How to Spot an Unlicensed Online Casino: Licence Check

Any website can print “Licensed by the Malta Gaming Authority” in its footer. The words cost nothing, and regulators keep finding sites that use them falsely. A casino licence only counts if the regulator’s own public register lists the company and the exact web address you are using, with an active status. This guide shows where each major register lives, the five-minute check to run before you deposit, the red flags that mark an unlicensed site, and what to do if you have already paid in.

Why a licence badge proves nothing on its own

Regulators publish warnings about fake licence claims regularly. In July 2026 the Malta Gaming Authority named three websites impersonating MGA-licensed operators, said it had “no connection” with them, and called their licence claims false and misleading. It warned that unlicensed sites are unregulated and lack consumer safeguards.

The same month, the Isle of Man’s Gambling Supervision Commission said it acts to remove sites “illegally purporting to hold a GSC licence”. It noted that its licence holders have just 40 genuine, approved URLs, and it keeps a separate register of websites that may be falsely claiming a licence or spoofing a real licensee.

Both warnings describe the same trick: a site posing as, or spoofing, a genuine licensee. What a clone cannot fake is its own domain’s entry on the regulator’s register.

Takeaway: treat any licence claim on a casino’s own site as unverified until you find it on the regulator’s website.

Where to check: the main public registers

Each regulator below runs a free, public register. Always type the regulator’s address yourself or search for it; never trust a “verify” link supplied by the casino.

Two of these have recent context worth knowing. Curaçao replaced its old system on 24 December 2024, when the National Ordinance on Games of Chance (LOK) brought operators under direct CGA supervision instead of the criticised sublicence model; by 17 December 2025 it had granted 604 provisional licences and rejected 139 applications, according to a one-year review published by Curaçao Chronicle. Our Curaçao licence reform explainer covers what that means for older “Curaçao eGaming” badges. In the Philippines, PAGCOR chairman Alejandro Tengco said the PAGCOR Guarantee site would help players “easily identify and verify” legitimate platforms.

Takeaway: bookmark the register of whichever regulator a site claims, and check the domain, not just the company name.

The five-minute licence check

Run this before you register, and again before your first deposit if the site has moved to a new address.

1. Find the claim. Scroll to the footer and note the regulator, licence number and company name. If there is no company name or licence number at all, stop here.
2. Go to the regulator directly. Open the register from the regulator’s own website, not from a link or seal on the casino page.
3. Search the company. Confirm the licence is active, not suspended, revoked or surrendered, and that the licence type covers casino games.
4. Match the domain. The UK Gambling Commission tells players to check that “the details of the licence (including activities and website domain names) match the public register”. MGA users can paste the address into the URL Checker. A real company with your domain missing is a red flag for a clone.
5. Check the enforcement and warning lists. Search the regulator’s enforcement register or fake-site register for the domain and brand name.
6. Check where you live. A licence from Malta, Curaçao or the Isle of Man regulates the operator; it does not make playing legal in your country. In Singapore, for example, the Gambling Regulatory Authority’s licensing page names Singapore Pools as the licensed betting and lottery operator.

Takeaway: company, status, licence type and exact domain must all match the register; one mismatch is enough to walk away.

Red flags of an unlicensed or fake casino

Most of these come up again and again in the scams covered in our fake gambling app guide. One alone is a reason to pause; two or more is a reason to leave.

• A seal that does nothing. A static image, or a link to a page hosted on the casino’s own domain rather than the regulator’s.
• Vague or missing operator details. No registered company, no address, or a company name that does not match the register.
• Payments to individuals. Deposits to a personal bank account, an e-wallet in someone’s name, or a crypto address sent by a chat “agent”.
• Fees to withdraw. Being asked to pay a “tax”, “unlock fee” or “verification deposit” before a withdrawal. Our guide to withdrawal holds explains which checks are normal and which are not.
• Guaranteed wins or insider tips. No licensed casino game can be predicted; promises of sure wins are a classic lure, including in pig-butchering scams.
• Frequent domain changes. Being told to move to a “new link” every few weeks, often via Telegram or WhatsApp.
• Bonus terms you cannot find. Regulated operators are expected to publish clear, fair terms; our wagering requirements guide shows what fair terms look like.

Takeaway: pressure, private payment channels and withdrawal fees are scam signals regardless of what licence the site claims.

What to do if you already deposited

1. Stop paying. Do not send any further “fee”, “tax” or “unlock” payment, whatever the site promises.
2. Save evidence. Screenshot the site, the domain, chat messages, transaction IDs and wallet or account numbers.
3. Call your bank and the scam hotline quickly. Malaysia’s National Scam Response Centre on 997 runs 24 hours a day, and calling within 24 hours gives authorities a chance to block accounts and transactions. In Singapore, the ScamShield Helpline is 1799, 24/7. In Hong Kong, the police Anti-Deception Coordination Centre runs the Anti-Scam Helpline 18222.
4. Report the site to the regulator it impersonates. The Isle of Man GSC, for example, asks the public to report sites claiming its licence.
5. Beware recovery offers. Anyone who contacts you offering to get your money back for an upfront fee is a further red flag.

Takeaway: speed matters more than anything else; report within hours, not days.

FAQ

Is a Curaçao licence still meaningful?

Since the LOK took effect on 24 December 2024, operators are licensed directly by the CGA. Check the company on the CGA’s own register, and remember the CGA says its overviews do not guarantee current validity.

Can a scam site copy a real licence number?

Yes. That is why the domain check matters: the MGA and the Isle of Man GSC have both flagged sites impersonating genuine licensees.

Does a licence mean I will always get paid?

No, but it means there is a regulator with rules, a register and a complaints route. Unlicensed sites offer none of that.

The site’s licence link takes me to a register page. Is that enough?

Not always. Fake sites can link to look-alike pages. Type the regulator’s address yourself and search the register from there.

HotStakes is an independent directory. Some links on this site are affiliate links; we may earn a commission at no cost to you, and it never changes our rankings. Gambling involves risk — only play with money you can afford to lose, and if it stops being fun, seek help.

Looking for operators checked by Cyndia’s team? Browse vetted operators by currency.