Betting accounts are attacked because they hold money and because a compromised account can be emptied through a legitimate-looking withdrawal. The defences are all free and all take a few minutes.
This page sets out the account security measures worth putting in place, and what to do immediately if an account is compromised.
Eligibility Requirements at a Glance
What is generally required to withdraw.
- Be 18 years or older — gambling by anyone under 18 is prohibited
- A verified account registered in your own name
- Identity verification completed under the operator’s FICA obligations
- A payment method in your own name matching the account holder
- Any wagering requirement on a bonus fully met
- The withdrawal at or above the operator’s minimum amount
- No security hold, restriction or open investigation on the account
- An operator licensed by a provincial gambling board
Identification and Account Requirements
Use a unique password. A password reused from an email account or another site is the most common route in, because credentials leaked elsewhere are tried everywhere. A password used nowhere else removes that entire attack.
Enable two-factor authentication where the operator offers it. It is the single most effective control after a unique password.
Enable a SIM swap lock with your mobile provider. A fraudulent SIM swap gives an attacker the one-time PINs that protect the account, and the lock is free.
Never share a one-time PIN, password or account details with anyone, including someone claiming to be from the operator. Support will never ask for them, and this is how most accounts are emptied.
Beware of clone sites. Fraudulent sites copy branding and licence details to capture credentials. Reach the operator by typing the address yourself or through the provincial gambling board’s listing, not through an advertisement, a message or an unchecked search result. Check the domain for substituted characters.
Beware of fake support accounts. Social media profiles impersonating operator support are common and are used to obtain credentials from people who have posted a complaint. Contact support only through the operator’s own site or app.
Documents and Verification Required
The verification document set.
- South African ID document, smart ID card or valid passport with a permit
- Proof of residential address, where the operator requires it
- Proof of the payment method — a bank statement or card image in your own name
- A selfie or live photograph, where identity verification requires it
- A cellphone number and email address registered to you
- Banking details in your own name matching the registered account holder
Fees, Limits and Service Conditions
If an account is compromised, act in this order: change the password immediately, revoke any active sessions, contact the operator in writing to report it and request a freeze, contact your bank if a payment method was used, and change the password anywhere you reused it.
Report it to the operator in writing with times and amounts, and keep the reference. A verbal report leaves no record.
Report a payment fraud to your bank immediately. Time determines whether funds can be recalled.
Check your registered details afterwards. Attackers change the registered email address, cellphone number or banking details so a withdrawal routes to them. Verify all three after any incident.
Check the withdrawal history for payments you did not request.
Do not log in on shared or public devices, and log out rather than closing the app. Enable device biometrics and a screen lock.
Set a deposit limit at registration. Licensed operators must offer deposit limits, loss limits, session reminders and self-exclusion.
Never gamble with borrowed money or money you need.
Free, confidential help is available. The South African Responsible Gambling Foundation operates a national counselling line at no cost, and every licensed operator must offer self-exclusion. Self-exclusion can be requested from the operator and, through the provincial licensing board, applied across licensed operators.
Complaints go to the provincial gambling board that licensed the operator under the National Gambling Act 7 of 2004 and provincial legislation.
How to Apply, Open or Activate
Set up the account securely on day one: a unique password, two-factor authentication, a SIM swap lock, and a deposit limit. That is about ten minutes of work and it removes almost all of the risk.
If something goes wrong, change the password first, then report in writing, then check that your registered email, cellphone number and banking details have not been altered.
- Use a password you use nowhere else
- Enable two-factor authentication where offered
- Enable a SIM swap lock with your mobile provider
- Never share a one-time PIN or password with anyone
- Reach the site by typing the address or via the gambling board’s listing
- Check the domain for clone-site substitutions
- Contact support only through the operator’s own site or app
- If compromised: change password, revoke sessions, report in writing
- Check registered email, cellphone and banking details after any incident
- Do not log in on shared or public devices
Frequently Asked Questions
How do accounts get compromised?
Most often a reused password leaked elsewhere, a fraudulent SIM swap, a cloned site capturing credentials, or a one-time PIN shared with a fake support account.
What should I do first if my account is hacked?
Change the password, revoke active sessions, report it to the operator in writing and request a freeze, then contact your bank if a payment method was used.
Why check my registered details afterwards?
Attackers change the registered email, cellphone number or banking details so a withdrawal routes to them. Verify all three after any incident.
Is operator support on social media genuine?
Often not. Fake profiles impersonating support target people who post complaints. Contact support only through the operator’s own site or app.
Account security features, verification requirements, withdrawal rules and limits are set by each licensed operator and the provincial gambling authorities, and are revised. Confirm current requirements with the operator and its licensing board.