What should I do if I suspect someone else has logged into my Ontario online casino account?

Lock it down first — then investigate

If you genuinely suspect someone else has been in your account, your first move is to change your password immediately and, if the site offers two-factor authentication (2FA), enable it right now if you haven't already. Don't wait to confirm your suspicion — act first, confirm second. Every minute of continued access is a minute of potential exposure to your funds and personal data.

Once you're back in control of the login, check your account activity. Under the AGCO's Registrar's Standards, all player account transactions must be recorded and logged accurately, and that information must be made readily available to you — at minimum, your deposit and withdrawal history, current balance, log-in times, last log-in and log-out times, and your full gaming event history. Use that transaction log to build a clear picture of what happened: when the suspicious login occurred, whether any funds moved, and what games (if any) were played.

Contact the operator directly — and escalate if needed

Under Ontario's requirements, internet gaming site operators must address player complaints, disputes and inquiries in a fair, timely and appropriate way — and most complaints are handled directly by the site. Contact the site's customer support if you're experiencing problems with your player account. Report the suspected unauthorized access explicitly, ask them to freeze any pending transactions while they investigate, and request a full account audit. Document every communication — timestamps, names, reference numbers.

The AGCO's standards back you up here. The gaming system must be able to change, block, deactivate, or remove accounts in a timely manner upon unauthorized usage of an account. That's a regulatory obligation, not a courtesy — so push the operator to act on it.

If the operator doesn't resolve it satisfactorily, players may escalate an unresolved or unsatisfactorily resolved dispute to iGaming Ontario for review, after first attempting to resolve it with the regulated operator. Use the player support tool at igamingontario.ca to start that process. If the situation involves actual fraud or theft, it's also worth filing a report with your local Ottawa police or the Canadian Anti-Fraud Centre — iGaming Ontario's player support page notes that matters of a criminal or regulatory nature are referred to the appropriate authorities.

Protecting yourself going forward

A few practical steps once the immediate situation is resolved: use a strong, unique password that you don't reuse on any other site; enable 2FA wherever the operator supports it; and review whether your email account (the one tied to your casino login) has also been compromised — that's often the actual entry point in account takeovers. Check haveibeenpwned.com to see if your credentials have appeared in any known data breaches.

One thing worth keeping in mind: only eligible individuals who hold a valid player account are permitted to log on to their account and gamble — so any wagers placed by an unauthorized person are a violation of the operator's terms and the AGCO's standards, which strengthens your position when disputing any losses or transactions.

You can confirm your site is legitimately regulated by checking for the iGaming Ontario and BetGuard logos — every internet gaming website offered by a fully registered and approved operator in Ontario will display both logos, which confirm the site is managed by iGaming Ontario and regulated by the AGCO. The full current list of registered operators is maintained at the iGaming Ontario website. If you're ever feeling like the stress of all this is getting to you, ConnexOntario (1-866-531-2600) is available around the clock — and gambling on any Ontario-regulated site is 19+ only.