You open your betting account and notice a bet you never placed.
Or your balance has fallen, a withdrawal request appears in the transaction history, your phone number has changed, or your normal password suddenly stops working.
Do not continue using the account as though nothing happened.
Those signs can indicate that your betting account has been compromised.
The first objective is not to work out exactly how the attacker got in. It is to stop further access, protect the linked email and payment accounts, notify the sportsbook, and preserve evidence of what happened.
Official cyber-security guidance follows the same general pattern for compromised online accounts: contact the provider, secure the associated email, change compromised and reused passwords, sign out other sessions and enable two-step verification where available.
For a betting account, you should also review:
- open bets;
- withdrawal requests;
- deposit history;
- changed personal information;
- linked bank or payment details.
The important principle is:
Treat a suspected betting-account compromise as both an account-security problem and a money-access problem. Secure the account first, then investigate the transactions.
Signs Your Betting Account May Have Been Hacked
One unusual result does not automatically mean somebody has taken over your account.
But certain changes deserve immediate attention.
You Cannot Log In With the Correct Password
A password that worked normally and suddenly fails can indicate:
- somebody changed it;
- the sportsbook temporarily restricted the account;
- you are entering credentials on the wrong website;
- your own login details are incorrect.
Do not immediately create another account.
First use the official password-recovery process or contact support.
You Receive a Password Reset You Did Not Request
An unexpected reset message may mean somebody is trying to gain access to the account.
If you still control the account, change the password directly through the sportsbook’s official website or app rather than following a suspicious link in an unexpected message.
Bets Appear That You Did Not Place
Check the bet history carefully.
Record:
- bet ID;
- time;
- stake;
- market;
- device/login information if available.
Do not delete messages or screenshots related to the activity.
An Unfamiliar Withdrawal Appears
This needs urgent attention.
Check whether the transaction is:
- pending;
- processing;
- completed;
- rejected.
If it is still pending, contact the sportsbook immediately and ask whether the withdrawal can be investigated or stopped.
Do not assume that changing your password alone automatically cancels an existing payment request.
Personal Details Have Changed
Look for unexpected changes to:
- email address;
- phone number;
- username;
- password;
- bank information;
- security settings.
Changes to the contact information are especially important because they may allow somebody else to control future password resets.
You Receive OTP or Login Codes You Did Not Request
An unexpected one-time password can indicate that somebody already knows part of your login information and is attempting the next authentication step.
Do not give the OTP to anyone.
A genuine support agent should not need you to send a security code that was generated specifically to authorise a login or transaction.
First: Make Sure You Are Using the Real Betting Website
Before entering another password, confirm that you are actually on the sportsbook’s genuine website or official app.
A phishing page can look almost identical to a real bookmaker login screen.
It may copy:
- logo;
- colours;
- login form;
- promotions;
- support details.
Its purpose is to collect the username and password you enter.
Check carefully for:
- misspelled domain names;
- unexpected extra words in the address;
- links sent through unsolicited messages;
- pages asking for unusual information;
- login screens opened from suspicious advertisements.
If you are uncertain whether the operator itself is legitimate, NaijaScore9’s guide on how to know if a betting site is legit in Nigeria is the more appropriate security check before entering personal or payment information.
What to Do Immediately If Your Betting Account Has Been Hacked?
The order matters.
You want to close the most important access routes before spending time investigating every transaction.
1. Secure the Email Account Linked to the Sportsbook
This step is frequently overlooked.
If an attacker controls your email account, changing the sportsbook password may not solve the problem because the attacker may simply request another password reset.
Official NCSC guidance specifically recommends checking the email account associated with a compromised service, including forwarding rules that an attacker may have added to receive copies of future emails.
Check your email for:
- unfamiliar login sessions;
- changed recovery details;
- forwarding rules you did not create;
- deleted security notifications;
- unexpected password-reset emails.
Then change the email password if compromise is suspected.
Use a password that is not reused elsewhere.
2. Change the Betting Account Password
If you can still access the account, change the password immediately.
SportyBet Nigeria’s current account terms, for example, tell customers who believe a third party knows their username or password to change it immediately and to contact the operator if someone else may have obtained the account details.
A new password should not simply be:
OldPassword1 → OldPassword2
Use a completely different password.
The most important requirement is that it is unique to that sportsbook.
If the stolen password was also used for:
- email;
- bank account;
- social media;
- another sportsbook;
change those passwords too.
