Logo
external image

Oh goody! My online casino account got robbed... 😎

  • Thread starter Thread starter Lemon
  • id109048
  • Start date Start date
  • View count 5869
  • Replies 219
A fraud you say , but no breach ? That makes no sense at all and how does it sit with the closed loop deposit withdrawal system if anyone can add a card to another account with no verification and withdraw to it?
Unless it’s something more sinister as in someone has got access to your payment system and diverted a withdrawal made to the card on the account..

What I meant is that there has been no breach of the data stored with us. There were questions about whether passwords had been leaked from Videoslots, and my response was specifically referring to that.

I can’t comment on your other questions in relation to this specific account. However, generally speaking, it may be possible to introduce new payment methods to an account if the relevant loop has been closed.

There is always a balance between security and the customer experience. The more barriers we introduce to prevent scammers and fraudsters, the more friction we also create for legitimate players.

Fortunately, we rarely see issues of this nature. When they do occur, compromised credentials can originate from data breaches on other websites where the same or similar login details have been used, or potentially from malware on a user’s device. I wouldn’t be able to guess what happened in this case.

We will, of course, review our systems and processes to determine whether there are further improvements we can make to strengthen customer protection. However, for security reasons, details of such measures and internal controls are not something we will discuss in public forums.
 
I understand that it doesnt make sense. However, casinos cover these type events through their terms :(

The gesture is insanely kind if you ask me. VS didn't had to do it technically. So kudos to them.
So in a case like this it’s the customers fault a card that wasn’t attached to the account has been added and a large withdrawal sent to it?
Very surprised a customer could ever be held responsible for it happening and even more concerning that it’s not the first time it happened at VS.
 
good idea, but many wont take it imo. I wouldnt for sure. So there is still some risk.

I might have an extra solution for those that dont want to take 2fa. PM and ill explain.
@L&L-Jan just wondering what might make you not want to take 2FA?

Thinking of security - is the "Passkey" concept perhaps the modern way to go, it seems to pop up more often as an offer from websites.
 
A fraud you say , but no breach ? That makes no sense at all and how does it sit with the closed loop deposit withdrawal system if anyone can add a card to another account with no verification and withdraw to it?
Unless it’s something more sinister as in someone has got access to your payment system and diverted a withdrawal made to the card on the account..
Yes, great questions. The response came across a bit like “well it’s not our fault but because it garnered enough attention so we’ll provide a goodwill gesture. Oh and by the way, let’s change the subject to something about issues with Battles”.

From what AI tells me, a closed loop system is not mandatory in the UK but the UKGC strongly recommends one for AML purposes. I haven’t been able to fact check that but someone else may know better?

The only two plausible scenarios I can come up with is either Lemon’s login details got into the wrong hands (in which case it is hard to lay blame on the casino bar the sensible closed loop system), or that the casino’s systems were compromised (the casino’s responsibility).

I’m glad that Lemon got a good outcome, but will this likely happen to other customers?
 
@L&L-Jan just wondering what might make you not want to take 2FA?

Thinking of security - is the "Passkey" concept perhaps the modern way to go as well?
I think it has been mentioned before, but these things require the customer to opt into, and for those who are less technically inclined, they tend to not use such measures. Although to be fair, it’s not hard to set up and understand 2FA. Passkeys are definitely the way to go though.
 
Everyone should check the
You do not have permission to view link Log in or register now.
site. There have over the years been lots of high profile data breaches and also not so high profile ones.

For high profile ones, think Adobe, Linkedin and MySpace to name but three.

The key is to use unique hard as nails passwords on each and every online and offline account you have. Yes using 2FA is preferable if offered, of course but, using the same login credentials for all your accounts, sadly you are asking for trouble.

Case in point, if you put a gun to my head, I wouldn't even be able to tell you what my password is for 'Webzcas' here on the Casinomeister forum.
 
Yes, great questions. The response came across a bit like “well it’s not our fault but because it garnered enough attention so we’ll provide a goodwill gesture. Oh and by the way, let’s change the subject to something about issues with Battles”.

