Short answer: run six checks before you log in or deposit: licence, domain, Steam sign-in, payout reports, clones and predictor claims. Each one has a concrete test below. Passing all six does not prove a site is safe, but failing any one is a reason to stop.
The six checks and their tests
| # | Check | The test | Pass condition |
|---|---|---|---|
| 1 | Licence | Find the authority, number and company in the footer or terms; look the number up on the authority’s register | All three are shown and the register matches |
| 2 | Domain | Compare the address letter by letter with the operator’s official channels | Exact match, no extra words or swapped letters |
| 3 | Steam sign-in | Start the Steam login and read the address bar | The page is on steamcommunity.com, not the gambling domain |
| 4 | Payout reports | Sort recent independent reviews by newest | Recent, specific, mostly consistent reports |
| 5 | Clones | Reach the site only from your own bookmark | You did not arrive by an ad, message or search result |
| 6 | Predictors | Ignore any tool that promises to forecast rounds | You are not asked to install or pay for one |
1. The licence is shown, and it checks out
A real licence has an authority, a number and an operating company. “Licensed and regulated” with no number is a claim, not evidence. Where the authority runs a public register, search the number there and confirm the company name matches the one in the site’s terms. If the register is not public, treat the licence as unconfirmed. The review pages show the licence details each operator publishes, for example the PLG.BET review lists its Anjouan licence number and operating company.
2. The domain is the official one
Clones copy the logo and layout and change one character of the address. Test it: type the name of the operator, open its official channels (not an ad), and compare the address letter by letter. Also check how long the domain has existed with a public domain lookup tool. A brand that claims to be years old on a domain registered last month is a warning sign. Our “Official site” buttons point only to addresses we visited ourselves, and we record the final address in the data.
3. Steam login happens on Steam
Sites that take skins use Steam’s sign-in to know who you are. The sign-in page must be on a Steam domain. Test it: start the login and read the address bar before you type anything. If the page asks for your Steam username, password or Steam Guard code on the gambling site’s own domain, close it. Real Steam sign-in does not give the gambling site your password.
4. Payout reports are recent and specific
A review score is a summary; the newest reviews are the evidence. Test it: open an independent review site, sort by newest, and read the last twenty. Look for specific complaints, such as a withdrawal stuck for weeks, support that stops replying, or account closure after a win. A few complaints are normal for any operator, and a pattern of the same complaint is not. Check the dates, because a three-year-old score says little about this month.
5. You are not on a clone
Many scams reach you through a promoted post, a direct message, a streamer’s link that has been altered, or a search ad. Test it: keep a bookmark to the real site that you made from an official source, and only use that bookmark. Never reach your account through a link someone sent you.
6. Nobody is selling a predictor
Predictor bots, “signal” groups and “hacks” claim to know the next crash point. They cannot, and here is the proof in one line: the crash point is set by a random value from a secret seed, and rounds are independent. If a predictor could know it, then the site’s randomness would be broken, and the site would be losing money.
Two things usually follow from a predictor: you are asked to log in with Steam on a copy of a site, or you are asked to deposit to “activate” it. Both are theft. The only thing you can learn from a past round is what happened, as we explain in provably fair crash: how to verify a round.
What a scam usually looks like in practice
- A very high bonus with no wagering terms shown.
- Pressure: “claim in 10 minutes”, “last spots”.
- A new account that can deposit but whose withdrawals need “verification fees”.
- Support only through a messaging app, and never through the site.
- A site that wins your trust with a small payout and then closes your account at a large one.
If you already logged in on a bad site
- Change your Steam password from a clean device, and sign out of all devices in Steam’s settings.
- Revoke the site’s access in Steam’s connected-apps and API-key settings where available.
- Check your trade history for offers you did not make.
- Tell Steam Support about the incident, and your bank if you paid by card.
Recovery of items or funds is not guaranteed, so prevention is the only dependable protection.
Where legit sites still fall short
Passing these checks does not make an operator good. For example, several reviewed operators publish no payout time, and the figures the others state are their own claims. See the CSGO500 review and CSGOFast review for the specific gaps we found, and the legal guide for the questions the law raises. Remember that crash has a house edge at every site, scam or not, and that only adults should play. See how we rate for how we weigh these signals.
Key points
- Six tests: licence, domain, Steam sign-in, payout reports, clones, predictors.
- Steam sign-in must happen on a Steam domain.
- Predictors cannot work and are a common way to steal logins.
- Prevention matters, because recovery is not guaranteed.