Start with the RNG certificate, not the welcome banner
When a casino site asks for your money, the first thing worth checking is whether its game outcomes are independently verified. The mechanism behind every digital card, spin, and dice roll is a random number generator, or RNG. Independent testing laboratories are commonly used to certify RNG behaviour. That certification covers game mechanics, not an operator's financial conduct. A certificate tells you the games are not rigged at the code level. It tells you nothing about whether the company pays withdrawals on time, honours its terms, or will still exist in six months.
Look for the certificate itself, not a badge. A real testing report has a certificate number, a date, and a named laboratory. The operator's terms page or footer usually links to it. If the badge is an image with no underlying document, treat it as decoration. If the certificate is for a different company name than the one on the cashier page, that is a discrepancy worth resolving before you deposit.
What provably fair verification does and does not prove
Some crypto-based games use a different scheme called provably fair. A hashed server seed is published before play and revealed afterwards, letting a player verify that the outcome was not altered after their bet. It verifies individual round integrity. That is a narrow, specific promise. It is not a licence, an audit, or a guarantee of solvency. A site can run provably fair games and still freeze withdrawals, change bonus terms retroactively, or disappear with customer balances.
Here is the distinction that matters when you are deciding how much trust to extend:
| What is being checked | RNG certification | Provably fair verification |
|---|---|---|
| Game outcomes are random | Yes, for the tested games | Yes, for the rounds you verify |
| Outcome was not altered after your bet | Implied by certified RNG | Directly verifiable per round |
| Operator is financially solvent | No | No |
| Withdrawals will be paid | No | No |
| Bonus terms are fair | No | No |
| Site is licensed to operate where you live | No | No |
Neither mechanism is a substitute for reading the terms you are agreeing to. A casino can have spotless game integrity and still be a bad place to keep money.
Which terms clauses reliably signal risk
Before you deposit, open the terms and conditions page and search for a few specific clauses. You are not looking for a verdict on whether the site is "good" or "bad." You are looking for clauses that change what your balance means.
The wagering requirement, or playthrough, is a multiplier stating how much must be wagered before bonus-related funds can be withdrawn. As an example, a 30x requirement on a 50-unit bonus means 1,500 units must be wagered. That figure is not inherently unfair; what matters is whether it is stated clearly and whether game weighting changes how much each wager counts. A clause that says slots count 100% but table games count 10% means the same wagering requirement is effectively ten times larger on blackjack. If the weighting is buried in a sub-page or written so vaguely you cannot calculate it, that is a risk signal.
Three other clauses deserve a close read:
- Maximum cashout caps. A no-deposit bonus or free spins offer normally carries a cap on how much of the winnings can become withdrawable. If the cap is not stated in the same screen where the bonus is offered, assume it exists and find it before you play.
- Expiry windows. Bonus funds and free spins commonly expire. A short window is not automatically unfair, but an unstated or retroactively shortened one is.
- Dormancy and withdrawal review clauses. Look for language about how long a withdrawal can be held for review, what triggers additional identity verification, and what happens to a balance on an inactive account. The specifics will be in the operator's own terms; your job is to confirm they are written down and specific, not to memorise a universal standard.
What a functioning complaints path looks like
A casino that intends to operate honestly has a visible route for when something goes wrong. You are checking for structure, not for promises. A functioning complaints path has at least these elements:
| Element | What to look for | What its absence suggests |
|---|---|---|
| Support channel | Live chat, email, or ticket system reachable from the logged-in area | No way to escalate a dispute |
| Dispute escalation | A named internal review step or a reference to an external dispute body | Decisions are final and unaccountable |
| Regulator reference | A licence number or regulator name on the terms page or footer | No external authority to answer to |
| Withdrawal status visibility | Cashier shows pending, under review, and completed states | Funds disappear into an opaque queue |
A licence number is a claim, not a fact. You can verify it by visiting the regulator's own public register and checking that the number matches the operator name on the site. If the regulator has no public register, or the number does not appear, that is a discrepancy to resolve before depositing. The same applies to any testing certificate: verify it at the laboratory's own site, not the casino's summary of it.
