Account security for large balances: 2FA, devices, phishing

Step 1: Two-factor authentication (2FA)

The single most effective action. Even if your password leaks, the attacker needs the second factor.

Enable it: Account → Security → Two-factor authentication. Store the recovery codes somewhere safe (not on the same phone).

Step 2: A password that exists nowhere else

• 16+ characters, random, from a password manager (Bitwarden, 1Password, iCloud Keychain).
• Unique — the bookmaker password must not be used on any other site. Most breaches happen via “credential stuffing”: passwords leaked from one site are tried everywhere.
• Check whether your email has appeared in a breach at haveibeenpwned.com.

Step 3: The email is the key

Your betting account is only as secure as the email that resets it. Your email needs:

• 2FA (mandatory),
• a unique password,
• a check of forwarding rules (intruders quietly add a forwarding rule to read reset emails).

Step 4: Spotting phishing

Phishing SMS and emails targeting players in Greece follow patterns:

• “Your account will be suspended — confirm your details” + link.
• “You have a €500 bonus — log in to claim” + link.
• “Unusual login from [city] — if this wasn’t you, click here”.
• A call from the “security department” asking for your 2FA code “to block the withdrawal”.

Rules:

1. Never click a link from an SMS/email. Type the domain yourself.
2. The real domain ends in .gr — check every letter (fonbet.gr ≠ fonbet-gr.com ≠ fonbеt.gr with a Cyrillic “е”).
3. No phone call ever needs a 2FA code. Hang up and call the official number yourself.

Step 5: Device and session checks

Once a month: Account → Security → Active sessions / Devices. If you see a device or location you don’t recognise: log out everywhere, change the password, re-check 2FA.

Turn on login alerts (email/push on every new device) if offered.

Step 6: Limit the damage in advance

• Locked withdrawal method: licensed operators allow withdrawals only to a method in your name. Don’t add a second one “for convenience”.
• Don’t keep large balances idle. Money you won’t use next week goes back to the bank.
• Deposit limits: they cap what an intruder can deposit with your card details.

If the account is compromised

1. Immediately: change the password from a clean device, log out all sessions.
2. Within 1 hour: contact the operator (live chat or phone) — ask for a withdrawal freeze.
3. Record: login times, IPs, transactions you did not make.
4. Change your email password and check forwarding rules.
5. If a withdrawal went to a third-party method: written complaint to the operator and, if it does not respond, to the HGC. A withdrawal to a method not in your name is an operator breach.
6. File a report with the Cybercrime Division for use in any insurance or bank procedure.

For how large-withdrawal checks work, see large withdrawals.