Security · 7 min read

Pokies Security Guide — Player Safety Checklist

By Mira Fenwick · Updated 23 July 2026

Depositing at an offshore pokies site means trusting a company outside Australia's regulatory reach with your money and, eventually, your identity documents. That trust is not unreasonable if the site is well-chosen — plenty of long-running operators have strong security practices — but it is a decision that deserves a checklist rather than a gut feel.

The 90-second pre-deposit check

Before you commit a dollar, run through the following in about ninety seconds:

1. Licence in footer. Scroll to the bottom of the site's homepage. You should see a named regulator (Curaçao GCB, Anjouan AGA, Malta MGA are the common ones) and a licence number.
2. Cross-check the licence. Go to the regulator's public register and search for the licence number. If the register doesn't return the site's name, that's a red flag.
3. TLS in the browser. Every page — not just the deposit page — should load with HTTPS and a valid certificate. Modern browsers show a padlock icon; if it's missing or shows a warning, close the tab.
4. Terms and conditions accessible. Bonus terms, withdrawal terms, and general terms should all be reachable in one click from the footer and dated with a "last updated" line.
5. Support that answers. Open live chat with a genuine question ("what's your maximum withdrawal per week?") before depositing. If it takes more than 5 minutes to get a coherent answer, that's a preview of how things will go if something goes wrong later.

Account hygiene

Once you've signed up, the security burden shifts partly to you. Two things dramatically reduce your risk of account compromise:

• Unique password. Use a password manager (1Password, Bitwarden, Apple Passwords, Google Password Manager) to generate a random 16+ character password used nowhere else. Reused passwords are the single biggest cause of account takeover.
• Two-factor authentication. Every reputable site now offers this — usually via authenticator app rather than SMS. Turn it on. It's a 60-second setup that prevents almost every credential-stuffing attack.

What data the site actually holds about you

After KYC, a typical pokies site holds: your full name, date of birth, residential address, mobile number, email, a scan of your ID document, a proof of address document, your bank account name (visible via PayID transfers), and your full gameplay and transaction history. That's a meaningful data footprint. A site with a serious data breach could expose all of it.

You cannot eliminate this risk while playing at any site, offshore or otherwise. You can minimise it by using unique email addresses per site (many email providers support plus-addressing), keeping the same password unique per site, and closing accounts you no longer use — most sites will delete records on request after a legally-mandated retention window (usually 5-7 years for gambling operators).

Payment security specifics

PayID is one of the safer deposit methods precisely because it doesn't require sharing card numbers or online banking credentials with the casino. The bank sees the transfer, the casino sees the payment arriving, but neither has ongoing access to the other's system. For a fuller walk-through of the deposit flow, our PayID deposit guide covers what each party actually sees.

If you use card deposits at any site, use a virtual card number (available from Wise, Revolut, or your bank's virtual-card feature) rather than your physical card. If the site is ever breached, the exposed number can be deleted and replaced without affecting your real card.

What responsible-gambling tools tell you about a site

The quality of a site's responsible-gambling toolkit is a strong proxy for its overall integrity. Serious operators build meaningful deposit limits, loss limits, session-time reminders, and self-exclusion options because their licences require it and because their long-term business depends on players who don't burn out and leave. Weak operators offer only cosmetic tools — a deposit limit that can be raised instantly without a cooling-off period, for example, is worse than useless. If you can't find responsible-gambling settings inside your player account within about a minute, the site is either badly designed or actively hiding them. Both are reasons to reconsider.

Complaint escalation — knowing your options in advance

Every legitimate site has an internal complaints process, an external mediator via its licence, and a public complaint forum where disputes eventually air. Understanding this ladder before you have a problem helps you resolve it faster if one arises. Start with the site's live chat. If unresolved after 48 hours, escalate to their formal complaints email address (usually in the terms document). If still unresolved after 14 days, contact the licensing regulator directly — Curaçao's post-2024 process and Malta's MGA both have public complaint portals. Documented, dated evidence of each escalation step strengthens your position considerably.

Recognising phishing and impersonation

The most common attack against pokies players isn't a breach of the site itself — it's a phishing email pretending to be from the site, sent to your registered email address, asking you to "verify your account" or "claim a bonus" by clicking a link that leads to a lookalike login page. If in doubt, don't click the email link. Go directly to the site by typing the URL you already know, and check whether the "urgent" message exists inside your logged-in account. It almost never will.

For more general context on how we assess sites across the security dimension among others, see the methodology section on our main homepage. And if you feel a site has mishandled your data or account, our responsible gambling resources include contacts for external complaint escalation.