GamblScout’s scoring algorithm applies a measurable penalty to any operator that does not offer two-factor authentication (2FA), or that offers only a weak form of it such as email-only one-time codes. The decision is not aesthetic. Independent research on account takeover (ATO) shows it is now the costliest category of consumer fraud tracked in the United States, and multiple controlled studies put the protective effect of enabling a second authentication factor above 99% against automated credential attacks. An operator that skips this control is asking players to absorb a risk the data says is avoidable.
Key takeaways
- Account takeover cost US consumers more than $15 billion in 2025 and hit roughly 6 million people, making it the single costliest fraud category Javelin Strategy & Research tracks.
- A peer-reviewed Microsoft study of Azure accounts found that enabling MFA cut compromise risk by 99.22% overall, and by 98.56% even on accounts whose passwords were already leaked.
- Not all 2FA is equal: NIST’s revised digital identity guidelines no longer treat SMS one-time codes as meeting its mid-tier assurance level, pushing phishing-resistant methods like authenticator apps and FIDO2 keys to the top.
- UK Gambling Commission technical standards require licensees’ critical systems to implement “secure authentication” controls mapped to ISO/IEC 27001:2022, putting account login security inside formal regulatory scope.
- Gambling platforms sit in a specific risk category: industry data shows meaningful attack activity at account creation, login and payment stages of the player journey.
Table of contents
Why account takeover is the top threat to player funds
Account takeover is distinct from a data breach: the attacker does not steal information from the operator, they log in as the player using credentials obtained elsewhere.
Six million U.S. consumers had an existing account hijacked by criminals in 2025, and ATO losses fell 4% last year but still topped $15 billion, making it the costliest fraud type Javelin tracks.
Victims spent an average of 17 hours resolving account takeover fraud in 2025.
Gambling accounts are a specifically attractive target because they combine a funded balance with stored payment credentials.
Among industries targeted by account takeovers, online gambling sites account for roughly 11% of incidents, alongside 15% for online gaming platforms and 9% for cryptocurrency platforms or exchanges.
Industry-specific telemetry backs this up:
LexisNexis Risk Solutions reported attack activity across new-account creation, login and payments in gaming and gambling during 2025, with a 14.2% attack rate at new-account creation, a 0.4% account takeover attack rate at login and a 2.1% payment attack rate.
The login figure looks small in isolation, but at the volume of logins a mid-sized operator processes daily, a 0.4% attack rate against unprotected accounts translates into a steady stream of successful takeovers.
The mechanism behind most of these attacks is mundane rather than sophisticated.
Large databases of stolen username-password pairs, often containing millions of entries, make it easier than ever for attackers to target iGaming platforms, and password reuse across sites means even relatively unsophisticated attackers can break into casino and sportsbook accounts.
A single password, however strong, is a single point of failure once it appears in any breach dump — and most players’ passwords eventually do.
The evidence that MFA actually stops attacks
The case for mandating 2FA rests on some of the most replicated security research available. In a peer-reviewed measurement study of Microsoft Azure Active Directory accounts showing suspicious activity, researchers found a dramatic effect:
over 99.99% of MFA-enabled accounts remained secure during the investigation period.
Measured as a risk reduction,
implementing MFA led to a 99.22% reduction in the risk of compromise across the entire population, and a 98.56% reduction even in cases where credentials have been leaked.
That second figure matters more than the headline number. It means that even after an attacker already possesses a player’s valid, breached password, a working second factor still blocks the login in the overwhelming majority of cases. Given how routinely credentials circulate —
continuous new data leaks keep feeding these credential lists
— the assumption that any given player’s password is still secret is no longer safe to make. 2FA is the control that remains effective after that assumption fails.
This is also why gambling-specific security researchers keep landing on the same recommendation.
Stronger identity and access management, particularly multi-factor authentication, can significantly reduce the risk of credential-based attacks, yet adoption is far from universal.
