Two-factor authentication for casino apps

How to set up two-factor authentication for casino apps

Where a casino supports 2FA, the setting sits with your other login options. The menu names change from brand to brand, but the flow below is typical.

1. Log in to the casino app and open the account menu, usually the person icon or your balance.
2. Look for Security, Login & security, Account settings or Privacy.
3. Choose two-factor authentication, two-step verification or login verification and tap Turn on.
4. Pick a method: text message, email or authenticator app. Choose an authenticator app if it’s offered.
5. Enter the code the casino sends or your authenticator shows, to prove the method works.
6. Save the backup or recovery codes somewhere safe, such as your password manager, before closing the screen.

From then on, a new phone, tablet or browser asks for the second step after the password. Your own phone usually remembers itself as trusted for a set period. Our glossary entry on two-factor authentication explains the jargon.

Types of two-factor authentication you may be offered

Authenticator apps include Google Authenticator and Microsoft Authenticator, and the Passwords app built into recent iPhones can generate codes too. They work offline, which helps when travelling.

Linking an authenticator app to a casino account

Setting up an authenticator on the same phone as the casino app takes a slightly different route from the usual QR scan, because you can’t point the phone’s camera at its own screen.

1. In the casino’s security settings, choose authenticator app.
2. Tap the option to copy the setup key, or Set up on this device if shown, rather than scanning the QR code.
3. Open your authenticator, add a new account and paste the key, naming it after the casino.
4. Switch back to the casino app and type the six-digit code now shown.
5. Store the backup codes the casino gives you, ideally in a password manager.

If your casino app doesn’t offer 2FA

There’s no UK rule requiring casinos to offer two-factor login, and none of our partners’ store listings mentions it, so you may not find the option. You can still make your account much harder to take over.

• Use a unique password. Most account takeovers start with a password reused from a site that was breached.
• Put 2FA on your email. The casino’s password reset goes to your inbox, so a weak email account is a back door.
• Turn on biometric login where offered, so you rarely type the password on screen. See how to enable Face ID on casino apps.
• Keep login alerts on. If the casino emails you about new sign-ins, read them rather than filing them.
• Ask support. Some casinos can add security questions or verbal passwords on request.

Our wider guide on keeping your casino account secure covers every layer.

Protect the accounts behind your casino account

A casino account is linked to several others that matter just as much. Each has its own 2FA, and all are free to turn on.

• Apple Account: two-factor authentication is on by default for most accounts; check Settings > your name > Sign-In & Security.
• Google account: turn on 2-Step Verification in your Google account’s Security settings, which protects Play Store and Google Pay.
• Email: Gmail, Outlook and iCloud Mail all support 2FA or passkeys.
• PayPal and e-wallets: if you deposit with one, switch on its two-step login.
• Your mobile network: ask your provider about a SIM PIN or port-out protection, which makes SIM-swap fraud harder.

Your bank already adds a second step to many online card payments under Strong Customer Authentication, which is why a casino deposit can trigger an approval in your banking app.

2FA is not the same as casino verification

People often mix up three different checks. Two-factor authentication proves it’s you logging in. KYC verification proves who you are and your age, and every UK casino must complete it before you deposit or play demo games. Strong Customer Authentication is your bank checking a payment. A casino app may ask for all three at different times, and only the first is optional. See casino app verification for the identity side.

Changing or losing your phone with 2FA switched on

2FA is only a problem if the second factor disappears with no backup. Before you trade in or reset a phone:

1. Open your authenticator app and use its transfer or export option to move codes to the new phone, or rely on its cloud backup if you’ve enabled one.
2. Log in to the casino on the new phone and confirm the codes work before wiping the old one.
3. Keep your mobile number when switching networks, so text codes still arrive.
4. If you have no access to codes, use a backup code or contact the casino’s support team, who will verify your identity before resetting 2FA.

If the phone was lost or stolen, act quickly; our lost or stolen phone guide sets out the order to do things in.

Scams that target your two-factor codes

2FA works only while the code stays with you. Fraudsters therefore try to make you hand it over:

• a call or message claiming to be the casino’s security team, asking you to read back a code to stop a suspicious withdrawal;
• a text with a link to a fake login page, which passes your password and code to the real site in real time;
• a bogus app in a search result or link that copies the casino’s login screen;
• a push approval you didn’t start, sent in the hope you’ll tap Approve by reflex.

Genuine casino staff never need your 2FA code or password. If in doubt, close the message and open the app yourself. Our guide to spotting fake casino apps shows how to check a listing.

What to do if someone gets into your casino account

1. Change the casino password straight away from a device you trust, and change it anywhere else you used it.
2. Turn on 2FA if available and sign out of all other sessions.
3. Contact the casino’s support. 10bet, for example, lists a UK phone line on 0808 175 0550 from 08:00 to 23:00, and Coral publishes help@coral.co.uk for email.
4. Check your transaction history and withdrawal methods for anything you didn’t add.
5. Tell your bank if a card or account linked to the casino may have been misused.

Withdrawals can only go back to methods registered on the account, under the closed-loop rules casinos follow, which limits what a fraudster can take. Our page on a hacked casino app account has the full process.

Licensed casino apps with clear account security

PlayOJO and 10bet are both licensed by the UK Gambling Commission and available on the App Store and Google Play; check each app’s security settings to see which login protections it offers. Their welcome offers are for new customers aged 18 or over, with terms covering minimum deposits, spin values or wagering, and expiry.

18+. Gambling should be entertainment that costs money, not a way to make it. Set a deposit limit before you play: how to set limits. Free, confidential help: National Gambling Helpline 0808 8020 133.