How to Spot a Fake or Clone Casino: The 6-Step Verification Checklist

The site looks perfect: same green and black, same logo, the layout you know by heart. You deposit, you play, you win — and when it's time to cash out, support goes silent. That wasn't bad luck. That was a clone.

And this isn't theory. Every major sporting event drags a wave of fraud behind it — and the 2026 World Cup, which just wrapped up in the United States, Mexico and Canada, came with the usual routine: more betting volume and more ads using deepfakes of famous players to push "super apps" that don't exist. Back in 2025, before the tournament, research from ESET and Kaspersky recorded a jump of more than 800% in deepfake-driven betting fraud in Brazil. And Mexico went through one of the most serious mass-cloning cases ever documented: dozens of official government websites turned into fake casinos, with more than 68,000 victims in 2025 (the details are in the real-world cases section below).

The short version: cloning a casino has never been cheaper — and never have so many people been trying at once. This guide is the complete package to keep you from falling for one. The 13 types of crypto casino scam are already covered in our complete scam taxonomy — here the focus is a single question: how to spot and avoid a fake or cloned casino, with a technical checklist that goes well beyond "check the license".

The 3 kinds of fake casino you'll run into

Before the checklist, it's worth separating the three patterns — because the warning signs change from one to the next.

1. The clone domain (copy of a real brand)

Someone copies the look, the name and even the game provider of a casino that actually exists, registers a similar domain (with a hyphen, a different extension or one swapped letter) and hopes you won't notice the difference. The goal is to hijack the trust the original brand has already built.

2. The invented casino (100% fake, built from scratch)

It copies nobody — it invents a brand-new name, "licenses" that don't exist, a registration number that looks real but shows up nowhere. It usually comes with a fake regulator seal (Curaçao, Malta, or some national authority), purely to look legitimate.

3. The hijacked legitimate domain

The most treacherous of the three: a real website — sometimes even a government portal — gets breached and used to redirect to or host illegal casino content, without the original owner knowing. You think you're at a trustworthy address because, technically, you were — until you got rerouted.

The verification checklist: 6 steps before you deposit a single dollar

This is the heart of the article. No "trust your gut" — it's a process, in the right order, and it takes less than five minutes.

1. Check the URL, letter by letter

Copy the address from your browser bar and compare it with the official domain you already know (from your bookmarks, or searched directly on Google — never from an ad or a Telegram link). Watch for: an extra hyphen, a swapped letter (rn instead of m), a different extension (.net, .co, .live instead of the original .com) and a strange subdomain in front of the brand name.

2. Verify the license in the official register — not just the badge

A license badge on the page proves nothing — it's just an image, anyone can paste one in. What proves something is the regulator's public register:

• If the platform claims a license in your jurisdiction: it has to appear on the regulator's official list of licensed operators — the UK Gambling Commission keeps a searchable public register, the Malta Gaming Authority publishes its licensee database, and Curaçao's Gaming Control Board (GCB) lists its licensees. The principle is always the same: trust the public register, never the seal on the page. If the name isn't on the official list, it isn't regulated there — full stop.
• If it's an offshore crypto casino (Curaçao, Anjouan): seeing a license number on the page isn't enough. Copy the number and look it up directly on the regulator's own site (Curaçao Gaming Control Board or Anjouan Gaming Board). If the number doesn't come up, belongs to a different company, or the register won't even load, that's the signature of a forged license — exactly what happened with the casino B9.GAME (see the real-world cases below).

3. Check the basics scammers always skip: SSL, company details, contact

A valid SSL certificate is the bare minimum — on its own it guarantees nothing, but its absence is already reason enough to close the tab. Then look for a company registration, a verifiable physical address and a support channel that isn't just a Telegram bot. A domain registered less than a year ago (you can check that for free on any WHOIS site) combined with those missing details is the classic scam pattern.

4. Run the Provably Fair panel test

This is the layer almost no consumer guide explains — and it's where FairPlay Audit actually comes in. A genuine crypto casino with provably fair games shows you, inside the game itself, the server seed (sometimes only its hash, revealed later), the client seed(s) and the nonce for every round — which lets you recalculate the result on your own. A clone or fake casino usually has no such panel, or has a "verify" button that doesn't actually do anything. Use our Provably Fair verifier to test this yourself before depositing anything.

5. Check the crypto deposit address before you send

There is malware built specifically to swap the wallet address shown on your screen at the moment you copy and paste — so-called "address swapping". After copying the deposit address, compare it character by character (at least the first 6 and last 6) with what appears on the casino's official page — preferably opened fresh, directly via the URL, not in the tab that was already sitting there.

6. Cross-check reviews and domain age

Search the site's name on review aggregators (Trustpilot, AskGamblers) and on a domain reputation checker. A real casino has years of history, with mixed reviews — positive and negative, and that's normal. A freshly created clone tends to have few reviews, all recent, in a repeating pattern: generic "great first experience" praise or identical complaints about blocked withdrawals.

Real casino vs. clone: 8 differences in practice

What's actually at stake

It's not just "losing a deposit". These are the four risks that come up most in real-world cases:

• An irreversibly lost deposit — in crypto there is no refund and no chargeback.
• Address-swapping malware — fake apps and sites install code that switches the wallet address at the moment you send, routing the funds straight to the scammer.
• Phantom winnings that never get paid — the clone shows your balance growing normally, then blocks the withdrawal with endless requests for "additional verification" until you give up.
• Data and identity theft via fake KYC — a document and selfie submitted to a "verification process" that is, in practice, data harvesting for later fraud (a pattern reported in a large share of the Mexican cases, just below).

