How Cybersecurity Protects Payments in the US Online Gambling Industry

In 2022, hackers emptied about 1,600 DraftKings accounts without breaking into DraftKings at all. They simply used passwords stolen elsewhere. Here is how US sportsbooks protect every deposit and withdrawal today, where the weak points still are, and what you can do about them.

On the first Sunday of the 2026 NFL season, GeoComply logged 99.8 million location checks for its US sportsbook clients in a single day. Every one of those checks sits on top of a payment system moving real money in seconds. For criminals, that combination of speed and cash makes betting apps an attractive target.

Whether you follow the NFL or watched the 2026 World Cup across North America, the same question applies: how safe is the money you deposit? This guide explains how payments move through a US betting app, the security layers that protect them, what happened when those layers failed, and the simple steps players can take to protect their own accounts.

Why betting payments are a target

The US market is large and growing. According to the American Gaming Association, commercial sports betting revenue reached $16.89 billion in 2025, up 22.6%, while online casino revenue rose 27.6% to $10.73 billion. Online casino games are legal in only seven states, but sports betting is available in far more.

Unlike a bank, a betting account is built for fast, frequent transactions. Players deposit before kickoff, bet during the game and withdraw after the final whistle. That speed is what customers want, but it also gives attackers a short window to move stolen money before anyone notices. Big events increase the pressure: GeoComply recorded a peak of 14,300 location checks per second just before half-time of Super Bowl LIX.

How a deposit travels

US players fund accounts in several ways. Common options include debit and credit cards, instant online banking through services such as Trustly, ACH bank transfers through processors such as VIP Preferred, PayPal, Venmo, Apple Pay and Play+ prepaid cards. Each method passes through banks and payment processors, and each step has to be secured.

The rules vary by state. Iowa, Massachusetts, New Hampshire, Oregon, Rhode Island, Tennessee and Vermont do not allow credit cards to fund sportsbook accounts. At federal level, the Unlawful Internet Gambling Enforcement Act of 2006 requires payment systems to block transactions linked to unlawful online gambling, which is one reason some banks refuse gambling payments altogether.

The security layers that protect your money

Card data standards: PCI DSS

Any business that handles card payments must follow the Payment Card Industry Data Security Standard (PCI DSS). Version 4.0 became the only valid standard on 31 March 2024, and its newer requirements became mandatory on 31 March 2025. These include multi-factor authentication for all access to systems holding card data, controls on every script running on payment pages, and protection for staff against phishing.

In practice, this means card numbers are encrypted in transit and operators keep the number of systems that touch raw card data as small as possible. The payment page rule matters because criminals often try to inject hidden code into checkout pages to copy card details as customers type them.

Identity checks before the first bet

Licensed US sportsbooks must verify who their customers are before allowing real-money play. This Know Your Customer (KYC) process confirms identity, age and address, and helps stop stolen identities being used to open accounts. It also supports anti-money laundering controls, because operators need to know whose money is moving in and out.

Multi-factor authentication

New Jersey, the most established online market, requires operators to use multi-factor authentication (MFA) for customer logins. That means a password plus a second factor, such as a code sent to a phone. Under the Division of Gaming Enforcement’s guidance, a player who logs in successfully on the same device can skip MFA for up to two weeks.

The same guidance recommends not allowing email addresses as usernames, because they are the easiest target for credential stuffing. It also says operators should investigate when one account is used on more than three devices within 24 hours. These small rules are designed to spot a criminal logging in from a new phone or laptop.

Geolocation

Every licensed app must confirm that a player is physically inside a state where betting is legal. GeoComply, the main provider, says it uses more than 820 data points to do this. Checks happen at registration, login and each time a bet is placed. Beyond legal compliance, this helps detect fraud, because an account suddenly appearing in an unusual place can signal a takeover.

Regulators who audit the systems

State regulators add their own requirements. In New Jersey, each casino offering online gaming must have an independent professional carry out an annual system integrity and security assessment, and send the results to regulators. Primary gaming servers must be located in secure facilities in Atlantic City, and players must re-enter their login details after 15 minutes of inactivity.

When security fails: lessons from real cases

The most important US case involved DraftKings. In November 2022, attackers used username and password combinations leaked from other websites to break into accounts where customers had reused passwords. This technique is known as credential stuffing. DraftKings said its own systems were not breached, but 67,995 customers were affected.

According to the FBI, around $600,000 was stolen from about 1,600 accounts. The method shows exactly where payment security can break down. Buyers of the stolen accounts added their own phone number to switch on two-factor authentication, deposited a small amount to verify a new bank account, and then withdrew the balance to that account. DraftKings said it restored funds for affected users.

Wisconsin teenager Joseph Garrison pleaded guilty and in early 2024 received 18 months in prison, plus more than $1.3 million in restitution. Investigators found about 40 million username and password pairs on his devices. Two other suspects were charged in January 2024. For operators, the case showed that strong systems are not enough if attackers can log in as the real customer.

Other incidents show the wider risk. BetMGM disclosed a 2022 breach of personal information affecting more than 1.5 million customers, and a related lawsuit was dismissed in June 2025. In September 2023, attacks hit Caesars Entertainment and MGM Resorts. MGM expected costs above $100 million but said no payment card or bank account data was taken, while Caesars was widely reported to have paid $15 million of a $30 million ransom demand.

What players can do

Most account takeovers start with a reused password, so the best protection is simple. Use a unique password for every betting app, switch on the strongest login protection offered, and never share account access. Only use licensed operators, because offshore sites are not audited by US regulators and players have little protection if money disappears.

It also helps to unlink a bank account when you are not using it and to check your account history regularly. Any unexpected change, such as a new phone number, new payment method or withdrawal you did not make, is a warning sign that should be reported to the operator and, if necessary, to the state regulator straight away.

The bottom line

Cybersecurity in US online gambling works in layers: card data standards, identity checks, multi-factor logins, geolocation and state audits all protect each payment. The DraftKings case proved that the weakest point is often the login rather than the payment system itself. As betting volumes keep rising around the NFL season and major tournaments, both operators and players have a role in keeping that door locked.