Light Casino security: accounts, payments and fake sites

A copied website, a message pretending to be from us, an app that uses our name: this page shows how to tell ours from the copies, and what protects your account and your card payments.

Anything that uses the Light Casino name and is not among the official channels listed here is not us, however convincing it looks.

Check the address before you sign in

A copy can reuse our design, our logo and even our terms word for word. It cannot use our address, so it picks one that looks close enough: an extra letter, a different ending, a hyphen in a new place.

Official domains

Light Casino operates these domains, and no others.

light-casino.biz
addresses ending in .light-casino.biz

Type it or bookmark it: Reach the site by typing light-casino.biz or from your own bookmark, not from an advert or a link in a message.
Read the address from the right: The name just before the first single slash owns the page: light-casino.biz.example.com/login belongs to example.com, not to us.
“Mirrors”: A “mirror”, a backup address or a way round a block is a copy unless its domain is in the list above.
If you signed in on a copy: Change your Light Casino password at once and tell Light Casino support. If you typed in card details, call your bank on the number printed on your card.

Protecting your account

HTTPS: Pages on light-casino.biz are served over HTTPS, encrypted with TLS: the protocol designed to stop anyone in between from reading, altering or forging what you send. If your browser says the connection is not secure, do not sign in.
Your password: Use one you use nowhere else, ideally made and kept by a password manager.
Two-factor sign-in: Two-factor sign-in is available on every account and stays off until you turn it on in Account › Security › Two-step verification. With it on, a stolen password alone does not open your account: signing in also needs the six-digit code from an authenticator app on your phone, which changes every 30 seconds.
Codes are yours alone: Light Casino support will never ask for your password or a sign-in code. Anyone who asks is trying to get into your account.

How we contact you

Email from Light Casino comes only from addresses ending in @light-casino.biz, and text messages only from the sender name LightCasino.

A sender name can be faked. If a message asks you to sign in, confirm a payment, verify your identity or release a withdrawal, do not use its link: open light-casino.biz yourself, or ask support whether the message is real.

Fake apps and APK files

Light Casino app

Light Casino has no app in the App Store or Google Play, and no APK file: the site runs in your browser. Any app or file offered under our name is not ours.

An APK is the file an Android app is installed from. One downloaded from outside Google Play skips the safety check Google Play runs before you download an app. If you do install apps from other sources, keep Google Play Protect switched on: it checks those apps too, and warns you about harmful ones.

Card payments and 3-D Secure

Payment methods and limits

When you pay by card online, the bank that issued your card may ask you to confirm the payment with a one-time code, a fingerprint or face check, or another method it uses. That step is 3-D Secure. Your bank runs it, not us, and it makes it much harder for someone who has your card details to pay with them. Many payments pass with no visible step because the bank judges them low-risk; riskier ones get the check.

In the European Economic Area, the Payment Services Directive (PSD2) requires this kind of strong customer authentication for electronic payments, with some exemptions. It combines at least two independent elements: something you know, such as a password or PIN; something you have, such as your card or a code-generating device; something you are, such as a fingerprint.

If a prompt looks wrong: Stop, and call your bank on the number printed on your card.
If the check fails: The payment is not completed. Try again, or ask your bank why: the decision is the bank’s, not ours.

Reporting a security problem

Found a vulnerability in light-casino.biz, or in how Light Casino accounts work? Write to security@light-casino.biz; we reply within 5 days.

Include the address or feature, the steps to reproduce the problem and what someone could do with it. Test only on your own account, do not access anyone else’s data, and give us time to fix it before you publish. The same address takes reports of copied sites, fake messages and fake apps.

Sources

IETF — RFC 8446, TLS 1.3: TLS is designed to prevent eavesdropping, tampering and message forgery.
EMVCo — EMV 3-D Secure: The card issuer authenticates the cardholder; many payments pass without friction, higher-risk ones get a challenge such as a one-time passcode or biometrics.
European Central Bank — the revised Payment Services Directive: Strong customer authentication uses two or more independent elements of knowledge, possession and inherence; some payments are exempt.
EUR-Lex — Delegated Regulation (EU) 2018/389, Article 4(1): Strong customer authentication is based on two or more elements categorised as knowledge, possession and inherence.
Google Play Help — Google Play Protect: Play Protect checks apps from Google Play before download, checks apps from other sources on the device, and warns about harmful ones.

Written by Light Casino · Last reviewed 14 September 2026