From what AI tells me, a closed loop system is not mandatory in the UK but the UKGC strongly recommends one for AML purposes. I haven’t been able to fact check that but someone else may know better?

The only two plausible scenarios I can come up with is either Lemon’s login details got into the wrong hands (in which case it is hard to lay blame on the casino bar the sensible closed loop system), or that the casino’s systems were compromised (the casino’s responsibility).

I’m glad that Lemon got a good outcome, but will this likely happen to other customers?
Exactly what happened last time.

Whilst it is the OPs responsibility to ensure his account is secure, it should also be VS to ensure their systems work effectively and securely.

Allowing a random card to be added and withdrawn to is absurd.
 
Exactly what happened last time.

Whilst it is the OPs responsibility to ensure his account is secure, it should also be VS to ensure their systems work effectively and securely.

Allowing a random card to be added and withdrawn to is absurd.
Agreed - makes me feel like I should close my videoslots account.............oh wait a minute.....
 
Happy that Lemon has been told he will get his money back (hopefully in cash and not free spins on starburst)

The whole response of "as a gesture of good will" really winds me right up. If someone commits fraud on your account, a player, especially at a UKGC accredited casino should not have to expect a "good will" gesture to get their funds back, especially when a rouge withdrawal method has been used. It should be returned straight away after investigation. Don't make it sound like you are doing the guy a favour.

I firmly believe the only reason that the "good will gesture" has even happened is due to the post on Casinomeister - shows the strength of the forum (which is good) but I doubt if this had been done through "normal" channels the result would be the same (or as quick)
 
This is another reason why there should be personal vaults. Place some or all of your winnings in the vault if you don't want to cash it back to your bank for one reason or another. Then if you want to take some out later, possibly receive a withdrawal code to the email on your account or use an authenticator app. I'm using authenticator apps just to place a prescription with my doctor these days, everything's gone authenticator app mad!
 
This is another reason why there should be personal vaults. Place some or all of your winnings in the vault if you don't want to cash it back to your bank for one reason or another. Then if you want to take some out later, possibly receive a withdrawal code to the email on your account or use an authenticator app. I'm using authenticator apps just to place a prescription with my doctor these days, everything's gone authenticator app mad!
100% - All apps I use for work nowadays require 2FA with Authenticator.
 
Same - and they all log me out after 30 days and have to do them again - it gets annoying but it is what it is
My energy company does this auto log out which winds me up.

Ah yes indeed. Security vs Convenience.

I noticed that even The National Lottery website doesn't offer 2FA or Passkeys. Just the basics.

Seems to be industry norm for gambling maybe.
 
Exactly what happened last time.

Whilst it is the OPs responsibility to ensure his account is secure, it should also be VS to ensure their systems work effectively and securely.

Allowing a random card to be added and withdrawn to is absurd.

Don’t forget that even with closed loop, there will be times when the loop is clear thus being able to setup and withdraw to a new method.

It looks like this might have been the case here, but that’s where a validity check for new methods would have prevented an unauthorised transaction to a third party.
 
Don’t forget that even with closed loop, there will be times when the loop is clear thus being able to setup and withdraw to a new method.

It looks like this might have been the case here, but that’s where a validity check for new methods would have prevented an unauthorised transaction to a third party.
I agree, it is possible, but unlikely.

The main point is that an unverified card was seemingly allowed to be withdrawn to. A new method is fine, but surely it should be verified first.

Seems rather bizarre a casino would let you withdraw to any card whatsoever, normally it's the shoe on the other foot, they want to see pics of card, inside leg measurement, what you had for breakfast. etcetc. Remember VS is a UK facing casino.
 
Everyone should check the
You do not have permission to view link Log in or register now.
site. There have over the years been lots of high profile data breaches and also not so high profile ones.

For high profile ones, think Adobe, Linkedin and MySpace to name but three.

The key is to use unique hard as nails passwords on each and every online and offline account you have. Yes using 2FA is preferable if offered, of course but, using the same login credentials for all your accounts, sadly you are asking for trouble.

Case in point, if you put a gun to my head, I wouldn't even be able to tell you what my password is for 'Webzcas' here on the Casinomeister forum.

