Consumer evidence guide · 2026-09-07
How to report a suspected illegal online casino
Reviewed by Casino Fact Check UK Editorial Desk and Consumer Evidence Review Desk on 7 September 2026.
A suspected illegal online casino can raise several different issues: possible unlicensed gambling, a suspicious or deceptive web address, an unresolved customer dispute, or fraud involving money. Those issues do not all go to the same organisation. Choosing the route that matches what happened helps avoid turning an uncertain concern into an unsupported accusation.
The guidance below concerns Great Britain. Regulatory scope matters: Great Britain comprises England, Scotland and Wales, while Northern Ireland is not part of Great Britain. Anyone reporting from Northern Ireland should verify the appropriate local route rather than assuming that every Great Britain process applies.
Choose the route that matches the concern
Start by describing the event neutrally. “I found a domain that may be offering gambling without appropriate authority” is regulatory intelligence. “A web address appears designed to capture credentials” is a suspicious-site concern. “Money was taken through suspected deception” may be a fraud report. “A gambling business rejected my withdrawal complaint” is an individual dispute and does not, by itself, prove illegal gambling or fraud.
| What happened | Most relevant route | What the route is for |
|---|---|---|
| Possible unlicensed gambling, suspicious gambling activity or criminality connected with gambling | Gambling Commission | Confidential regulatory intelligence rather than resolution of an individual dispute |
| A suspicious casino web address, phishing-style domain or potentially malicious site | National Cyber Security Centre (NCSC) | Reporting the suspicious website address |
| Suspected fraud or cyber crime, including an actual financial loss | Report Fraud, or the relevant Police Scotland route in Scotland | Reporting suspected crime or fraud rather than merely flagging a website |
| A personal complaint about a gambling business | The business complaint process and the appropriate dispute route | Seeking consideration of the individual complaint |
The Gambling Commission complaints hub distinguishes complaints about gambling businesses from confidential reports concerning unlicensed gambling, suspicious activity or criminality. That distinction was confirmed in the official record checked on 7 September 2026 (Gambling Commission, src-165). For more on separating individual disputes from regulatory concerns, see casino complaint routes.
Check the exact casino domain before making an allegation
Record the complete hostname shown in the browser, not only the casino name. Small differences matter: an added word, substituted character, unexpected subdomain or different ending may identify a separate website. Do not assume that two similar-looking domains belong to the same legal entity, licence holder or operator.
Copy the address as text if it is safe to do so, and capture a screenshot that includes the browser address bar and the date. Record any redirect separately, including the address first visited and the destination reached. If the address arrived by email, text message, social media or an advert, preserve that message as well. Avoid repeatedly opening a domain that appears unsafe.
A missing licence claim, an unfamiliar brand or a negative review is not conclusive proof of illegality. Equally, an operator-controlled claim that it is licensed should not be treated as independent verification. Use the licence-checking process to compare the precise domain and named entity with a current primary record. Public allegations and forum posts can provide leads, but they do not establish misconduct.
Report suspected unlicensed gambling to the Gambling Commission
For activity affecting Great Britain, the Gambling Commission route is relevant when the concern is possible unlicensed gambling, suspicious gambling activity or criminality connected with gambling. Its complaints hub expressly separates those confidential reports from complaints about a gambling business, according to the official material checked on 7 September 2026 (Gambling Commission, src-165).
A concise report should identify the exact domain, when it was accessed, what gambling activity appeared to be offered and why the reporter is concerned. Include the names presented by the site as claims made by the site, not as verified identities. If a licence number or company name appeared, reproduce it accurately and explain where it appeared. Do not state that the claim is false unless a competent, current record establishes that conclusion.
Confidential intelligence does not automatically resolve a refund, withdrawal or account dispute. If the central issue is treatment by a gambling business, preserve the complaint history and use the appropriate complaint route. A dated regulatory action also should not be assumed to have cancelled a current licence; historical action and current status require separate checks. The guide to Gambling Commission regulatory actions explains that distinction.
Report a suspicious casino address to the NCSC
The NCSC accepts reports of suspicious websites. Its official guidance also distinguishes reporting a suspicious site from reporting an actual crime or financial loss, as checked on 7 September 2026 (NCSC, src-166). A casino-themed address can therefore be reported to the NCSC when the concern is the website itself, such as suspected phishing or deceptive imitation.
Submit the precise web address rather than a broad brand description. If several addresses were involved, identify each one and note the sequence of redirects. Do not include passwords, full card details, authentication codes or unnecessary identity documents in a narrative. Reporting the web address does not replace a fraud report when money was lost or a crime may have occurred.
After preserving the necessary evidence, avoid further interaction with a suspicious site. Do not make another payment merely to test whether deposits or withdrawals work. No deposit, withdrawal, KYC, support or account test was conducted for this guidance, and no inference about any individual operator follows from the reporting routes described here.
