Start with the offer text, not the brand name
When a bonus offer reaches you, the first thing to check is not whether the name on the page looks familiar. It is whether the offer text states its own conditions in a way you can verify. A legitimate-looking bonus can be attached to a cloned site, and a confusing bonus can sit on a perfectly ordinary operator. The offer itself is the first document to interrogate.
Read the promotional page as a contract, not as marketing. The three clauses that matter most are the wagering requirement, the maximum cashout, and the game weighting. If any of those three is missing, the offer is incomplete, and an incomplete offer is a risk signal regardless of who is making it.
Wagering requirement is a multiplier stating how much must be wagered before bonus-related funds can be withdrawn. As an example, a 30x requirement on a 50-unit bonus means 1,500 units must be wagered. Maximum cashout caps how much of the bonus-derived winnings can ever be withdrawn, even after wagering is complete. Game weighting changes how much each wager counts toward the requirement: a slot spin might count fully while a table game wager counts as a smaller fraction or nothing. All three numbers should be visible before you accept the offer.
What an RNG certificate does and does not tell you
Casino games run on a random number generator, the algorithm that determines game outcomes. Independent testing laboratories are commonly used to certify RNG behaviour. When you see a certificate or a laboratory logo on a site, you are looking at a claim about game mechanics: that the outcomes are produced by a process the laboratory examined.
Certification covers game mechanics, not an operator's financial conduct. A site with certified RNGs can still delay withdrawals, apply aggressive bonus terms, or operate without a complaints process that works. A certificate is one input into your assessment, not a verdict on the whole operation.
The useful check is to verify the certificate itself. A genuine certificate usually carries a reference number or a link to the laboratory's own verification page. If the logo is an image with no link, or the certificate number cannot be looked up on the laboratory's site, you have not verified anything. You have seen a picture.
| What you are checking | What it certifies | What it does not cover |
|---|---|---|
| RNG testing certificate | Game outcome generation under examined conditions | Withdrawal speed, bonus fairness, operator solvency |
| Provably fair verification | Individual round integrity for supported crypto games | Licensing, auditing, financial conduct, all other games |
| Terms and conditions | The operator's own stated rules for the offer | Whether the operator will honour them in practice |
| Complaints channel | That a route for disputes exists | Whether the route produces outcomes |
Provably fair: a narrow but useful tool
Some crypto-based games publish a hashed server seed before play and reveal it afterwards. This is the provably fair scheme. It lets a player verify that the outcome of a specific round was not altered after their bet was placed. The check is real and can be run by the player, usually through the game's own verification tool or a third-party implementation.
But the scope is narrow. Provably fair verifies individual round integrity. It is not a licence, an audit, or a guarantee of solvency. A game can be provably fair while the operator behind it delays withdrawals indefinitely or applies bonus terms that make cashing out practically impossible. Treat provably fair as evidence about one game's mechanics, not about the business running it.
If a site advertises provably fair, look for the actual verification interface. A claim without a way to check the seed before and after play is marketing, not verification.
Terms clauses that reliably signal risk
Some clauses are not automatically unfair but require you to read them closely. Others are structural warning signs. The difference is whether the clause is specific and bounded, or vague and unbounded.
A specific clause says what it means: a wagering requirement, a maximum cashout, an expiry. A vague clause says the operator may do something at its discretion without defining the trigger or the limit. Phrases like "bonus abuse will result in forfeiture" without a definition of abuse, or "withdrawals may be delayed for review" without a stated review window, leave the operator holding all the interpretive power.
Other clauses to read carefully: game restrictions that exclude most titles from contributing to wagering, maximum bet limits during bonus play, and any clause that lets the operator amend terms unilaterally without notice. None of these is proof of wrongdoing on its own. Together, or in vague form, they describe an offer where the path from bonus to withdrawable cash is narrow and controlled entirely by one side.
What a functioning complaints path looks like
Before you deposit, find the operator's complaints and dispute process. It should be reachable from the site's footer or support page without logging in. The path should name the steps: how to raise a dispute, what information to provide, how long a response takes, and what happens if you are unsatisfied with the answer.
A functioning path does not guarantee a favourable outcome. It guarantees that there is a defined process, with a defined owner, and a defined escalation point. A missing or circular path — one that routes all complaints to the same generic support inbox with no escalation — tells you that disputes will be handled however the operator chooses in the moment.
Ask one question before depositing: if a withdrawal is rejected, who do I contact, and what happens next? If the answer is not on the site, the path is not functioning.
Cloned and phishing sites: the concrete signs
A cloned casino site copies the look of a real operator, often with a slightly altered domain name. The goal is to collect deposits or login credentials from players who do not notice the difference. The signs are checkable without any technical skill.
First, look at the domain itself. A clone often uses a misspelling, an added word, a different top-level domain, or a hyphen inserted into a familiar name. Second, check the certificate details in your browser: a cloned site may have a valid-looking padlock, because encryption is cheap and automatic. The padlock is not a trust signal.
Third, compare the offer against the operator's known terms. A clone often offers a bonus that is dramatically better than anything the real operator advertises, because the clone never intends to pay. Fourth, check the payment instructions. A request to send funds to a personal wallet, a payment page that is not the operator's own cashier, or pressure to use an irreversible transfer method is a strong signal that you are not dealing with the operator you think you are.
On-chain transfers are irreversible once confirmed, require the correct network to be selected, and settle according to network confirmation times and fees rather than the operator's banking hours. That irreversibility is exactly why a phishing site prefers them.
A checkable framework, in order
You do not need to prove a site is legitimate. You need to check the things that are checkable, and weigh what remains unverified. The order matters, because each step is cheaper than the one before it and none of them requires you to deposit.
Start with the offer text: are the wagering requirement, cashout cap, game weighting and expiry all stated? Then check the RNG or provably fair claim: can you verify it through the laboratory or the game's own tool? Then read the terms for vague or unbounded clauses. Then find the complaints path and test whether it names steps and owners. Then check the domain and payment instructions for clone signals.
If any step fails, you have not proven the site is a scam. You have proven that the offer is not fully checkable, and that is enough reason to walk away. The burden of clarity is on the operator, not on you.
FAQ
Can a bonus be legitimate but still not worth taking?
Yes. A bonus can be honestly described and still be a poor choice for you, because the wagering requirement, game weighting and cashout cap may make the path to withdrawable cash very narrow. Legitimacy and value are separate questions. Read the terms and decide whether the offer fits your play, not whether the operator is honest.
Does a padlock on the site mean it is safe?
No. The padlock indicates that the connection between your browser and the site is encrypted, which is standard and cheap to obtain. It says nothing about who operates the site, whether games are fair, or whether withdrawals will be paid. Treat encryption as a baseline, not as evidence of anything else.
What should I do if the offer terms are different after I sign up?
Take a record of the offer as you saw it before registering, then compare it against the terms shown in your account. If the terms changed without notice, that is a dispute to raise through the operator's complaints path. If the path is missing or circular, the discrepancy itself is a signal about how the operator handles disagreements.
Gamble responsibly. If you or someone you know has a gambling problem, call the helpline printed in the footer below for confidential support.
Play responsibly
Gambling should be treated as paid entertainment, never as a way to earn income or recover losses. 1-800-MY-RESET (1-800-697-3738)
18+ or 21+ depending on where you are; follow the minimum age that applies to you.
This article is general information about how these mechanics work. It is not legal advice and not a recommendation to gamble or to use any particular operator. Availability and legality differ by jurisdiction — check the rules that apply where you are.