How to Protect Your Identity Documents

Upload inside the account, not over chat

Use the verification form in your own logged-in account. Email and chat attachments pass through systems with broader internal access and longer retention, so an agent asking you to email documents is a reason to confirm the route first.

Check the page address before attaching anything. The domain should match the site you deposited on, character for character, and the connection should be encrypted. A link that arrived by message is worth typing by hand.

Where an account offers no upload form and documents can only go by email, treat that as a finding about the operator, not an inconvenience.

What the check actually needs

Each check has a narrow purpose. Identity confirms name and date of birth, address confirms where you live, payment ownership confirms the method is yours, and source of funds applies to larger play.

Send the pages requested and stop there. A full bank statement answers an address check with a complete spending history attached, more than was asked for.

Redaction: cover what is not being checked

Follow the operator's stated redaction rule where there is one. An over-redacted file is normally rejected and re-sent, and a second upload doubles the exposure. Where no rule is published, ask support in writing first.

On a card image, the security code and the middle digits are commonly covered while the cardholder name and visible end digits remain. On a statement used for an address check, unrelated transaction lines can be covered.

Flatten the file before sending. Photos carry location and device metadata, and a box drawn over text in a PDF can sometimes be removed again. Export to a flat image, then try to select the text you covered.

Keep a record of what you sent

Save a copy of every upload exactly as sent, in a dated folder, with the confirmation screen or email. When a document is requested again, that record shows what the operator already holds.

Note the date, the file, the channel and who asked. A later claim that nothing arrived is answered by the note, not by uploading the same document a third time.

Requests that did not come from the operator

Impersonation follows verification closely, because a document request feels normal once an account exists. Signals worth checking: unprompted contact, a deadline attached, a sender domain that differs from the site, a form hosted outside the account, and any request for a password or one-time code.

No legitimate verification needs your account password, your card PIN or a code sent to your phone. Support can see what it needs from its own side.

Verify by opening the account yourself and looking for a pending request there. If the message was genuine the account will show it; if not, nothing was lost.

Retention, breaches and the Australian position

Ask how long documents are kept and whether they are deleted when an account closes. The answer belongs in the privacy policy, and its absence from that policy is itself informative.

If documents you uploaded are caught in a breach, keep the notification, change the account password and any password reused elsewhere, and tell your bank where payment details were involved. Where the identity document itself is exposed, ask the issuer about a replacement number.

Australian privacy law may not reach an offshore operator. The Privacy Act 1988 and the OAIC apply to organisations with an Australian link, while online casino services may not be offered or advertised to people in Australia under the Interactive Gambling Act 2001, which the ACMA enforces. Your own copies and the operator's written policy are the practical protection. Gambling Help Online is free and confidential on 1800 858 858.