Concrete signs of a phishing or cloned site
The most dangerous casino is not the one with unfair games. It is the one that is not a casino at all. Cloned sites copy the look of a real operator and collect deposits, login details, or identity documents. You check for clones by treating the URL as the primary identity of the site, not the logo.
Work through these checks in order:
- Exact domain. A clone often lives on a domain that is one character off, uses a different top-level domain, or adds a word like "login" or "verify" before the real name. Type the address yourself rather than following a link from an email or message.
- Certificate and padlock. A padlock means the connection is encrypted. It does not mean the site is legitimate. Phishing sites routinely use valid encryption certificates.
- Pressure to act. A message that your account will be closed, your bonus expires in minutes, or you must re-verify your identity through a link is a classic clone tactic. Real operators handle verification through the logged-in account area, not through emailed links.
- Payment destination. If a crypto deposit address is shown, check it against the address shown on the operator's own cashier page after you log in. A clone will often show a different address in an email than the one in the real account.
- Contact details. A cloned site often has no phone number, a support email on a free provider, and a physical address that does not match any real office. The absence of a verifiable address is a risk signal, not proof, but it belongs in your overall picture.
Build your own checklist instead of trusting a verdict
No single check answers the question of whether a casino is legitimate. The honest answer is that legitimacy is not a property you can read off a badge. It is a collection of verifiable claims, each of which you can check against an independent source. When you assemble the checks, the picture either holds together or it does not.
Here is a working checklist, in the order a new player should follow:
| Check | Where to look | What you are verifying |
|---|---|---|
| RNG certificate | Footer link to testing laboratory report | Games are certified as random by an independent lab |
| Licence number | Terms page or footer | Number appears on the regulator's public register under the same name |
| Wagering terms | Bonus terms and conditions | Playthrough, game weighting, caps, and expiry are stated clearly |
| Withdrawal process | Cashier and withdrawal policy | States, timeframes, and review triggers are written down |
| Domain authenticity | Browser address bar | Exact domain, no lookalike characters, no "verify" subdomain |
| Support channel | Logged-in account area | A ticket or chat channel exists and responds before you deposit |
Run these checks before your first deposit, not after a withdrawal is frozen. The checks cost minutes. The alternative is discovering a problem when your money is already inside the system.
FAQ
What does an RNG certificate prove about a casino?
An RNG certificate proves that the game's random number generator was tested by an independent laboratory and found to produce outcomes consistent with randomness. It covers game mechanics only. It says nothing about whether the operator pays withdrawals, honours bonus terms, or is financially stable. Treat it as one piece of evidence, not a seal of overall legitimacy.
Can a casino be provably fair and still be a scam?
Yes. Provably fair verification lets you check that a specific round's outcome was not altered after your bet. It does not verify that the operator will release your withdrawal, that its bonus terms are reasonable, or that it is solvent. A site can run mathematically honest games and still freeze balances or disappear. Game integrity and business conduct are separate questions.
How do I verify a casino's licence number myself?
Copy the licence number from the casino's terms page or footer, then visit the regulator's own website and search its public register. Check that the number exists and that the registered operator name matches the name on the casino site. If the regulator has no public register, or the number does not appear, treat that as an unresolved discrepancy and do not deposit until it is explained.
If you or someone you know is struggling with gambling, help is available. Contact the National Problem Gambling Helpline at the helpline printed in the footer below for free, confidential support, around the clock, every day of the week. You can also visit 1800gambler.net for resources and information. Please gamble responsibly and only with money you can afford to lose.
Play responsibly
Gambling should be treated as paid entertainment, never as a way to earn income or recover losses. 1-800-MY-RESET (1-800-697-3738)
18+ or 21+ depending on where you are; follow the minimum age that applies to you.
This article is general information about how these mechanics work. It is not legal advice and not a recommendation to gamble or to use any particular operator. Availability and legality differ by jurisdiction — check the rules that apply where you are.