Is It Safe to Send ID to an Online Casino? 7 Checks

Yes, if the request comes from a licensed casino and you upload inside your logged-in account. Licensed sites must check who you are. The bigger danger is a fake “verification agent” on WhatsApp or Telegram, or a clean scan anyone can reuse. Send your ID only to a casino whose licence you have checked, only through its own upload page, and never with an OTP, bank login or card CVV. In November 2025, Singapore Police reported scammers swapping the face on NRIC copies that victims had sent them. Below: the rules, the red flags and seven checks.

Why a licensed casino has to ask for your ID

KYC (“know your customer”) is not a casino being nosy. It is a licence condition tied to anti-money-laundering and age rules.

Take the UK Gambling Commission, one of the strictest regulators. Since 7 May 2019, online operators must verify “the name, address and date of birth of any customer” and complete it before that customer is allowed to gamble.

The rules also say how long the data stays. Under the Commission’s anti-money-laundering guidance, identity records “must be kept for a period of five years after the business relationship with the customer has ended”. After that, personal data must be deleted unless a legal exception applies.

So a casino asking for ID is normal. A site that never asks, even when you withdraw a large sum, should worry you more. Our guide to licensed vs unlicensed casinos explains what that licence actually gives you.

Takeaway: a KYC request is a sign of a regulated site. Whether it is safe depends on who is asking and how.

What the rules ask for vs what scammers ask for

We wanted to know what regulators really require, so on 1 November 2026 we read three official pages: the UK Gambling Commission’s customer due diligence and record-keeping guidance, Singapore’s PDPC guidance on NRIC numbers, and the Singapore Police Force’s November 2025 advisory on doctored identity cards.

What we found:

• UK: identify the customer by name plus address or date of birth. Verify it “by documents or electronically”. Keep the records five years after the relationship ends.
• Singapore: private organisations may collect NRIC numbers or copies only when the law requires it, or when they need to verify identity to a high degree of accuracy.
• Police: never share images of ID documents without first checking who is asking and why.

None of these pages tells a business to collect your OTP, your online banking password or the CVV on your card. Those are exactly the items scam “verifiers” ask for.

Takeaway: the line is simple. Documents that prove who you are: possibly fine. Anything that lets someone move your money: never.

What can go wrong: casino data breaches

Licensed does not mean leak-proof. Three large, regulated casino companies have lost customer data since 2023, and two of them confirmed ID numbers were taken.

• Caesars Entertainment (Sept 2023): in its filing to the US SEC, Caesars said an attacker took a copy of its loyalty programme database, “which includes driver’s license numbers and/or social security numbers for a significant number of members”.
• MGM Resorts (Oct 2023): MGM’s SEC filing said attackers obtained names, contact details, gender, date of birth and driver’s licence numbers of some customers who transacted before March 2019. For a limited number, passport numbers were also taken.
• Marina Bay Sands, Singapore (Oct 2023): data of more than 665,000 patrons was stolen. In October 2025 Singapore’s PDPC fined the resort S$315,000, and the data was later found offered for sale on the dark web. Here the stolen fields were names and contact details, not ID numbers.

You cannot control a casino’s servers. You can control how many sites hold your ID, and how useful a stolen copy is. That is what the checks further down are for.

Takeaway: give your ID to as few sites as possible, and make every copy traceable.

The bigger risk: fake KYC requests

A breach at a big company is rare. A stranger asking for your IC is not. The fake KYC trap usually looks like this: you are told your withdrawal is “frozen” and a “verification agent” needs your IC, a selfie and sometimes a fee or an OTP to release it.

What happens to those copies? Singapore Police described one use in November 2025. Scammers took soft copies of identity cards, replaced the face with digital tools, and opened accounts with payment service providers. An accomplice who looked like the new photo passed the facial liveness check. The accounts were then used to receive scam money. The police advisory notes that “some of the misused identity cards belonged to victims of scams” who had handed over soft copies earlier.

That is how your name ends up on a mule account you never opened. Our money mule explainer covers the legal trouble that can follow.

If the request asks you to pay before you get paid, it is the withdrawal-hold scam pattern, not KYC.

Takeaway: real verification happens on the site, costs nothing and never needs your banking codes.