Yep only downside is it makes targetting someones google account etc much more valuable when they store passwords via that you are hitting the jackpot if you have enough information and the means to pull off a sim swap attack etc to defeat 2FA then get someones entire google account saved passwords and email in 1 attack. Lots of huge crypto thefts happening this way.
 
This is another reason why there should be personal vaults. Place some or all of your winnings in the vault if you don't want to cash it back to your bank for one reason or another. Then if you want to take some out later, possibly receive a withdrawal code to the email on your account or use an authenticator app. I'm using authenticator apps just to place a prescription with my doctor these days, everything's gone authenticator app mad!
If somebody wants to hijack my monthly prescription for anal suppositories they are welcome to them!
 
We seem to have finished up with more questions than answers here. Back when I was still playing at VS I remember adding a new card to my account but it wouldn't let me withdraw to it until it'd equalised with some deposits, something like that anyway.

I also remember having to go through some fairly thorough checks with ID, card verifications, and bank statements at more than one point too. (Which to be clear, I was alright with as part of an overall model of good account security, even if those things can be a pain in the arse.) Also adding a new card came with extra verifications in and of itself - which again, I can understand.

As such, how a new card gets added to a VS account and a decent chunk of cash gets withdrawn to it, with the player claiming they had nothing to do with it, and the casino claiming there was no breach, is beyond me.

Whatever has happened behind the scenes here, the message for the rest of us is 'nothing to see'.

1790148876065.webp
 
As in google password manager?

Yep, I never use any online service to store my passwords. I am old school. Do not trust the cloud, so have my own NAS, Store all my passwords locally on that in an encrypted file. Not 100% bullet proof, nothing ever is, but as near as :cool:
Yes like if your google account is signed into chrome/your android etc and saving them to your google account. The upside is when you change phones/device etc the transition is really user friendly and its 1 or 2 taps to enter your details for username/password every time.
 
I remember first signing up to VS - it was based on this CM forum, the review and also at the time (2018) it was all the rage. I still think VS is a great place to play, the battle system is very unique and I have never had any problems with withdrawals. Until recently never really had any need or cause to talk to Customer Services much. (aside from the odd free spins not activating)

We have reps on this forum and this is a big plus. I feel like VS would always put things right when something goes wrong.

Of course this thread is a concern, and while it would be great to know the whole story, its a complicated matter so I can understand it might not be possible for Lemon/VS to comment.

But as long as @Lemon is happy with VS that is most important thing.

I still think its valuable to know when these things happens so that other players can read and see. We may think our casino balance is secure, but actually, there are situations that could happen to any of us that change that at a moments notice.

The biggest question on my mind, taking VS away from the scenario, more generally if a players balance "goes missing" for whatever reason, what protections does the player have? Can a casino really just say "The security of your account is the players responsibility". How can a casino/player prove or disprove whether it is a security issue for casino/player or if its a system error or bug. :what:
 
So I had a scan through my emails from VS and here's the last time I added a new card to my account, which was a virtual Revolut card. As you can see I had to get the thing verified and pass a security check and also, from memory, I had to make a deposit or deposits with it, up to a certain value before it would let me withdraw to it. (Something like that anyway. It also didn't like me mixing and matching, i.e. depositing with one card and withdrawing to another, even with both cards, and my identity, being fully verified.)

Either way adding a new card to my account was a non-trivial process, and triggered more than one security process. (Which as I noted above, feels like a faff, but I understand why casinos do it so I did what they asked.)

I note Mr Wild explicitly states there was 'no breach' of data from VS, and also refers to the 'relevant loop' having been fulfilled. My own experiences at VS over the years was always that they were pretty solid on identity and payment method verifications. (I've got a 'Casino Docs' archive on my NAS which, amongst other things, holds all the stuff VS have asked for over the years, and it's a lot!)

There is some 'reading between the lines' here that we can do IMO, although since that's disappearing off into the realms of speculation, I'll leave it there.

