Casino account hacked? Act fast with these 5 steps
Your sweepstakes casino account has been compromised, or you think it has. Don’t freeze, and don’t start clicking at random. There is a correct order to work in, and following it gives you the best chance of saving your balance and your identity. Here’s what to do:
Content Manager
Last updated
16 June 2026
Take one breath. The next ten minutes matter more than the next ten hours, but only if you spend them on the right things. Someone who has your login is trying to turn that access into money: by draining your balance, spending the cards you have saved, or stealing the personal documents you uploaded to verify the account. Your job right now is to cut off those routes and lock the doors they could use to get back in.
Work top to bottom, and don’t skip ahead.
First, are you actually hacked?
You do not need to be certain to act because acting early rarely costs you anything. These are the signals that matter:
- A login alert, a password reset email, or a new device notice you did not trigger.
- Your password suddenly stops working, or the email or phone number on the account has changed.
- Redemptions, withdrawals, or Gold Coin purchases you did not make.
- A payout method you do not recognize, whether a bank, PayPal, Skrill, or a crypto address.
If you see any of these, treat it as real and move.
The five things, in order
1. Secure your email first.
This is the step most folks tend to get wrong, and the order is the whole point. Your email is the master key because most password resets and identity checks run through it. So, if an attacker is already sitting in your inbox, changing your casino password just hands it straight back to them.
Start there:
- Change your email password, sign out of every device (the control is usually under the inbox’s security settings), and switch to two factor authentication (2FA).
- Do all of this from a device you trust.
- If you cannot get into your email at all, use the provider’s account recovery before anything else, because until the inbox is yours again, nothing else you reset can be trusted.
2. Lock down your casino account.
With the inbox secured, the casino password is finally worth changing, so change it to something new and unique. Then, find the option to log out of all sessions or sign out everywhere, because changing a password does not always end a session the attacker already has open; you have to revoke the active ones, too. Switch to 2FA, if the site offers it.
If you are locked out, the password reset is now safe to use since your email is back under your control. If you still cannot get in, move straight to the next step, because at that point, getting support to freeze the account is the priority, while it stays open and your money is still reachable. Support is also your route if the attacker has added their own 2FA to keep you out.
3. Cut off your funds.
With access locked down, the attacker’s real goal is what is left exposed: the money. This is also where sweepstakes accounts differ from an ordinary login because your balance and your saved payout methods are sitting right there inside the account. Work the money trail in order:
- Remove your saved payment methods, both cards and wallets.
- Check your payout and redemption details, and change them back if they have been altered, because attackers reroute redemptions to their own account rather than yours.
- Cancel any pending redemptions or withdrawals you did not start, if the platform allows it.
- Contact the casino’s support or fraud line and ask them to freeze the account, using the contact details shown on the site itself, never a link sent to you in an email or text.
Tip: Protect Your Payment Method Too
If you are locked out and support is freezing your account for you, ask them to do these same things: Strip the saved payment methods and cancel any redemption you did not start.
Then, deal with the card behind the account: call your bank or card issuer, report the saved card as compromised, dispute any charges you did not make, and ask for a replacement number. Most banking apps also let you freeze the card yourself in seconds, which is faster than waiting on hold. A dispute reverses one transaction; a new card number stops the ones still coming.
4. Close the back doors elsewhere.
The hacked account is now sealed; what is left at risk is every other account that shares its password. Reused passwords are how a single stolen login becomes ten compromised accounts, so if the password from your sweepstakes casino or your email is used anywhere else, change those, too, in order of damage: your bank first, then PayPal or Skrill, then any crypto exchange or wallet, then any other casino or fintech account. Give each one a password of their own.
5. Keep a record as you go.
Unlike the first four, this one runs alongside them, rather than after them. Document what you find as you find it because your bank’s dispute team and any fraud report will rely on it later. Screenshot the unauthorized logins, the altered details, and any charges or deposits, and note the date, time, and amount of each.
Where you can, capture a screenshot before you change something back, but never let record keeping slow down locking the account, because stopping the loss comes first.
Once the bleeding stops: the next 24 to 48 hours
Rule out a compromised device.
A login can leak from malware on your own computer or phone, an ‘infostealer’, rather than from a website breach, and if that is the cause, the passwords you just changed will leak too. Run a full antivirus and antimalware scan; if it finds something, clean the device first, then change your important passwords again from a device you know is clean.
Measure how far the exposure goes.
Enter your email address at Have I Been Pwned, a free service run by an independent security researcher, to see which breaches and passwords of yours are already public.
Protect your credit.
Both tools below are free, and which one you choose depends on how much was taken. A fraud alert asks lenders to verify your identity before opening new credit in your name; it lasts one year, and you contact only one of the three bureaus, which is then required to notify the other two.
A credit freeze is stronger because it blocks new lenders from pulling your report at all; you place it at each of the three bureaus separately, and it stays until you lift it. Choose the freeze if your ID, Social Security Number, or the identity documents you uploaded may have been exposed.
The three credit bureaus:
- Equifax: 1 (800) 685 1111, equifax.com
- Experian: (888) 397 3742, experian.com
- TransUnion: (888) 909 8872, transunion.com
The week after: closing it for good
- Move every account onto its own unique password using a password manager, such as Bitwarden or 1Password, both of which also flag the reused and weak passwords you still need to fix, so one leaked password can never open a second door again.
- Upgrade your 2FA. Text message codes can be defeated by a SIM swap attack, where someone takes over your phone number, so switch to an authenticator app, such as Authy or Google Authenticator, or, where it is offered, a passkey, which ties the login to your device so it cannot be phished.
- Stay alert to the scams that follow. Fraudsters know a newly hacked person is rattled and will send fake “security” warnings to finish the job, so reach any site through your own bookmarks rather than a message, and ignore unexpected requests to “verify” anything.
- Watch your money for a few weeks, including your bank statements, card activity, and login and redemption history, and pull your free weekly credit reports at AnnualCreditReport.com (1 (877) 322 8228) to check for accounts you never opened.
An honest word about getting your money back
This is the part most guides leave out. Many sweepstakes operators are based offshore and lightly regulated, and their fraud support runs from genuinely helpful to nonexistent. A sweepstakes balance carries no FDIC insurance, the federal cover that protects bank deposits, and no gaming regulator backstop, so some operators will investigate and restore a drained balance, while others will point to their terms and refuse.
That is exactly why the order above secures your email, your card, and your reused passwords first: Those are the doors you actually control. File the complaint with the casino and keep your evidence, but pursue the chargeback through your bank, and do not stake your recovery on the operator’s goodwill.
This guide is general information, not legal or financial advice. If your identity has been misused or a significant sum is involved, the resources above, in particular IdentityTheft.gov and your bank’s fraud department, can guide you through the specifics of your situation.