7 checks before you upload your ID

1. Check the licence first. Find the licence number in the site footer and confirm it with the regulator. Our licence check tool and guide to spotting an unlicensed casino show how. No verifiable licence, no upload.
2. Upload only inside the logged-in site. Type the address yourself. Never send ID through WhatsApp, Telegram, email replies to a stranger, or a link someone sent you. Our fake login page check works for casino pages too.
3. Confirm the request in your account. If someone contacts you about KYC, log in separately and see whether the request is there.
4. Read what they ask for. ID, proof of address and possibly a selfie on their own page are normal. An OTP, bank password, PIN or CVV ends the conversation.
5. Watermark every copy. Steps below.
6. Send the minimum. Cover what is not needed (see below), and do not send extra documents “just in case”.
7. Lock the account down. Use a unique password and two-factor login. Our casino account security checklist takes ten minutes.

How to watermark your ID copy

A watermark will not stop a skilled forger. It makes a stolen copy harder to reuse at a bank or e-wallet, and it shows where a leak came from. Put it across the document, not in a corner, but keep the photo, name, number and expiry date readable, or the casino will reject it.

1. Take a clear photo of your ID on a plain surface. Do not use an old copy saved in chats.
2. Open any photo editor that lets you add text (most phone galleries do).
3. Write: “For KYC at [site name] only, [today’s date]”.
4. Make the text semi-transparent and run it diagonally across the card, crossing the edges of the photo.
5. Check that every field is still readable, save, and upload that copy only.
6. Delete the unmarked original from chats and cloud folders you do not need it in.

What to cover, and what not to

• Payment card photo: cover the middle digits and the CVV on the back. No identity check needs your CVV.
• Bank statement as proof of address: your name, address and the bank’s name and date are what count. Ask support whether you may cover transaction lines.
• The ID itself: do not cover the photo, name, date of birth, number or expiry. A redacted ID will fail the check and delay your withdrawal.

Takeaway: a traceable, minimal copy uploaded to a licensed site is about as safe as KYC gets.

Singapore and Malaysia: what the data rules say

In Singapore, the PDPC’s NRIC guidelines took effect on 1 September 2019. Organisations may collect NRIC numbers or copies only when the law requires it or when identity must be verified to a high degree of accuracy. A physical NRIC “can only be retained by an organisation if required by law”. If a random “agent” wants your NRIC, ask which law requires it. They will not have an answer.

Malaysia has its own Personal Data Protection Act 2010. But a privacy law only helps if you can reach the company that holds your data. An offshore site with no local presence is hard to pursue if it mishandles your MyKad copy. Our is-it-legal checker shows where online gambling stands in your country. Either way, send your IC to as few places as possible.

Takeaway: the law limits who should hold your IC. Your own caution has to do the rest.

Already sent your IC to the wrong place? Do this today

1. Stop contact. Do not send anything more, and do not pay any “fee” to get your documents back.
2. Call your bank. Ask it to flag your accounts for extra checks and watch for new accounts or cards in your name.
3. Malaysia: if money has moved, call the National Scam Response Centre on 997 (24 hours), then make a police report.
4. Singapore: call the ScamShield Helpline on 1799 to check, and make a police report. Keep an eye on your Singpass activity.
5. Hong Kong: call the Anti-Scam Helpline 18222 (24 hours) for advice, and report at a police station.
6. Secure your phone number and accounts. Ask your telco to block SIM replacements without in-person checks, change passwords, and move from SMS codes to an authenticator app where you can.
7. Keep records. Screenshot the chat, the number and what you sent. Police and banks will ask.

If you have also lost money, be wary of anyone who offers to “get it back” for a fee. That is a second scam.

FAQ

Is it normal for a casino to ask for ID before a withdrawal?

Yes. Licensed operators must verify customers under anti-money-laundering rules, and checks often come up at the first withdrawal. What is not normal is being asked to pay a fee to finish verification.

Should I send a selfie holding my ID?

Only through the casino’s own verification page or app, after you have checked its licence. Never send a selfie with your ID to a chat, an “agent” or a link someone sent you. That combination is exactly what fraudsters need to open accounts in your name.

Can I black out parts of my IC?

Not the parts being checked: photo, name, date of birth, number and expiry. A diagonal watermark that leaves them readable is the better protection. On card photos, do cover the middle digits and the CVV.

Will a real casino ever ask for my OTP or bank login?

No. An OTP or banking password gives someone control of your money, not proof of your identity. Anyone asking for one is trying to take over your account.

How long does a casino keep my ID?

It depends on the regulator. Under UK Gambling Commission guidance, identity records are kept five years after the business relationship ends and then deleted unless a legal exception applies. Check the privacy policy of your site for its own retention period.

HotStakes is an independent directory. Some links on this site are affiliate links; we may earn a commission at no cost to you, and it never changes our rankings. Gambling involves risk — only play with money you can afford to lose, and if it stops being fun, seek help. This article is general information, not legal advice. Read our full disclaimer.