Credential reuse allows one compromised password to create problems across several services. NCSC guidance explicitly recommends changing passwords on other accounts where the same password was used.
3. Sign Out Other Devices and Sessions
Changing the password is important, but an already authenticated session can sometimes remain active depending on the service.
If the sportsbook provides an option such as:
Sign out all devices
or:
Manage active sessions
use it.
General cyber-security guidance recommends logging all devices and applications out after changing a compromised password so that existing sessions cannot continue using the account.
If the sportsbook does not provide that function, ask support whether they can terminate all existing account sessions.
4. Enable Two-Factor Authentication If Available
Two-factor authentication adds another requirement beyond the password.
Depending on the sportsbook, this could use:
- authenticator app;
- SMS code;
- email code;
- another verification method.
NCSC guidance recommends enabling two-step verification on recovered accounts because a stolen password alone is then less useful to an attacker.
If the bookmaker does not support 2FA, protecting the email and phone number linked to the account becomes even more important.
5. Contact the Sportsbook Through an Official Support Channel
Do this quickly when money, account details or unauthorised bets are involved.
Explain that you suspect:
unauthorised access to the account.
Do not simply write:
“My money disappeared.”
Provide useful details.
For example:
Account username: [your username]
Suspicious activity first noticed: [date/time]
Unauthorised bet or withdrawal ID: [ID]
Last activity you recognise: [date/time]
Ask the sportsbook to:
- investigate the account;
- restrict unauthorised access;
- review suspicious transactions;
- confirm whether account details were changed.
SportyBet’s published terms currently instruct users who believe somebody else may have obtained their account details to contact the operator.
6. Check Whether a Withdrawal Is Still Pending
If you see a withdrawal you did not request, note its status immediately.
A transaction marked:
Pending
is very different from one marked:
Completed.
Contact the sportsbook and specifically identify the transaction.
Do not create repeated withdrawal requests or additional deposits while the account is being investigated.
If the withdrawal is genuinely yours but simply has not arrived, that is a different problem. NaijaScore9’s guide to why a betting withdrawal may remain pending covers normal verification, payment-processing and account-review delays.
7. Review the Entire Transaction and Bet History
Do not stop after identifying one suspicious transaction.
Determine the point at which unauthorised activity appears to have started.
Review:
- deposits;
- withdrawals;
- betting history;
- bonuses;
- account transfers where applicable;
- profile changes.
Suppose you identify:
Monday 11:20 — last recognised bet
Monday 14:16 — unknown login notification
Monday 14:25 — unknown ₦15,000 wager
Monday 14:31 — withdrawal details changed
That timeline is far more useful to the sportsbook’s security team than a general complaint that the account was hacked.
Preserve Evidence Before Details Change
Take screenshots of suspicious activity before it disappears from an account interface.
Keep copies of:
- betting history;
- transaction history;
- withdrawal status;
- security emails;
- password-change notifications;
- login alerts;
- support conversations.
Record exact timestamps where possible.
Do not edit screenshots in a way that removes important information.
If a later dispute occurs, a chronological record will be much easier to understand than trying to reconstruct events from memory.
What If You Can No Longer Access the Betting Account?
Do not repeatedly guess passwords.
Use the sportsbook’s official account-recovery route.
For example, SportyBet Nigeria currently provides a Forgot Password process and directs customers who cannot recover their username to support.
If the attacker changed:
- phone number;
- email;
- password;
tell support explicitly.
The operator may need to verify your identity before restoring access.
Be prepared to provide information through the sportsbook’s official verification process.
Do not send sensitive identification documents to an unofficial social-media account merely because somebody claims to represent the bookmaker.
Do Not Create Another Account to Solve the Problem
Opening a second sportsbook account can make an already complicated situation worse.
The new account may be flagged as a duplicate during KYC or withdrawal verification.
If you cannot access your original account, recover it through support rather than registering again unless the sportsbook specifically instructs you to do so.
NaijaScore9’s guide to multiple betting accounts with the same betting site explains why duplicate-account rules can become an additional verification problem.
What If Money Has Already Left the Betting Account?
Separate the sportsbook issue from the payment issue.
First identify:
Where did the money go?
Was it:
- withdrawn to an unfamiliar bank account;
- sent to a payment wallet;
- lost through unauthorised bets;
- transferred through another feature?
Then contact the sportsbook with the relevant transaction ID.
If your bank, card or payment account may also be compromised, contact the financial institution through its official channel.