1790166331279.webp


1790166377593.webp

1790166398076.webp
 
I can also say that this is becoming a much bigger issue now then it once was. In all my years slotting it may have happened once or twice max, in which somone tried to access one of my casino accounts.

Its now becoming a weekly thing almost. Emails from different U.K casinos alerting me someone has attempted to login to one of my accounts now becoming a normal thing.

Last week someone tried one of my uk casino accounts and a few days ago another UK casino account of mine.

Both not small sites either but rather the huge sites you see on tv etc. Im not saying which sites they were for obvs reasons but you can figure it out.

Its becoming more and more often now, in the past it used to be very very rare that it happened but now thats not the case anymore

the best way to avoid this is to use 2 factor connecting your phone or an authenticator app but if your details have already been breached and leaked on to the dark web years ago, like mine were, then you need to change all your passwords like i had to else they will keep trying to login until they eventually do.
 
Shocking from Videoslots i might add also. And no surprise it was them, Still running on there tinfoil servers for there freeroll battles 12 years later after making multi millions in profit.

And obviously still using tinfoil security protection for their players accounts also.

:mad:
Also going off topic at little there customer service is shocking when ever I’ve been raised an issue like depo bonus not added or missing rewards it always takes them WEEKS to sort it. Only reason I play there is cause I like there layout on the PC but i think im gonna start going back to L&L casinos @L&L-Jan will be happy to find out 😂🎉🎉
 
Also going off topic at little there customer service is shocking when ever I’ve been raised an issue like depo bonus not added or missing rewards it always takes them WEEKS to sort it. Only reason I play there is cause I like there layout on the PC but i think im gonna start going back to L&L casinos @L&L-Jan will be happy to find out 😂🎉🎉
Same mate, takes weeks to get errors fixed on games or missing rewards, broken rounds etc. Evey battle night full of lag etc. Its old news now, i just play at other places instead now.
 
... will this episode have any impact on CM's rating of 9.1 for Videoslots?
Well, let me start by saying "probably". Why? because I'm going to recommend that VS be given a bit of a bump up in their Support score.

For a casino to deal directly with a breach like this in little more than 48 hours to include assuring the player they'd compensate the theft AND commit to adding new security measures is pretty rare in cases like this. We've been dealing with situations exactly like this for years now, increasingly so as time goes on, and I can report that most casinos simply say "not our problem" and wash their hands of it.

For VS to do what they have done here speaks very well of them. The fact that the OP has thanked VS for their part in it and made it clear that it's "case closed" from their point of view should be given a lot more weight here than has been the case. IMHO.

As to the issue of the new card being introduced and used to WD without prior verification I have to admit that I'm not yet clear on whether there was an actual fault in VS's system or not. My guess is not but we'll see.

That said the prevailing issue here -- as has already been said -- is the constant balancing act between verification and inconvenience. Casinos have to walk the line between protecting players and pissing them off with the hoops and hurdles that necessarily come with increased protections. Errors will be made as systems adapt. The primary concern is whether a player who had money stolen through no fault of their own was taken care of, and we all know that the answer here was "yes". In my experience that's commendable.
 
PS. I'm well aware of the argument that VS "only did the right thing because of posts here on CM."
Maybe true, maybe not, but at least they are here, and responding, and doing the right thing. There are countless other casinos that are not and would not, so I count them being here a big net gain for us all, to include the OP.
 
I guess the next question is will this episode have any impact on CM's rating of 9.1 for Videoslots?

Sure, they refunded the customer, but it really wasn't handled that well.
From my perspective, they couldn't really have handled it any better. Massive kudos to them 👍
 
Hello,

I’ve been following up on this today.

We have investigated the matter and found no indication of any breach on Videoslots. However, as a gesture of goodwill, we will cover the losses you incurred due to the fraud.

We are also adding the option to enable two-factor authentication (2FA), which will provide an additional layer of security for customer accounts. Will become available soon.


Regarding the issues flagged with Battles, these were caused by delays in WebSocket updates and caching. A fix was deployed today to address this.