Report suspected fraud or financial loss
Where the concern includes suspected fraud or cyber crime, Report Fraud provides online and telephone reporting information. Its official guide notes that Scotland uses Police Scotland routes; this was checked on 7 September 2026 (Report Fraud, src-167). Follow the current official instructions applicable to where the incident is being reported.
Prepare a chronological account before starting. State when contact began, what representation was made, what payment was requested, how much was transferred in GBP, which recipient details were shown and when the loss was discovered. Separate what can be demonstrated by records from what is suspected. If several transactions occurred, list them individually rather than giving only a combined estimate.
| Evidence to preserve | Useful detail | Safety limit |
|---|---|---|
| URLs and redirects | Exact addresses, access dates and the order of redirects | Do not revisit a dangerous address solely to collect more material |
| Messages | Email headers where available, sender details, dates and message text | Do not reply or disclose further credentials |
| Transactions | Amount in GBP, date, payment reference and displayed recipient | Retain full records privately; redact sensitive data from public posts |
| Website captures | Address bar, relevant claim and date captured | A screenshot records what appeared; it does not prove who controlled the site |
| Account and complaint history | Case references, responses and a dated timeline | Do not send passwords, PINs or one-time security codes |
Preserve evidence without creating new risk
Keep original files where possible and create a simple evidence index. Give each item a date, short description and file name. Preserve messages in their original form as well as taking screenshots, because a cropped image may omit sender or timing information. Keep notes factual and distinguish direct observations from conclusions.
Do not edit an original screenshot to add arrows, accusations or reconstructed text. If an annotated working copy is useful, retain the untouched original separately. Record telephone contact contemporaneously in a note containing the date, approximate time, number displayed and a summary of what was said. Do not claim to have a recording unless one genuinely exists.
Sensitive records should not be posted publicly. Full payment details, identity documents, home addresses and authentication information can create additional risk. Share only what the chosen official route asks for, using its current submission process. Anyone facing immediate financial or personal danger should use urgent help information rather than waiting for an ordinary complaint response.
What each report can and cannot establish
Submitting a report is not a finding that a casino is illegal, fraudulent or responsible for a loss. A suspicious-domain report records a concern about an address. Regulatory intelligence alerts the Gambling Commission to possible gambling-related issues. A fraud report records suspected crime or cyber crime for the relevant reporting system. Outcomes, investigative decisions and remedies remain matters for the competent bodies.
No particular casino domain, legal entity, licence, complaint, transaction or enforcement result was assessed here. There was no independent KYC, deposit, withdrawal, customer-support, complaint or alternative dispute resolution test. The three dated primary sources support only the allocation of reporting routes described above. They do not prove allegations about any unnamed or named operator.
Editorial review follows an evidence-separation method: primary official records support procedural claims; operator statements would be labelled as operator-controlled; and user reports would remain contextual allegations unless independently established. The broader approach is described in the evidence methodology. Corrections, updated official procedures or evidence of a material error can be submitted through contact and corrections.
Frequently asked questions
How do I report an unlicensed online casino in Great Britain?
Record the exact domain and describe the observed gambling activity without presenting suspicion as a proven fact. The Gambling Commission complaints hub provides a distinct route for confidential reports about unlicensed gambling, suspicious activity or criminality, separate from complaints about a gambling business. That separation was confirmed in the official record checked on 7 September 2026 (Gambling Commission, src-165). If the issue is an individual account or withdrawal dispute, use the relevant complaint process as well.
Should a suspicious casino website be reported to the NCSC?
Yes, when the concern is the suspicious web address itself. The NCSC accepts suspicious website reports and distinguishes that service from reporting an actual crime or financial loss, according to its guidance checked on 7 September 2026 (NCSC, src-166). Preserve the exact URL and any redirect sequence, but do not revisit an unsafe address merely to gather more evidence. Use the appropriate fraud route separately if money was lost.
Where do I report money lost to casino fraud?
Suspected fraud or cyber crime can be reported using the current Report Fraud online or telephone guidance. The official guide checked on 7 September 2026 notes that Scotland uses Police Scotland routes (Report Fraud, src-167). Prepare transaction dates, GBP amounts, payment references, recipient details and a clear chronology. A report records suspected fraud; it does not itself establish liability or guarantee recovery.
What evidence should I save before reporting a casino domain?
Save the exact domain, redirects, dated screenshots, original messages, transaction records and complaint references. Keep an untouched original of each item and distinguish observations from suspicions. Do not publish full payment details, identity documents, passwords or authentication codes. A screenshot can show what appeared on a particular date, but it does not by itself prove who controlled the domain or whether an offence occurred.