Real cases that already happened

B9.GAME: the case reported as a clone of BC.GAME

The firmest starting point here doesn't come from any review site: BC.GAME itself — one of the largest crypto casinos in the world — publicly warns users to trust only platforms coming from its official domain (bc.game) and, according to multiple reports, has denied any link with B9.GAME. In other words: the imitated brand has publicly disowned the imitator. From there, user reports and reputation analyses (listed in the sources) describe a clone that reproduces BC.GAME's dashboard, color scheme, VIP bonus structure and even its terminology, propped up by a supposed Curaçao license that cannot be confirmed in any official register. And the rest you can check yourself in ten seconds: on Trustpilot, B9.GAME shows a predominance of negative reviews — as of this publication — with the same pattern repeating: blocked account, withdrawal that never arrives, support that never answers. It's the portrait of a clone: the copied brand lends it trust it never built, the license doesn't survive verification and, according to the reports, money goes in but doesn't come back out.

Mexico: 68,000 victims on official government websites

This is the most serious recently documented case of a "hijacked legitimate domain". Starting in March 2025, a cybercriminal network breached at least 40 official Mexican government websites — from states including Coahuila, Veracruz, Jalisco, Guanajuato, Oaxaca and Mexico City, plus the National Institute of Anthropology and History (INAH) — inserting malicious code hidden in routes invisible to the administrators. According to the investigation, traffic was redirected to fake casinos with names like Casino Royale, A7X, RBD 777 and MX777, which displayed fraudulent seals of SEGOB (Mexico's interior ministry) to look official. The tally, per the November 2025 report published by the Mexican press: more than 68,000 victims, estimated losses of 420 million pesos, and identity theft, card cloning or extortion associated with 70% of the cases.

Brand clones in crash games: the "name + extra word" pattern

Popular crash-game providers, such as Spribe (creator of Aviator), get their domains cloned constantly. The recipe is always the same: take the real brand name and glue on an extra word or hyphen — something like "brand-aviator", "aviator-brand" or "hub-brand". Reputation checkers like ScamAdviser routinely flag domains fitting this profile — owner hidden behind a privacy service, a registrar known for harboring fraud, a rock-bottom trust score — even when they present themselves as the brand's "official home". The practical rule that eliminates most cases: Spribe's official domains are spribe.co and spribegaming.com. Any variation with a hyphen or a word glued to the name deserves suspicion until proven otherwise — confirmed at the official source, not on the suspicious site itself. We did the full audit of the game in Is Aviator rigged? The Provably Fair audit.

The 30-second test (worth memorizing)

Before depositing at any new casino, follow this order:

• Type the URL yourself — never click an ad, a DM or a Telegram link.
• Check the domain, letter by letter, against the one you already know.
• Look the license up in the official register (your local regulator, or the Curaçao/Anjouan register for offshore sites) — don't trust the badge on the page.
• Open the Provably Fair panel and see whether you can actually verify a round.
• Check the crypto deposit address character by character before sending.

Failed any of these steps? Close the tab. Passed all of them? It's still worth running our Provably Fair verifier to confirm the game's integrity before betting larger amounts — and, to understand the rest of the crypto scam universe (impossible bonuses, frozen withdrawals, rug pulls and the like), the complete scam taxonomy is your next read.

Practical note: a good share of the clones described here depend on you clicking a malicious link before you ever reach the fake site — in an ad, an app or a message. Browsing services with built-in phishing/malware blocking, such as NordVPN's Threat Protection, help block that kind of domain before the click. It doesn't replace the checklist above, but it is one more layer. Disclosure: this is an affiliate link — if you subscribe through it, FairPlay Audit may earn a commission, at no extra cost to you. We take nothing from the casinos we audit, and our recommendation here is a security tool, not a betting site.

This article is for informational purposes and does not constitute legal, financial or investment advice. Brands and cases are cited from the public sources listed below; where an investigation is ongoing or claims come from third parties, this is indicated in the text. Always verify on your own before depositing. Gambling involves risk of loss; play responsibly.

Sources consulted for this article:

• https://www.infobae.com/mexico/2025/11/08/cibercriminales-exponen-la-fragilidad-del-gobierno-mexicano-al-convertir-sus-portales-en-casinos-ilegales-y-centros-de-fraude-en-linea/
• https://blog.tecnetone.com/en-us/hackers-hide-illegal-casino-network-on-mexican-government-websites
• https://www.gov.br/fazenda/pt-br/composicao/orgaos/secretaria-de-premios-e-apostas/lista-de-empresas
• https://www.trustpilot.com/review/b9.game (user reviews of B9.GAME — predominantly negative; directly verifiable)
• https://www.analyticsinsight.net/cryptocurrency-analytics-insight/b9game-a-warning-to-users-frozen-funds-cloned-platform-and-mounting-complaints (B9.GAME: frozen funds, cloned platform, mounting complaints)
• https://www.geekboots.com/story/b9-game-scam-warning-a-fake-crypto-casino-disguised-as-bc-game (warning about the B9.GAME clone)
• BC.GAME — public warnings to trust only the official domain (bc.game) and denials of any link with imitators/clones, as reported by industry outlets
• https://www.scamadviser.com/ (domain reputation checks; brand-clone patterns)
• https://spribe.co/ (Spribe's official domains, reference)
• ESET / Kaspersky, data on deepfake betting fraud in Brazil (2025)