UK Casino Player Loses £1,375 in Three Minutes as Casinomeister Calls on UKGC to Make Two-Factor Authentication Mandatory

Casinomeister, the long-running player advocacy and casino complaints platform, is calling on the UK Gambling Commission (UKGC) to make two-factor authentication (2FA) mandatory at licensed online casinos. The call follows a case in which a long-standing Casinomeister forum member lost £1,375 in three minutes.

The attacker got into the player's account at a UKGC-licensed casino and added a Revolut card the player had never owned. Two withdrawals of £975 and £400 then went through within three minutes. The player didn't know it was happening and wasn't actively using the account. The casino didn't offer 2FA when the attack took place.

Casinomeister's investigation points to credential stuffing. Criminals take email and password lists leaked in breaches of unrelated websites and use automated scripts to try them on casino login pages. Many login pages reveal whether an account exists, so the scripts can target thousands of accounts in a few hours. One compilation, "Collection #1" from 2019, held nearly 2.7 billion email-and-password records covering 773 million unique addresses.

UK-licensed casinos use closed-loop payment systems that are meant to return money only to the card or account it came from. That protection assumes the person using the account is its real owner. In this case, a card with no deposit history was added and paid out twice in minutes. One UK-licensed operator source said the tools available to check who owns a card are "still inaccurate." At least one licensed operator has said it found and closed the specific weakness used in this type of theft.

"How is it my bank's fault when the card used to steal my money isn't theirs?" the affected player wrote on the forum. In a later post he added: "There's clearly something not right when a card can be added to an account without the account-holder's knowledge."

Regulation behind banking standards

UKGC technical standards expect licensees to protect players from "unnecessary security risks." However, 2FA is only encouraged, not required. UK banking made two-factor authentication effectively mandatory years ago under Strong Customer Authentication rules. In 2026, some UK-licensed casinos still don't offer 2FA at all, and many leave it optional and hidden in account settings.

Outcome

After the case drew attention on the Casinomeister forum, the casino said it had found no internal breach. It offered a full refund "as a gesture of goodwill" and said it would add optional 2FA "soon."

"The addition of 2FA can't come soon enough," the player said. "We all need to be more security-conscious in these times, so the more awareness the better, whether it's players, customers or businesses."

Advice for players

Casinomeister recommends that players:

• use a unique, long, random password for each casino account
• turn on 2FA wherever it's offered, using an authenticator app rather than SMS
• if they're targeted, freeze the affected cards, change all passwords, and complain in writing to the operator and the UKGC

Players whose complaints are dismissed can use Casinomeister's free player complaint service.

About Casinomeister

Founded in 1998, Casinomeister is one of the longest-established independent watchdogs in online gambling. It advocates for players, maintains standards for the operators it accredits, publishes news and guidance for the casino community, and runs a free Player Arbitration service that helps players resolve disputes with licensed casinos. Its focus throughout has been fair play, transparency, and player protection.

The full story is available at: https://www.casinomeister.com/blog/ukgc-casino-accounts-are-getting-robbed/

For further queries please contact team@casinomeister.com