What to do if your betting account has been hacked
Act in this order: secure the phone number and the email, change the account password, tell the operator's customer care centre in writing, and keep every message and transaction code. A licensee must report fraud to the Authority within twenty-four hours.
Signs your account has been taken over
The usual signs are bets or withdrawals you did not make, a changed phone number or email, login alerts from places you have not been, and one-time codes you did not request. Any one of them is enough reason to act.
Many takeovers start with a stolen code, a copied login page or a swapped SIM. The guides on recognising betting phishing SMS and protecting a gambling account from SIM swap explain how those routes work.
The first hour: what to do and in which order
Order matters, because a thief who still controls your email or phone number can undo a password change. Work from the outside in.
| Step | Action | Why this comes here |
|---|---|---|
| 1 | Check your phone has signal and that your SIM still works | Loss of signal for no reason can mean a SIM swap. Call your mobile network from another phone |
| 2 | Secure the email account linked to the betting account: new password, sign out other sessions | Password resets are sent there |
| 3 | Change your mobile-wallet PIN if you ever shared it or a code | The wallet is the route money leaves by |
| 4 | Change the betting-account password from the operator's real app or site, and any account that used the same password | Cuts the thief off from the login |
| 5 | Contact the operator's customer care centre and ask it to secure the account and stop pending withdrawals | Only the operator can freeze the account |
| 6 | Save evidence: screenshots, SMS, transaction codes, times | You will need them for every later report |
Get the customer care details from the operator's own app or site, not from a message, because scammers also pose as support. If the app itself is the suspect, read fake betting apps and APK risks.
Why speed matters
A thief who has the login can usually withdraw whatever the account holds within minutes. Once money has left the account and the wallet, recovery is harder and not guaranteed. Acting within the hour, and asking the operator in writing to stop pending withdrawals, gives it the best chance to intervene.
What to put in your message to the operator
Write rather than only phone, so there is a dated record. State your registered name and phone number, the time you noticed the break-in, each transaction you did not make with its amount in KES and code, and what you ask for: a freeze, a log of logins, and a written outcome.
Do not send your password or a one-time code to anyone, including someone claiming to be support. A real customer care centre does not need them to freeze an account.
What the rules say operators must do
The operations regulations do not contain a refund rule for hacked accounts, but they set duties that bear on your case. The table lists those that this guide could verify.
| Duty | Where | What it means for you |
|---|---|---|
| Keep a customer care centre in Kenya to respond to consumers' issues | Act s.68(8) | You have a place to raise the matter |
| Resolve complaints and disputes before they are reported to the Authority, and refer unresolved matters to it | Reg. 9(2) | Ask for the matter to be recorded as a complaint |
| Establish internal dispute resolution mechanisms approved by the Authority | Reg. 103 | Ask which procedure applies |
| Encrypt player personal and financial data in transit and at rest | Reg. 42(1) | The operator is expected to protect stored data |
| Keep platforms secure from cyber-attacks and hacking, and keep an incident response report of breaches and fraudulent digital activity | Reg. 50(1) and (3) | Your incident should appear in its records |
| Report fraud and malpractice to the Authority within twenty-four hours | Reg. 91(2); reg. 93(1) | The operator cannot treat fraud as a private matter |
If the operator does not resolve it
Keep the complaint in writing and note each reply. Section 80 of the Act allows a party to a dispute arising out of an online gambling activity to appeal to the Tribunal within fourteen days from the date of the dispute. Whether a particular hacking dispute qualifies is a legal question, so check promptly rather than wait.
The regulator publishes a toll-free line, 0800-723-770, also listed on the responsible gambling page. Use it to ask how to escalate a complaint.
Money, identity and data after a break-in
Look at your mobile-wallet statement as well as the betting account, since stolen money often leaves through the wallet. The guide on how mobile-money deposits work shows the path money takes.
If an impostor changed your details, ask the operator to restore them and to re-check your identity. Identity checks are explained in proof of age and identity checks.
Illustrative example: a thief withdraws KES 2,000 in one transaction and KES 3,500 in another before you notice. The total taken is 2,000 + 3,500 = KES 5,500, so list both transaction codes and both amounts in your message.
Mistakes that make a bad situation worse
Some reactions feel sensible in a panic but help the thief or weaken your case. Avoid them.
- Replying to the thief or paying to "get the account back". Nobody legitimate sells back access to your account, and payment only adds a second loss.
- Calling a number found through a search result or a message. Fake support lines exist. Use the contact route shown inside the real app or site.
- Deleting messages, emails or the app before saving them. Screenshots and transaction codes are your evidence. Save first, tidy later.
- Opening a new account to continue betting. Settle the first account's complaint before anything else, and pause gambling while you deal with it.
- Changing only the betting password. If the email or SIM is still compromised, the thief can reset it again.
After you regain control: a short checklist
Once the operator confirms the account is secure, go through the list below before you use it again. It takes a few minutes and closes the gaps a thief would use a second time.
| Check | What to look for |
|---|---|
| Registered phone number and email | Both are yours. If either was changed, ask the operator to restore it |
| Payment details and withdrawal destination | No unfamiliar wallet number or bank account is saved |
| Transaction history | Every deposit, bet and withdrawal matches what you did. List the ones that do not |
| Written reply from the operator | It states what happened and what it decided about the disputed amounts |
| Limits and exclusion settings | Nobody has raised or removed any limit you set |
If the break-in shook your confidence in the account, you may also decide to close it. The guide on deleting a betting account and personal data explains how that works.
Habits that lower the risk
- Use a password for the betting account that you use nowhere else.
- Keep only the balance you need in the account.
- Never read out codes sent to your phone.
- Install the app only from an official store.
Gambling is addictive: play responsibly, and only with money you can afford to lose.
Questions and answers
Who do I contact first when my betting account is hacked?
The operator's customer care centre. Section 68(8) of the Gambling Control Act, 2025 requires an online operator to keep one in Kenya to monitor and respond to issues raised by consumers. Take its contact details from the operator's own app or site.
Must the operator report the break-in to the regulator?
A licensee must report fraud and malpractice to the Authority within twenty-four hours (regulation 91(2) of the operations regulations). Regulation 93(1) adds suspicious activity and transactions, within twenty-four hours of becoming aware.
Will the operator refund money taken from my account?
The Act and regulations read for this guide do not state a refund rule for a hacked account. Whether money is returned depends on the operator's terms and its investigation, so ask for the outcome in writing.
What if the operator does not resolve my complaint?
Customer care centres exist to resolve complaints before they are reported to the Authority and to refer unresolved matters to it (regulation 9(2)). Section 80 of the Act also lets a party to a dispute arising out of online gambling appeal to the Tribunal within fourteen days from the date of the dispute.
Should I report the theft to the police?
If money was taken from your account or your mobile wallet, a police report creates a record you can show to the operator and your network. Ask the station for a reference number.
Does the operator have to protect my data?
Regulation 42(1) requires a licensee to ensure all personal and financial data of a player is encrypted in transit and at rest, and regulation 50(1) requires online platforms to be secure from cyber-attacks and hacking.
Sources
- Gambling Control Act, 2025 (No. 14 of 2025), ss.68(8), 80, accessed 2026-10-05
- Gambling Control (Conduct of Gambling Operations) Regulations, 2026, rr.9, 42, 50, 91, 93, 103, accessed 2026-10-05