Cloned casino sites and fake casino apps, explained

What a cloned casino site actually is

“Cloned casino site” covers two closely related cons that feel identical from the player’s side.

The pixel-copy clone. A real, recognisable brand is duplicated almost exactly — logo, colours, game lobby, login screen — and hosted on a lookalike domain. The address is the giveaway and also the trap: it’s almost right. An extra hyphen, a swapped letter, a different ending (.net instead of .com, .casino instead of .co.uk). Everything you see looks like the brand you intended to visit, because it was copied from that brand. Only the destination of your money and data has changed.

The wholly invented casino. No real brand behind it at all — a casino that exists only as a website, dressed up with stock game thumbnails and, crucially, a fabricated licence badge. A “UKGC Licensed” graphic, a Gambling Commission logo, an official-looking licence number in the footer. None of it is verified by anyone. A badge is just an image; anyone can paste one onto a page. The number beside it is the only thing that can be checked — and on a fake site it leads nowhere on the official register.

Both versions exploit the same instinct: that a site which looks legitimate is legitimate. It isn’t. Appearance is the cheapest thing in the world to copy.

The three ways a clone reaches you

Clones almost never appear out of nowhere — they’re delivered through one of three channels, and each one is a place where you click before you check.

1. Paid social ads. Sponsored posts on social platforms, often using a real brand’s name and artwork, linking to the lookalike domain. The ad approval process is not a licence check, so a clone can buy its way directly into your feed.

2. Search results for closed brand names. When a casino leaves the UK market, its name keeps being searched — and impostors move into that gap. This is documented on our register. Thrills Casino exited the UK market, and per its review record, lookalike domains now trade on its name. Casino Calzone closed in October 2020 as a business decision; as the register notes, its old domain may since have passed into unrelated hands. And the Winner Casino entry documents how many domains can cluster around a single brand name — a structure that makes it easy for a player to land on the wrong one.

3. Phishing messages. Emails, texts and direct messages claiming to be from a casino — a “bonus”, a “verification required”, a “withdrawal ready” — with a link to the clone. The message manufactures urgency so you act before you read the address.

What a clone is actually collecting

A clone doesn’t need you to lose at games — most don’t bother running real ones. The product is you, in three layers:

• Deposits. The most direct theft. Money goes in and never comes out, because there’s no real casino behind the cashier — just a payment form pointed at the operator’s account.
• Card details. The card number, expiry and security code you enter at the “deposit” screen can be used for further fraud or sold on, whether or not the initial deposit even “succeeds”.
• KYC documents. This is the most damaging and least obvious layer. A clone will happily ask you to “verify your account” by uploading a passport or driving licence and a proof of address — exactly the documents a real casino requires. Handed to a fraudster, those become tools for identity theft and for opening accounts in your name. The ID-reuse risk outlives the lost deposit by years.

That last point is why a clone is worse than a bad bet: the money is recoverable in some cases, but a copy of your passport, once taken, is out there for good.

How to verify you’re on the real site

Because clones win on appearance, the defence has to be mechanical — something that doesn’t care how convincing the page looks. Three habits do almost all the work:

• Check the exact domain against the register’s domain list. The Gambling Commission’s public register doesn’t just list licensed operators — it lists the domains each licence covers. The genuine address will appear there, character for character. A site that looks like the brand but sits on a domain absent from that list is the clone. Our check-a-licence walkthrough shows exactly where to look.
• Type the address yourself. Reach the casino by typing its known address into the bar, or from a bookmark you saved from a verified visit — never by clicking a link in an ad, a message or an unverified search result.
• Never enter through ads. Treat every sponsored link to a casino as untrusted by default. If an offer is real, it will still be there when you arrive via the verified address.

Remember the badge rule from Section 01: a licence graphic proves nothing. The licence number, looked up on the official register, is the only thing that does.

Fake reviews and forged licensing seals

A clone’s hardest problem isn’t looking like a casino — that’s easy — it’s surviving the moment a cautious player goes looking for reassurance. So the better operations manufacture the reassurance in advance, and AI tooling has made that cheap enough to do at scale. Two fabrications do most of the work.

Forged licensing seals. A “UKGC” or “MGA” badge in the footer, sometimes with a real-looking licence number, occasionally even a number genuinely belonging to a different, licensed operator — borrowed in the hope you won’t cross-check the name. The graphic is just an image; it links nowhere, or links to a page the same site controls. As Section 04 put it: the seal proves nothing, the number looked up on the official register is the only thing that does. A licence number that resolves to a different company’s name is not a clerical quirk — it is the tell.

Manufactured reviews and “news”. Search a brand-new rogue brand and you may find a tidy consensus of glowing five-star reviews, a freshly built “review site” that rates it highly, even article-shaped pages praising it. Much of this is generated — AI can produce a hundred plausible reviews and an entire endorsement site overnight, all pointing one way. The giveaways are structural: reviews clustered in a narrow date range, uniformly positive with no specific detail, on domains as young as the casino itself, frequently earning affiliate commission on every signup they send.

The defence is the same mechanical one throughout this guide, and it is immune to how convincing the credibility looks: trust the official register, not the page’s own self-description. A real licence verifies on the Gambling Commission’s site; manufactured praise does not survive the one source the scammer cannot fake.

Fake casino apps specifically

The clone problem has an app-shaped cousin, and it’s growing. Two forms dominate.

Sideloaded APKs. A site or message offers you the casino “app” as a downloadable Android package to install directly, outside any official store. Sideloading bypasses the store’s screening entirely, so a fake or malware-laced app installs with whatever permissions it asks for — including access that lets it harvest far more than a website could.

App-store lookalikes. Even inside official stores, copycat apps appear: a familiar name, a near-identical icon, published by an unfamiliar developer. They ride the brand’s reputation to get installs, then run the same deposit-and-document harvest as a web clone.

The checks don’t change. Confirm the casino is licensed and that the app is the one its verified website links to; read the developer name, not just the icon; and be deeply suspicious of any casino that wants you to sideload an APK rather than reach it through a checked, licensed route.

If you’ve already entered your details

If you suspect you’ve deposited at or handed details to a clone, speed matters more than certainty — act now, confirm later.

• Contact your bank immediately. Tell them you may have entered card details on a fraudulent site. Ask them to freeze and replace the card, and to flag the transactions. Doing this the same day preserves the most options.
• Ask about a chargeback. A card payment to a fraudulent merchant may be reversible through your card scheme, but time limits apply. The recovery guide covers what realistically works and in what order.
• Report it to Action Fraud. Gambling fraud is fraud. Reporting feeds enforcement and creates a record you may need later. The complaints guide explains the reporting routes.
• If you uploaded ID, treat it as compromised. Watch for accounts or credit applications you didn’t make, consider a credit-file alert, and keep the evidence. A stolen identity document is a longer-term problem than a lost deposit, and the sooner it’s flagged the better.

And ignore anyone who contacts you afterwards promising to recover your money for a fee — that’s the second wave, not a rescue.

Related reading

• All scam types: the full taxonomy
• How bonus traps work
• Roulette systems and the winning-system myth
• Thrills Casino and Casino Calzone — closed brands with documented lookalike activity
• How to check a gambling licence and its domains
• Get your money back and complaints & ADR