That gap between known effectiveness and actual deployment is precisely what our scoring is built to penalize.
Not all two-factor authentication is equal
A casino that lists “2FA available” is not automatically well protected. Authentication methods differ enormously in how resistant they are to the specific attacks criminals actually use against gambling accounts, and our scoring treats them differently.
SMS codes: the weakest widely used option
SMS one-time passcodes are better than no second factor, but they carry two structural weaknesses: they can be phished through fake login pages, and they can be intercepted through SIM swapping, where a criminal convinces or bribes a carrier to port a victim’s number to a new device.
The FBI’s Internet Crime Complaint Center logged over 17 million dollars in SIM swap losses across 971 complaints in 2025
in the United States alone, down from a 2022 peak but still a live and well-documented technique. Reflecting this,
NIST’s Revision 4 of SP 800-63B, finalized in July 2025, specifies that SMS-based one-time passcodes no longer meet its AAL2-and-above authentication assurance requirements.
Authenticator apps and push approval
Time-based one-time passcodes generated inside an authenticator app, and push-approval prompts sent to a registered device, remove the SIM-swap vector entirely because they do not depend on the phone network. They remain vulnerable to real-time phishing if a user is tricked into entering the code on a fake site, but
applications assessed at NIST’s AAL2 must at minimum offer a phishing-resistant authentication option
, and app-based codes sit well above SMS in practical resistance. This tier is what our algorithm treats as the baseline acceptable implementation of 2FA for a gambling account.
Hardware keys and passkeys
NIST defines phishing resistance as the ability of the authentication protocol to prevent disclosure of authentication secrets to an impostor verifier without relying on the user’s own vigilance, and states plainly that passwords, out-of-band codes and one-time passwords do not meet that bar because a value the user types manually can be relayed by an attacker.
Hardware security keys and passkeys built on FIDO2/WebAuthn do meet it, because the cryptographic handshake is bound to the legitimate site’s domain and cannot be replayed from a lookalike page. Few consumer gambling platforms currently offer this tier, but operators that do receive the strongest weighting in our authentication category.
| Method | Resists SIM swapping | Resists real-time phishing | NIST assurance alignment | Scoring treatment |
|---|---|---|---|---|
| No second factor (password only) | No | No | Below AAL1 | Maximum penalty |
| Email-only one-time code | Partial | No | Below AAL2 | Heavy penalty |
| SMS one-time passcode | No | No | Does not meet AAL2+ | Moderate penalty |
| Authenticator app (TOTP) / push approval | Yes | Partial | Meets AAL2 | Neutral to positive |
| Hardware key or passkey (FIDO2/WebAuthn) | Yes | Yes | Meets AAL2/AAL3 | Maximum credit |
What regulators and standards bodies expect
Authentication strength is no longer purely a best-practice recommendation; it is increasingly embedded in the compliance frameworks operators are already required to follow. In the UK, the Gambling Commission’s Remote Gambling and Software Technical Standards require licensees to secure the systems that handle sensitive customer information, explicitly including
electronic systems that record, store, process, share, transmit or retrieve sensitive customer information, for example credit/debit card details, authentication information, and customer account balances.
The Commission has based these security requirements on the relevant sections of Annex A to the ISO/IEC 27001:2022 standard
, and
the organisational and technological controls referenced include 5.16 identity management, 5.17 authentication information and 8.5 secure authentication.
That audit scope gives authentication controls formal regulatory weight, not just operational relevance, for any operator holding a UK licence. We cover how these audit obligations extend to third-party payment flows in our analysis of payment gateway audits.
In the US federal sector, the direction of travel is the same.
Microsoft’s own research shows that MFA can block more than 99.2% of account compromise attacks, which is why Azure began enforcing mandatory MFA for all sign-in attempts starting in 2024.
