Two-factor authentication at the login screen cut account takeovers by roughly 60% across a sample of U.S.-facing online gambling accounts, according to a 2024 review of operator incident data covering about 41,000 accounts. The drop held across sportsbook, casino, and poker products, which surprised some fraud teams who expected poker—where players share hand histories and chat—to resist the improvement. What the numbers suggest is that most takeovers were never sophisticated; they were credential stuffing that a second factor quietly killed.
Why the login screen is where the money leaks
Account takeover in iGaming rarely starts with a hack. It starts with a reused password from a breach somewhere else, tested in bulk against a casino login. Fraud teams have known this for years, but the operational response often focused downstream: withdrawal holds, KYC re-checks, bonus abuse flags. Those catch losses after the attacker is already inside, and by then they've often changed the email, drained a balance into crypto, or used the account's saved payment method.
Moving the control to login changes the economics. A password alone is a guessable secret; a password plus a device-bound code is not. The 60% figure lines up with what payment processors reported after rolling out mandatory 2FA in 2022 and 2023—most of the reduction came in the first 90 days, then flattened.
What kind of 2FA actually moved the number
Not all second factors perform the same. SMS codes cut takeovers but leaked some protection to SIM-swap attacks; authenticator apps and passkeys performed better. Operators in the sample that pushed passkeys saw takeover attempts fall further, though adoption stayed under 20% of active players even after prompting. The lesson: the first factor upgrade gets you most of the 60%, and the last mile is a slower grind.
The friction question nobody has fully answered
The obvious worry is that 2FA costs you deposits. The data here is mixed. Players who enabled it logged in slightly less often in the first two weeks—about 8% fewer sessions—but their average deposit size didn't drop, and their 90-day retention was marginally higher. That could be selection bias: security-conscious players may simply be more loyal. Nobody in the sample ran a clean randomized test, which is the honest gap in the evidence.
There's also a regulatory wrinkle. Several states now require "reasonable" account security for licensed operators, and 2FA is becoming the default reading of that phrase. If your platform treats it as optional, you may be on the wrong side of an examiner's checklist before you're on the wrong side of a fraud loss.
Where players fit in
For players, the practical takeaway is dull but real: turn it on, prefer an authenticator app over SMS, and don't reuse a casino password anywhere. For operators, the harder question is whether to make 2FA mandatory at signup or nudge it after the first deposit. Mandatory kills more takeovers; nudging protects conversion. Most of the sample chose the nudge, and their 60% is really a 60% with a hole in it.
The open question
If a second factor at login removes most of the easy takeovers, where does the fraud go next? Early signs point to account recovery flows—the "forgot password" path—and to social engineering of support desks, which no authenticator app can fix. The 60% is a real win, but it may be a win that pushes attackers toward the humans rather than the technology.