A password alone is insufficient security. If your password is compromised, someone with your email can reset it and own your account. Two-factor authentication (2FA) adds a second verification step after the password.
Typically: you log in with your password. The system sends a code to your phone. You enter the code. Only then do you access the account.
The Incident
The Toronto man used the same password for multiple accounts. His password was part of a public database leak (from LinkedIn or similar). An attacker tried the password on Bet365. It worked.
Without 2FA, the attacker could log in, reset the withdrawal address, and drain the account. The victim would notice only when they tried to log in themselves.
With 2FA, the attacker could log in with the password, but the system would ask for a code from the victim's phone. The attacker doesn't have the phone. The login fails.
Why Operators Don't Require It
Operators could require 2FA. Many don't. Why?
Because 2FA creates friction. Some users forget their phone. Some lose their phone. Some can't receive SMS. When users can't log in, they stop using the site.
Operators optimize for activation, not security. A user who can't log in is a user not generating revenue.
The Trade-off
From a security perspective, 2FA is essential. From a business perspective, 2FA is optional friction.
Operators offer 2FA as an option. "Protect your account with two-factor authentication," they suggest. But they don't require it, because that would reduce activation.
The Toronto man didn't have 2FA enabled. He had no idea it existed. If he'd known, he probably would have set it up.
But the operator doesn't push it hard enough for casual players to know.
What Actually Happened
Once the account was compromised, recovery was difficult. Bet365 has security procedures: they ask for identity verification. But the attacker had already supplied identity verification when opening the account (or the casino hadn't enforced strict verification during login).
The victim had to contact support, prove his identity, and request the fraudulent transactions be reversed. This took three weeks. His money was locked in the account during that time.
Eventually, he was refunded. But the process was painful.
What Could Have Prevented It
-
Unique passwords for each account. The Toronto man reused passwords. This is how his password ended up in the attacker's hands.
-
Two-factor authentication enabled. Even if the attacker had the password, they couldn't access the account without his phone.
-
Alerts on withdrawal address changes. If the casino sent an email when the withdrawal address changed, he would have noticed immediately.
The casino had #3 (most do). The victim didn't have #1 or #2.
The Recommendation
For any casino or betting account: enable 2FA immediately. Use SMS-based 2FA if app-based is unavailable. Use unique, strong passwords generated by a password manager.
If your casino doesn't offer 2FA, ask them why. If they don't have a good answer, consider a different casino.
The Broader Lesson
Security is not the casino's problem. It's your problem. The casino will refund you if there's clear fraud, but they won't prevent you from creating accounts with weak passwords.
Treat your casino account like your email account. It controls access to money. Protect it accordingly.
