Mirror addresses: why they are a risk for your money

Search for any casino brand together with the word "mirror" and you will find pages promising a "working link". This guide does not add another one. From the cashier's point of view, a mirror address is mostly a risk: it is the easiest way for someone to collect your login, your card details or your identity documents. Below is how to recognise the real address, what to do if you have typed data into the wrong page, and why using an alternative address to get around a block tends to end badly.

What a mirror is supposed to be

Operators sometimes run the same platform on more than one domain, for technical reasons or after moving to a new address. A genuine alternative address leads to the same account and the same balance; it never asks you to register again or to "confirm" your card. Because genuine mirrors exist, fake ones are convincing — the copy can look identical while the domain differs by a single letter.

How phishing copies work

A phishing copy imitates the design of a casino site on a lookalike domain. Typical goals are three: to capture your username and password, to collect card numbers and security codes through a fake cashier, and to obtain scans of identity documents through a fake verification page. Links to such copies are spread through messaging channels, comments, search ads and pages that promise bonuses or "unblocked access".

• Card details entered on a fake cashier can be used for purchases elsewhere.
• A stolen login can be used to change the payout method on your real account.
• Document scans can be reused to open accounts in your name.

How to find the operator's real address

1. Use the address from your own registration or account e-mails, or a bookmark you created when you first registered.
2. Compare the domain character by character before typing anything. Watch for swapped letters, extra hyphens and unusual endings.
3. Check that the connection is secure and that the operator details in the footer match those in the terms you accepted.
4. If in doubt, ask the operator's support through a channel you already trust, such as a reply to an e-mail they sent you.

Never follow a "new address" link from a stranger, and never type card data after arriving from an unknown link.

Blocking and the law

Some countries require gambling operators to hold a local licence and block access to sites that do not have one; in some places banks and payment providers are also required to refuse payments to such sites. A mirror used to get around that kind of block is not a technical workaround — it can mean a deposit stopped by your bank, an account closed under the operator's restricted-countries rule and a withdrawal that is never paid. Check the rules where you are and respect local law. The operator's terms list the countries from which it does not accept players.

If you think you used a fake page

Act quickly and in this order: block the card through your bank, change the casino password and any other account that uses the same password, switch on two-factor authentication if the operator offers it, and tell the operator's support so they can watch the account and freeze changes to the payout method. Keep screenshots of the fake page and the link you followed. If money has left your account, your bank's dispute process is the right place to start. The support guide explains what to include in your message.

Mirror and phishing questions

See also: Payments and withdrawals hub · Responsible gambling · Terms of use