NIST’s identity guidelines, which many enterprise security programs treat as the de facto US benchmark even outside government, have moved in step by deprecating weaker second factors and promoting cryptographic, phishing-resistant authentication as the preferred tier. iGaming platforms operate under lighter prescriptive authentication mandates than banking in most jurisdictions, but the gap between what the strongest available guidance recommends and what many casino sites actually deploy is exactly the signal our algorithm is built to surface.
How GamblScout scores two-factor authentication
When our algorithm evaluates a casino’s account security, the presence or absence of 2FA is one input among several, alongside the encryption and server configuration checks described in our SSL and server-side encryption testing. We do not simply check a box for “2FA offered.” We verify which method is offered by default, whether it is mandatory or opt-in, whether it is required specifically at withdrawal (the highest-value moment in the account lifecycle), and whether the operator has quietly downgraded security by allowing account recovery to bypass the second factor entirely — a known workaround that undermines an otherwise solid implementation.
Operators that offer no second factor at all receive the steepest deduction in our Security, Fraud Detection & Fair Play category, available in full at our fair play and fraud detection hub. Operators offering only email-based codes, which are easily compromised if the player’s email account itself is weak, receive a smaller but still meaningful deduction. Operators offering app-based TOTP or push approval as standard are scored as meeting baseline expectations. The small minority currently offering FIDO2 hardware keys or passkeys receive the highest marks in this sub-category, consistent with where NIST’s own guidance has moved. For context on how this sub-score fits into an operator’s overall rating, see our explanation of the scoring system and algorithmic weights.
This is also a place where the industry’s broader cybersecurity posture matters.
Account takeover attacks have become more sophisticated, driven by the widespread availability of breached credential databases and automated credential-stuffing tools, and these attacks undermine user trust and expose operators to financial losses particularly where authentication controls are insufficient, prompting a marked shift toward stronger authentication mechanisms including biometric verification and behavioral analytics.
Operators that are visibly investing in that shift, rather than treating authentication as a regulatory checkbox, consistently score better across our broader security category. Readers interested in why we weight automated signals over marketing claims in the first place can review our core principles on algorithmic versus human review.
Frequently asked questions
Why does GamblScout penalize casinos for missing 2FA instead of just noting it as a gap?
Because the evidence of harm is quantifiable, not speculative.
Enabling MFA has been shown to cut the risk of account compromise by over 99%, including on accounts with already-leaked passwords
, and
account takeover is the costliest individual fraud category tracked today
. A scoring system that treats a near-99% effective control as optional would misrepresent the actual risk to players’ funds.
Is SMS-based 2FA good enough for a gambling account?
It is better than nothing but is now considered the weakest mainstream option.
NIST’s current digital identity guidelines no longer count SMS one-time passcodes as meeting its AAL2-and-above requirements
, largely because of SIM-swap and phishing vulnerabilities. We score SMS-only implementations moderately, not maximally.
Should 2FA be required at login, at withdrawal, or both?
Ideally both, but withdrawal is the higher-priority checkpoint since it is the moment funds actually leave the account. An operator requiring 2FA only at initial login, with no re-verification at cashout, leaves a meaningful gap that our algorithm flags separately from general login security, which we also examine in our payment gateway audit methodology.
Does this apply to crypto casinos too, given some use wallet-based login instead of passwords?
Yes, though the attack surface differs. Wallet-based authentication removes password-reuse risk but introduces seed-phrase and device-compromise risk instead. We cover how cryptographic verification changes this calculus in our piece on zero-knowledge proofs in crypto gambling, and still expect a secondary verification layer for any custodial balance.
Methodology note
For this category, our algorithm scrapes operator account-settings pages, help-center documentation and registration/withdrawal flows to detect which authentication methods are offered, whether 2FA is mandatory or optional, and whether account-recovery paths bypass it. These findings are cross-referenced against the NIST and ISO/IEC 27001 authentication-assurance tiers described above and weighted according to the methodology outlined in our scoring system and algorithmic weights page.
Gambling involves risk. Only play with money you can afford to lose and use the deposit limits and self-exclusion tools available in your jurisdiction.
