The one thing every genuinely bad online casino has in common is that it does not look bad. The template is polished, the game library is stocked with real providers, the licence badge is sitting in the footer where the good ones keep theirs, and the welcome offer is at least as generous as the competition. What separates the rogue operator from the merely mediocre one is a small collection of tells that almost never appear on their own, and almost always show up before the first deposit clears. Ten of them, in roughly descending order of severity.
Take five minutes, run the checklist, and if a site fails more than two of the top five you have your answer already. Every one of these tells was worked out the expensive way, by our review desk and by readers who wrote in after the fact.
- No verifiable licence
- An owner you cannot pin down
- Bonus terms that are mathematically hostile
- Vague or missing withdrawal rules
- Support that goes quiet during withdrawals
- Fake security badges
- Responsible-gambling tools that do not work
- Aggressive VIP contact after your first deposit
- Withdrawal minimums above deposit minimums
- A domain that keeps moving
- All ten, ranked by severity
- FAQ
1. No verifiable licence
A licensor logo in the footer is decoration until you click it and land on the regulator’s own database, on the regulator’s own domain, with the operator’s name and licence number listed and current. If the click opens a lightbox, jumps to a PDF hosted on the casino itself, or leads nowhere at all, the badge is a graphic and the operator is unlicensed. Every real gambling licence in 2026, the UKGC, MGA, SGA, Kansspelautoriteit, Spillemyndigheden, ARJEL and their peers, is on a public register that anyone can search by operator name.
2. An owner you cannot pin down
The footer, or somewhere linked from it, should tell you the legal name of the company running the site, the country in which it is incorporated, and the registration number. That information should match a company you can locate on a national companies register. If the operator hides behind a shell company that turns up nothing on Google, on Companies House, on OpenCorporates, that is a hard no. You cannot enforce a payout against an entity that does not exist as far as any register is concerned.
3. Bonus terms that are mathematically hostile
“500% up to $10,000” with 60x wagering on deposit plus bonus is not a promotion anyone is going to clear, and it is not designed to be cleared. It is designed to inflate the balance briefly so that the player deposits more, keeps playing longer, and eventually loses the lot. If the wagering maths on the front-page offer look impossible before you open the terms, everything else on the site deserves the same suspicion.
4. Vague or missing withdrawal rules
A legitimate operator publishes exact withdrawal windows and fees for each supported method, and commits to them contractually. “Withdrawals processed as soon as possible” is not a commitment, it is a disclaimer. If the cashier terms are written in generalities and the FAQ dodges the timing question, you have nothing to point to when support tells you your two-week-old withdrawal is “still being reviewed”.
5. Support that goes quiet during withdrawals
The most useful pre-deposit test costs nothing. Open the live chat, ask a specific withdrawal question (“how long does a pay-by-bank withdrawal take from KYC-approved to hitting the account?”), and time the reply. A generic answer, a delayed answer or no answer at all is exactly the behaviour you can expect on the day you actually need support. The operators worth using answer the question inside a minute, in complete sentences, and often with the exact SLA in writing.
6. Fake security badges
McAfee Secure, Norton Secure, VeriSign Trusted, and their many imitators, are almost always static images in 2026. Click one. If it does not lead to a live certificate page issued by the vendor on the vendor’s domain, the badge is a screenshot and it is there to reassure, not to verify. The security that actually matters, a valid TLS certificate, a real licensor, a functioning complaints route, is invisible from the front page.
7. Responsible-gambling tools that do not work
Before you deposit, open the account-limits page and try to set a small deposit limit. The tool should apply instantly, confirm the new ceiling on screen, and email you a receipt. If the form does not save, redirects you to support, or emails you a “we’ll get back to you” ticket, the tools are cosmetic. Regulated operators are legally required to make limit-setting immediate; anything less is either a broken casino or an unregulated one.
8. Aggressive VIP contact after your first deposit
Legitimate VIP programmes are common and mostly fine. What is not fine is a private message from a “VIP host” on WhatsApp or Telegram inside an hour of your first deposit, offering “exclusive bonuses” that are not published anywhere on the site. That is a personalised trap: bespoke terms with no paper trail, applied to a balance that will not clear, on a chat channel the operator can delete when it wants to. If a real VIP scheme wants to reach out, it does so from a real corporate email address with linkable, on-site terms.
9. Withdrawal minimums above deposit minimums
A casino that will happily take a £10 deposit but refuses to send you less than £50 back has manufactured a friction gap. It is fine when your winning session lands well above the threshold. It is a problem the moment your winning session lands at £30 and your only options are “deposit and play more” or “leave the money on account and hope”. That gap is never accidental, and it is one of the more reliable indicators that the operator would rather keep your balance than pay it out.
10. A domain that keeps moving
If the casino asks you to bookmark a new mirror domain every few months, ask yourself what the old one was running away from. Regulators, blocklists, chargeback fingerprints and unhappy players all find it harder to catch an operator that changes address twice a year. A stable domain is a basic sign of an operator that expects to still be around next year and does not need to hide its history from the search engines.
All ten, ranked by severity
| # | Red flag | Severity | Deal-breaker on its own? |
|---|---|---|---|
| 1 | No verifiable licence | Critical | Yes, walk immediately |
| 2 | Owner cannot be pinned down | Critical | Yes |
| 3 | Mathematically hostile bonus terms | High | Skip the bonus; investigate the site |
| 4 | Vague or missing withdrawal rules | High | Yes |
| 5 | Support goes quiet during withdrawals | High | Usually yes |
| 6 | Fake security badges | Medium | Not alone, but rarely appears alone |
| 7 | Broken responsible-gambling tools | High | Yes |
| 8 | Aggressive VIP contact after first deposit | Medium-High | Approach with heavy caution |
| 9 | Withdrawal minimum above deposit minimum | Medium | Not alone, but a strong warning |
| 10 | Domain hops every few months | Medium-High | Usually yes at anything above trivial stakes |
How this fits our reviews
Every operator we cover on the market pages has been through this same ten-point workout, in the same order, before it was allowed into a ranking. When a casino sits high in our UK, Sweden or Netherlands tables, it has passed all ten. When we mark one down or exclude it entirely, this list is usually the reason. Pick a country from the top menu to see the checklist applied to specific brands.
FAQ
If a casino has one red flag but great bonuses, is it worth trying?
Almost never. The bonus is only real when the operator honours the payout, and one visible red flag almost always means several hidden ones you have not yet found. The generosity of the offer is exactly the mechanism the operator uses to make the flag feel worth ignoring; that is the trap, not the fine print.
How do I check a licence properly?
Click the licensor badge in the site’s footer. A working link should send you off the casino’s domain and onto the regulator’s own website, and the operator’s name and licence number should be listed on the regulator’s public register with a current status. If any of those steps break, the badge is decoration and the licence is unverifiable.
Are Curacao casinos automatically bad?
No, but Curacao remains the weakest of the mainstream gambling licences in 2026. A Curacao licence does not make an operator a scam; it does mean the enforcement machinery behind it is thinner than under a UK, Malta or Swedish licence, and your recourse when a payout stalls is much narrower. Weigh the other nine flags more heavily on a Curacao-licensed site than you would on a UKGC-licensed one.
Is there any way to test a payout before committing real money?
Yes, and we do it on every review. Deposit the minimum, complete KYC immediately, play a short session (however brief), and then request a small withdrawal to time the flow end-to-end. Any operator that stalls, changes the rules or asks for “additional documentation” that was not in the sign-up flow tells you everything you need to know before you scale up your stakes.