The winning scores themselves are public, as they represent each player’s score in the Battle. However, there was an issue with the previous Battle’s scores not being cleared quickly enough when a new Sit & Go Battle started. This was caused by the same delay and has now been addressed.
Having my own personal Groundhog Day with the payments team at @Team.Videoslots @Mr Wild Can you please save my sanity i sent a DM

@Lemon sorry to semi hijack ur thread pal
 
I guess we'll have to agree to disagree @maxd. With the initial response of "talk to your bank" through to taking action here after several members shared their concerns with the situation, I would have expected any final outcomes to balance out how this was handled, at most.

The OP is happy, which is brilliant, but the casino could have handled this a little better.
 
For a casino to deal directly with a breach like this in little more than 48 hours to include assuring the player they'd compensate the theft AND commit to adding new security measures is pretty rare in cases like this. We've been dealing with situations exactly like this for years now, increasingly so as time goes on, and I can report that most casinos simply say "not our problem" and wash their hands of it.

For VS to do what they have done here speaks very well of them. The fact that the OP has thanked VS for their part in it and made it clear that it's "case closed" from their point of view should be given a lot more weight here than has been the case. IMHO.
Sorry Max I don't agree with this - there was no real assurance to the player. It was quite clear in their response that it was "a gesture of good will" and they still have not answered the querey around the closed loop system - unless ive missed it, effectivley its a "it happens but not going to disclose why and how we will fix it"

Happy that Lemon got their money back (which should never have been in question), but boosting their score becuase they did the right thing just feels off to me
 
Sorry Max I don't agree with this - there was no real assurance to the player. It was quite clear in their response that it was "a gesture of good will" and they still have not answered the querey around the closed loop system - unless ive missed it, effectivley its a "it happens but not going to disclose why and how we will fix it"

Happy that Lemon got their money back (which should never have been in question), but boosting their score becuase they did the right thing just feels off to me
In fairness to VS, we don't actually have the full story. What we do know is that the issue was investigated, funds returned and new security measures will be introduced. That's pretty impressive in a relatively short timeframe.

In any case, shouldn't CM be rewarding casinos that are doing the right thing?
 
In fairness to VS, we don't actually have the full story. What we do know is that the issue was investigated, funds returned and new security measures will be introduced. That's pretty impressive in a relatively short timeframe.

In any case, shouldn't CM be rewarding casinos that are doing the right thing?
100% agree that any casino should be rewarded for doing the right thing, but as you state we still don't have the full story.

Im not saying there score should be dropped, but I don't think it should be increased because they have returned stolen funds because someone was able to withdraw to a non-approved method
 
Well, let me start by saying "probably". Why? because I'm going to recommend that VS be given a bit of a bump up in their Support score.

For a casino to deal directly with a breach like this in little more than 48 hours to include assuring the player they'd compensate the theft AND commit to adding new security measures is pretty rare in cases like this. We've been dealing with situations exactly like this for years now, increasingly so as time goes on, and I can report that most casinos simply say "not our problem" and wash their hands of it.

For VS to do what they have done here speaks very well of them. The fact that the OP has thanked VS for their part in it and made it clear that it's "case closed" from their point of view should be given a lot more weight here than has been the case. IMHO.

As to the issue of the new card being introduced and used to WD without prior verification I have to admit that I'm not yet clear on whether there was an actual fault in VS's system or not. My guess is not but we'll see.

That said the prevailing issue here -- as has already been said -- is the constant balancing act between verification and inconvenience. Casinos have to walk the line between protecting players and pissing them off with the hoops and hurdles that necessarily come with increased protections. Errors will be made as systems adapt. The primary concern is whether a player who had money stolen through no fault of their own was taken care of, and we all know that the answer here was "yes". In my experience that's commendable.
This is exactly why they have been my number 1 go too casino to chance my money on. Their dedication to "doing the right thing" is second to non given the hand they have been given by the UKGC :thumbsup:
 
We still don't even know how the VS account was illegitimately accessed in the first place, we can perhaps surmise that it was the same password used elsewhere that was at some point included in a data breach and then brute-forced into VS at a later date.

