregular play", or accounts closed after a large win is a different matter.

Pressure tactics. Support that urges you to deposit more before a withdrawal is processed, bonuses added to your account without consent (which then attach wagering to your own money), or withdrawal requests that are repeatedly cancelled so that the balance stays in play.

Cloned brands. Some fraudulent sites copy the design and name of a legitimate casino with a slightly different domain. Check the address bar and the licence details, not the logo.

Unrealistic offers. A 1,000 % bonus or "guaranteed" winnings signal an operator that is not competing on quality.

If you have already deposited with a casino that shows these signs, withdraw what you can, complete verification promptly if asked, keep records of every interaction, and see the dispute section of the withdrawals guide.

What happens to your personal data

To open an account you give a casino your name, address, date of birth, email and phone number. Before your first withdrawal you will typically upload a passport or driving licence, a proof of address and evidence of your payment method. Some casinos also ask for proof of source of funds for larger amounts.

Casinos licensed in the EU or EEA (Malta, Estonia, Gibraltar in practice) are bound by the GDPR, which gives you the right to know what data is held, to have it corrected and, subject to legal retention periods, to have it deleted. Casinos licensed elsewhere, including Curaçao, are subject to their own local law, which is generally weaker, though the 2024 Curaçao act includes data protection obligations.

What you can do:

• Read the privacy policy for retention periods and for whether data is shared with group companies or marketing partners.
• Upload documents only through the account's verification tool, which is encrypted, not by email.
• Opt out of marketing when registering, and again in the account settings if the first opt-out is ignored.
• Ask for a copy of your data or for deletion when you close an account. Licensed casinos must keep anti-money-laundering records for several years regardless, but marketing data should go.
• Be aware that casinos share data with fraud-prevention and identity-verification providers. This is normal and usually disclosed.

Anti-money-laundering rules mean a licensed casino cannot skip verification, and asking it to is a mark against you, not the casino. Verification is the mechanism that lets the casino pay you safely.

Limits and self-exclusion

Every reasonably run casino provides tools in the account settings to restrict your own play. Use them before you have a reason to.

Deposit limit. A cap on what you can deposit per day, week or month. This is the most effective single tool. Decreases usually take effect immediately; increases are delayed by 24 hours to 7 days so that they cannot be made in the heat of the moment.

Loss limit. A cap on net losses over a period. Useful in combination with a deposit limit.

Wager limit. A cap on total bets. Less common.

Session limit. A time limit per login, after which you are logged out. Some casinos also show a "reality check" pop-up at intervals with your session time and net result.

Cooling-off. A short break, typically 24 hours to 6 weeks, during which you cannot log in or deposit.

Self-exclusion. A longer block, usually 6 months to 5 years or permanent, which the casino must enforce and cannot reverse early. Note that self-exclusion at one casino does not extend to others, and there is no national self-exclusion register in Iceland covering foreign sites. You will need to self-exclude separately at each casino, and blocking software such as Gamban or BetBlocker can cover sites where you have no account.

A useful test: set a monthly deposit limit that you could lose entirely without it affecting rent, food or other commitments. If you find yourself wanting to raise it, that is the signal the limit was doing its job.

Getting help in Iceland

If gambling is causing you or someone close to you problems, help is available:

• SÁÁ offers assessment and treatment for gambling problems: https://saa.is/
• Spilavandi provides information, self-tests and support: https://spilavandi.is/
• Rauði krossinn hjálparsími 1717 is available 24 hours a day, free and confidential.

Warning signs include chasing losses, gambling with money needed for other things, hiding gambling from others, and being unable to stop once started. None of these need to be severe before it is worth talking to someone.