Bets You Did Not Place Appear in Your Account: What to Do If You Suspect a Hack

If your history shows bets or game rounds you do not recognise, stop all activity and save the evidence first. Record the balance, the transaction ID, the time, the amount, the game or market, your devices and active sessions. Then, from a trusted device, secure your email, set a new unique password, end all sessions and turn on two-step verification if the service supports it. Contact the operator only through its official website and ask it to restrict further transactions, log the incident and check the account logs.

Do not treat the cause as established before the investigation. An unknown entry may come from a compromised account, access by another person, a sync delay, a linked wallet or a display error. Ask not for an instant refund but for the data to be preserved and for a reasoned answer on each transaction. If there is an unknown deposit or withdrawal, contact your bank or payment service separately through its official contacts.

What counts as suspicious activity

New bets are not the only thing worth checking. Record any change you did not make:

• a game round or bet;
• a deposit, withdrawal or transfer between products;
• a cancelled withdrawal request;
• a change of email, phone number or address;
• a new payment method;
• two-step verification being turned off;
• a password reset;
• a new device or session;
• a bonus activation;
• a limit change;
• a support request made in your name.

One sign on its own does not prove a hack. It starts the process of protection and checking.

The first 15 minutes: what to do first

1. Stop playing

Do not place a “test bet”, do not top up and do not cancel the disputed transaction. New actions change the history and can make it harder to compare the state before and after the incident.

2. Capture the starting state

Take full-screen screenshots of:

• the current balance;
• the full row of the unknown transaction;
• the transactions before and after it;
• your profile and KYC status;
• active sessions and devices, if that section is available;
• login and change notifications;
• your payment history.

Do not crop out the time, currency, URL or identifiers. Write down the time zone.

3. Secure your email

Email is often used to reset passwords. The NCSC advises checking for unknown forwarding rules and filters, because an attacker may be receiving copies of your emails. Change your email password if there are signs of access and end any unknown sessions there.

4. Change your passwords

From a trusted, up-to-date device, set a new unique password for your gaming account. If the old password was reused on other services, change it there too. Do not give the new password to support.

5. End sessions and turn on 2FA

The NCSC recommends signing out of the account on all devices after changing the password and turning on two-step verification. If that feature is not available, ask the operator to force all sessions to end.

6. Report the incident

Use the official website, not a contact from an unexpected message. Ask for a ticket number and a temporary restriction on bets, payments and profile changes, if the operator offers that option.

A record card for each unknown bet

The UK Gambling Commission describes gambling logs as records that can contain the selection, the stake, the odds, the type and the result. This is a technical description of the British regulated system, but it shows why an ID and a time are more useful than a general screenshot of the balance.

What history to request

For the relevant British licensees, RTS 1 requires giving the customer easy access to at least three months of history and, on request, providing at least 12 months. This rule is not an international retention period. In another jurisdiction, check its requirements and the operator's rules.

Request, in an accessible format:

• the history of logins and security changes, if the operator can provide it;
• the history of bets and rounds;
• deposits, withdrawals and movements of funds;
• profile changes;
• bonus activations;
• support requests;
• a server-side check of the specific IDs;
• a final position on each disputed transaction.

The operator may not disclose sensitive anti-fraud rules or full technical logs. Ask for a sufficient explanation, not for the system's secrets.

A message to the operator

Square brackets mark the fields to replace.

Account [ID]. On [date and time, time zone] I found transactions [list of IDs] that I do not recognise. After finding them I stopped all activity, changed my password, ended all sessions and [turned on 2FA / asked for sessions to be ended]. Please log the incident, preserve the account logs, temporarily restrict new bets and payment changes, check the transactions listed and give me a reasoned written reply. A timeline and screenshots without unnecessary personal data are attached.

Do not include your password, 2FA codes, CVV, PIN, seed phrase or private key in the message.

Unknown bets and unknown payments are not the same thing

If the dispute concerns only an internal gaming transaction, the bank cannot establish who pressed the bet button. If there is an unfamiliar deposit, withdrawal or card charge, open a separate request with your bank at the same time.

Tell the bank:

• the exact transaction;
• when you discovered it;
• which details may have been exposed;
• what security measures you have already taken;
• the operator's ticket number.

Do not mix up a deposit you authorised with an unknown bet. Clearly separate the payment you actually made from the actions you do not recognise.

Possible explanations to check

A table like this helps you collect verifiable data instead of arguing about theories.

If the operator refuses

Ask the operator to:

• confirm that each ID was checked;
• state the time and method of login, if disclosure is permitted;
• name the account responsibility rules it applied;
• explain the change in the balance;
• provide the available history;
• give a final reply;
• name the next step for a complaint.

If the replies contradict each other or the transactions were not reviewed one by one, draw up a formal complaint. The route to ADR, a regulator, a bank or the police depends on the licence, the country and the nature of the incident. Do not apply the British eight-week ADR deadline to an operator in another jurisdiction.

How IPU.bet can help

IPU.bet can help you structure the timeline, the list of IDs and the request to the operator. IPU.bet has no access to a partner's server logs, does not determine who placed a bet and does not guarantee a refund, an unblock or a reply within a set time.

Send Player Support anonymised screenshots and replies. The IPU.bet policy states that by default the platform does not need a full passport, a bank statement, card details or access secrets for an initial review.

Help from IPU.BET

Key points to remember

When an unknown bet appears, first capture the state, then secure your email, password and sessions. Do not make new transactions to test anything. Each disputed entry needs an ID, a time, an amount, a product and its link to the balance.

A suspected hack is not yet an established cause. Ask for the logs to be preserved and for a reasoned reply. Report unknown payments to your bank in parallel through the official channel.

18+. Play responsibly. Gambling is not a way to make money.

Fill in a record card for each unknown transaction and send the operator the template from this article. If there is no reply on each ID, put together an anonymised timeline and open the IPU.bet request form.