Betting login alerts and device history: how to spot a stranger

Open the account's own security or settings page and compare each listed login, device and time with what you remember. Anything you cannot explain is a stranger: sign it out, change the password, and tell customer care in writing. Not every operator offers these features, so check what yours shows.

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-11-06

What a login alert and a device history are

A login alert is a message, by SMS, email or app notification, telling you that someone signed in to your account. A device or session history is a list inside the account of the phones and browsers that signed in, usually with a time and an approximate place. Neither is guaranteed: this guide describes common features, and you must check your own account settings to see which ones exist.

Both help with one question: was that me? A login you cannot place is the earliest sign that a password or a code has leaked. The steps after a confirmed break-in are in what to do if a betting account is hacked.

What the Kenyan rules say, and do not say

The Gambling Control Act, 2025 does not mention login alerts. Section 68(2)(a) says the Authority shall not approve a licensee's gambling control system unless it provides for online security of information, and s.68(2)(h) adds data protection measures under the Data Protection Act.

The Conduct of Gambling Operations Regulations, 2026 go a little further. Regulation 41(c) requires an online system to keep a secure, encrypted and tamper evident audit log of system and user activities. Regulation 42(1) requires personal and financial data of a player to be encrypted in transit and at rest, and r.50(3) requires an incident response report that registers breaches, downtime or fraudulent digital activity.

In short, an audit log should exist behind the scenes, but the law read for this guide does not promise you a view of it. That is why your own habit of checking matters.

Where to look in your account

Open the official app or the site typed in by hand, then look in the settings area for a heading such as security, account activity, devices, sessions or login history. Names differ, and some accounts show none of them. Also check the notification settings: some accounts let you switch login messages on or off.

Keep the phone number and email on the account current, because alerts go there. If the number is old, changing the phone number on a betting account comes first, otherwise a stranger who owns your old line may read the alerts instead of you.

How to read each entry

Go through the list from the newest entry backwards, and match every line to a day you remember opening the account. Use your phone's own list too: for a phone signed in to Google, Google's help page describes a "Manage all devices" view that lists devices signed in now or in the last few weeks.

An unrequested code is covered in why you received a betting OTP you did not request.

Illustrative example: reading a short history

Illustrative example: your account lists four entries. Entry 1 is your current phone at 7:40 pm yesterday. Entry 2 is the same phone on Sunday. Entry 3 is an unknown tablet at 2:10 am on Saturday. Entry 4 is your old handset from months ago.

Step 1: entries 1 and 2 match your own use, so they need no action. Step 2: entry 4 is an old phone you remember, so sign it out as housekeeping. Step 3: entry 3 matches nothing you own and a time you were asleep, so it is the stranger. Step 4: sign out all sessions, change the password, and check the transaction history for that night.

What to do when you find a stranger

1. Sign out the unknown session, or all sessions if the account offers it.
2. Change the password to a new one used nowhere else. The advice in setting a strong betting account password and PIN applies.
3. Check the phone number and email on the account, and the transaction history, for changes you did not make.
4. Contact the operator's customer care in writing, with the time of the unknown login and a screenshot of the entry.
5. Ask your mobile network whether your SIM was replaced if you also lost signal or stopped receiving codes.

Section 68(8) of the Act requires an online operator to maintain a customer care centre, and r.9(2) of the Conduct Regulations says its purpose includes resolving complaints before they are reported to the Authority. Use the contact details inside the operator's own app or site, not a number from a message or a chat. Fake helpers are described in fake betting agents on WhatsApp and Telegram.

If the operator cannot explain the login

Ask for a written answer: when the login happened, from what kind of device, and whether anything was changed or withdrawn afterwards. Keep the reply with your screenshots and transaction codes. A licensee must report suspicious activity and fraud to the Authority within twenty-four hours of becoming aware (r.93(1)), so say plainly in your message that you consider the login suspicious.

If the dispute is about personal data, such as who accessed your details, the Office of the Data Protection Commissioner runs a complaints portal, reached from its official site. Try the operator first and keep the dates.

Habits that make a stranger easier to spot

Sign in only on your own phone, and sign out of any shared or borrowed device. Remove old phones from the device list after you sell or replace them. Keep the screen lock on and hide SMS previews on the lock screen, so codes and alerts are not read by someone holding your phone.

Second-step codes help too, and two-factor authentication on a betting account explains where they fall short. Gambling is addictive: play responsibly, and keep account security separate from any decision to gamble. 18+ only.