Fake and cloned casino sites: how to spot them and check the real domain

A cloned casino site copies the name, logo and layout of a real one on a different web address. The casino you meant is not behind it, and a deposit goes to whoever runs the copy. The reliable defence is mechanical: type the address yourself, match the domain to the regulator’s register and distrust any link you did not choose. This guide shows how clones work, what regulators and consumer groups reported in 2026, a domain checklist and the domain, licence and register entry we recorded for each of the 15 casinos we profile.

How cloned and fake casino sites work

• Lookalike domains. A one-letter change, a different ending or an extra word in the address (for example a different country ending) makes a copy hard to spot.
• Cloned layout, borrowed licence. The licence number and seal are copied from the real site; the register entry belongs to another domain.
• Redirects. A page that looks like a licensed site sends the visitor on to a different, unlicensed one.
• Routes to the copy. Social posts, messages, ads and, as consumer groups reported in 2026, answers from AI assistants.

What was reported in 2026

• The Dutch Gambling Authority said on 7 October 2026 that it had 26 cloned websites on the .co.nl ending – copies of licensed Dutch sites that redirected visitors to illegal gambling – taken offline within 48 hours with the help of the domain operator, and that 86 further illegal gambling sites under .co.nl were reported and removed (Kansspelautoriteit).
• The Australian consumer group CHOICE reported (page updated 28 September 2026) that Microsoft Copilot and Google AI Mode directed users to unlicensed gambling sites without a warning (CHOICE).
• The UK charity CARE described, on 9 March 2026, tests in which five AI chatbots pointed users to unlicensed casinos (CARE).

The practical lesson is the same in each case: a recommendation, even from a tool that sounds authoritative, is not a licence check.

Seven checks before you deposit

1. Type the address yourself or use a bookmark you saved from a source you trust. Do not follow a link from an ad, a social post or a message.
2. Read the address character by character. Look for added words, swapped letters and unusual endings.
3. Find the licence number and regulator in the terms, then open the regulator’s register from the regulator’s own website, not from a link on the casino’s page.
4. Match three things in the register: the operating company, the status and the domain. If the domain is missing or different, stop.
5. Check that terms, privacy policy and responsible-gambling pages sit on the same domain as the cashier and that the operator named in them matches the register. See brand versus operator.
6. Be wary of software outside the official app stores and of requests to continue on a messaging app.
7. For crypto, check the deposit address and network in the cashier of the site you opened yourself; a transaction cannot be reversed. See deposit mistakes.

The domain, licence and register entry we recorded for the 15 casinos we profile

This is the domain our records use for each casino and the register entry we found, with the check date. Always type the address yourself and compare it with the register; we cannot see every lookalike.

If you have already deposited on a suspect site

• Stop paying and do not send “verification” or “release” fees.
• Keep screenshots, the web address and every transaction ID.
• If you paid by card or bank, contact your provider quickly; crypto transfers generally cannot be reversed.
• Report it to your national fraud-reporting service and, if a regulator is named, to that regulator.
• Change passwords that you reused and watch for follow-up messages offering to “recover” funds for a fee.

For a real casino that refuses a payout, the route is different: see escalation routes by licence.

Frequently asked questions

Gambling can harm. If play is no longer fun, use our responsible gambling page; how we verify casinos is described in our methodology.