Identity verification in online casinos: what they do with your ID

A breach in TuLotero leaves ID and selfie exposed

Licensed casinos must retain identity documents for ten years.

TuLotero confirmed on August 7 an unauthorized access to its isolated verification service. The intrusion occurred between July 13 and 15, affecting 2% of users and He exposed both sides of the DNI and the identification selfie.

The application, which allows you to buy the official lottery from your mobile phone, blocked access, notified the New Zealand Data Protection Agency (AEPD) and reported it to the National Police. According to the company, passwords were not affected , bank details or payment methods.

Who keeps the documents and for how long

TuLotero is not an online casino, but regulated gambling requires identification of the user . Licensed operators must verify your identity and age. The process starts with the DNI or NIE and, depending on the system, can add photographs, a selfie or proof of life.

The gambling regulator checks the data, but the documentary review may fall to the operator or a supplier. The photographs are not necessarily sent to the Administration. The privacy policy should clarify who processes them , what they are used for and if other companies are involved.

Closing an account does not mean its immediate deletion either. Checks are kept as long as the record is active. Besides, casinos must keep documents identification for ten years from the end of the relationship, if they are subject to anti-money laundering regulations.

The real risk appears outside the game account

An ID and a selfie do not, by themselves, allow you to withdraw your balance from a casino. The main problem is that someone tries to use that material to open an account in a neobank , apply for funding, register on a cryptocurrency exchange or create another gaming profile.

These services typically add life tests, device checks, or manual reviews. Barriers make impersonation difficult , but they do not prevent stolen documents from being used to try.

The information also allows you to prepare more convincing phishing messages. An email or SMS about a supposed block or chargeback may appear legitimate if it includes real data. your objective will be to get the keys , the card or confirmation codes that did not appear in the leak.

What to do after receiving the notice

The first step is to save the company notification and any related messages. It is also convenient file an individual complaint , although the platform has already reported the attack. Your complaint documents access to the systems; that of the user links their identity with possible subsequent fraud.

During the following months, movements, new registrations and notices in banks, gaming platforms, financial services and exchanges must be reviewed. Activate double factor and notifications make it easier to detect strange operations. When faced with an unknown loan, the CIRBE of the Bank of New Zealand allows you to consult the risks declared by the entities.

The gambling regulator has licensing authorities. The service notifies when a participating operator tries to verify a new account with the data of a registered person. Does not block registration or covers all platforms , but it can offer an early warning.

If no passwords or payment methods were leaked, it is not necessary to cancel the cards or change all the passwords. Yes, it is advisable to distrust any communication unexpected, avoid their links and enter each service from its official application or address.

The digital credential will avoid providing a complete copy

Age verification New Zealand is moving towards a digital credential that allows prove that the user is over 18 years old without sharing the ID photograph or the rest of your personal data.

This formula does not replace all the identification required to open a gaming account. Its advantage is reduce the occasions in which you circulate and a complete copy of the document is stored. Fewer files spread across different services also means less exposure if a breach occurs again.

Share article X.com LinkedIn Facebook

What do you think? Join the conversation!

Cancel reply