My VS account has a strong, unique password on it (which has been basic internet security for at least the last thirty years), and whilst there's no money in there, simply getting into the account could reveal an amount of personal information. (I should just close the account really, but as ever with gambling, never say never and all that...... :D )

Do the rest of us need to worry about the security of our VS accounts, or as long as it has a unique password on it, are we good?

We also don't know how a new payment method was then added at VS and subsequently used to clean out the OP's account, despite the OP having never gone through any verification/identity processes to authorise it for such actions.

I read the article that was linked off from here, and whilst the advice it contains is all perfectly valid, it still leaves unanswered questions.


How UKGC Casino Accounts Get Robbed and How to Prevent It
 
We also don't know how a new payment method was then added at VS and subsequently used to clean out the OP's account, despite the OP having never gone through any verification/identity processes to authorise it for such actions.
Yes, which is why I said above :
"As to the issue of the new card being introduced and used to WD without prior verification I have to admit that I'm not yet clear on whether there was an actual fault in VS's system or not. My guess is not but we'll see."​

I am seeking insights from VS and will report back in due course.
 
Last edited:
In fairness to VS, we don't actually have the full story. What we do know is that the issue was investigated, funds returned and new security measures will be introduced. That's pretty impressive in a relatively short timeframe.

In any case, shouldn't CM be rewarding casinos that are doing the right thing?
I don't know if you are old enough to remember the NZ appliance store LV Martin & Son, but they had a terrible motto which was "It's the putting right that counts". Get in right in the first place and you don't need to put it right. Sure things do go wrong, but to build your marketing around that?

You cannot always take a shallow view of things. You are correct in saying we don't know the full story (and may never know), but we do know that the initial response was to "sort it with your bank", and we do know that the rep seemingly reluctantly gave a goodwill gesture after this thread gained traction. And we know that the casino allowed a significant balance to be withdrawn to a new payment method.

So there are definite positives and negatives here, but to reward the casino with a higher rating because of this is very wrong in my opinion.
 
I don't know if you are old enough to remember the NZ appliance store LV Martin & Son, but they had a terrible motto which was "It's the putting right that counts". Get in right in the first place and you don't need to put it right. Sure things do go wrong, but to build your marketing around that?

You cannot always take a shallow view of things. You are correct in saying we don't know the full story (and may never know), but we do know that the initial response was to "sort it with your bank", and we do know that the rep seemingly reluctantly gave a goodwill gesture after this thread gained traction. And we know that the casino allowed a significant balance to be withdrawn to a new payment method.

So there are definite positives and negatives here, but to reward the casino with a higher rating because of this is very wrong in my opinion.
Can't say I recall that brand, and while I get your point, the harsh reality is that things go wrong. Putting them right is about the best you can do in these situations.

Initial response appeared to be a bit poor though, I agree there.
 
I don't know if you are old enough to remember the NZ appliance store LV Martin & Son, but they had a terrible motto which was "It's the putting right that counts". Get in right in the first place and you don't need to put it right. Sure things do go wrong, but to build your marketing around that?

You cannot always take a shallow view of things. You are correct in saying we don't know the full story (and may never know), but we do know that the initial response was to "sort it with your bank", and we do know that the rep seemingly reluctantly gave a goodwill gesture after this thread gained traction. And we know that the casino allowed a significant balance to be withdrawn to a new payment method.

So there are definite positives and negatives here, but to reward the casino with a higher rating because of this is very wrong in my opinion.

I believe Mr Wild is not just a rep, he is the owner of VS
 
I believe Mr Wild is not just a rep, he is the owner of VS
i believe it is a rep - why would an owner be on a forum?

Like my boss? He is probably not able to find register button for CM - however if its a casino website he has snake eyes :)
 
i believe it is a rep - why would an owner be on a forum?

Like my boss? He is probably not able to find register button for CM - however if its a casino website he has snake eyes :)

(1) Cause the reps have their seperate account here on Casinomeister from which they post
(2) Some of Mr Wild's posts have information that a rep wouldn't necessarily know
(3) I once had some nice caviar on a boat in Malta with Alexander
 

Users who are viewing this thread

Accredited Casinos

Back
Top