Do not wait for the sportsbook investigation before protecting an exposed bank or payment account.
Also review whether:
- bank login credentials were reused;
- the same password was used;
- card details were stored somewhere insecure.
What If the Hacker Placed Bets Instead of Withdrawing Money?
This can be particularly complicated.
Some sportsbook terms place significant responsibility on customers to protect account credentials.
For example, SportyBet’s currently published Nigerian terms state that bets can stand where the correct username and password were entered, even where the customer says the activity was unauthorised.
That does not mean every sportsbook uses the same rule or that every disputed case will have the same outcome.
It does mean you should report suspicious betting activity as quickly as possible rather than waiting for the selections to settle.
Provide:
- disputed bet IDs;
- timestamps;
- your last recognised account activity;
- relevant security notifications.
Let the operator determine the treatment under its own rules.
If Your Phone Was Stolen, Treat the Betting Account as Potentially Exposed
A stolen unlocked phone can expose much more than the sportsbook.
It can contain:
- logged-in betting apps;
- email;
- SMS authentication codes;
- saved passwords;
- banking applications.
Secure the most important connected services first.
Change passwords where needed and use any device-management service available for the phone.
If your SIM may be accessible, contact the mobile provider as well.
The objective is to stop the stolen device from becoming a route into other accounts.
If Your Email Was Hacked, Secure It Before Everything Else
Your email may function as the recovery key for multiple services.
An attacker who controls it could potentially:
- request a sportsbook password reset;
- receive the reset email;
- change the sportsbook password;
- delete the security notification.
This is why NCSC specifically recommends checking email accounts and forwarding rules during account recovery.
After securing the email:
- change the sportsbook password;
- terminate active sessions;
- review account changes.
What If Your Password Was Reused on Several Betting Sites?
Change all affected passwords.
Do not wait to see whether the other accounts are attacked.
Suppose the same password was used on:
Sportsbook A
Sportsbook B
Sportsbook C
If Sportsbook A credentials become exposed, attackers can try the same combination elsewhere.
This practice is commonly called credential stuffing.
The practical protection is straightforward:
one unique password per important account.
If you maintain legitimate accounts across different betting sites in Nigeria, do not use the same password for every operator.
The convenience of remembering one password is not worth turning one compromise into several.
Watch for Phishing After Reporting the Hack
After an account problem, you may become more vulnerable to a second scam.
You might receive a message saying:
“We are sportsbook security. Send your OTP to unlock the account.”
or:
“Pay ₦10,000 to recover the stolen balance.”
Be cautious.
Use support details from the official sportsbook website or app rather than replying to an unsolicited contact.
NCSC guidance on data breaches specifically warns about urgent, official-sounding messages attempting to obtain further information following security incidents.
Never Give Someone Your OTP to “Recover” the Account
An OTP is often an authorisation mechanism.
If you receive a code when you did not attempt to log in or perform a transaction, treat that as a warning.
Do not send the code to:
- Telegram contacts;
- WhatsApp agents;
- social-media users;
- strangers claiming to work for the sportsbook.
If support genuinely needs to verify you, follow the verification method displayed through the sportsbook’s official channels.
Check Your Device for the Source of the Compromise
If you secure the account but continue using a compromised device, the attacker may obtain the new credentials again.
Check:
- operating-system updates;
- browser extensions;
- suspicious apps;
- unofficial sportsbook APKs;
- saved passwords;
- malware warnings.
Official security guidance recommends keeping devices and applications updated because security updates address known vulnerabilities.
You do not need to assume every hacked account means malware.
Phishing and password reuse are also common causes.
The objective is to close obvious routes of re-entry.
Do Not Download a “Security App” Sent by an Unknown Support Agent
If somebody contacts you after the incident and asks you to install:
- remote-access software;
- an unknown APK;
- a browser extension;
- a “withdrawal verification” app;
do not install it merely because the person knows details about the account.
Use software only from trusted official sources.
An account-recovery problem should not require handing a stranger remote control of your phone or computer.
How to Create a More Secure Betting Account After Recovery?
Once access has been restored, review the entire setup rather than stopping at the password change.
Use a Unique Password
Do not recycle a password from email or banking services.
Turn On 2FA
Use it whenever the sportsbook provides it.
Secure the Linked Email
The betting account is only as secure as the recovery account attached to it.
Protect the Phone Number
A phone number can be used for login or OTP verification.
Avoid Saving Credentials on Shared Devices
A public or shared computer increases unnecessary exposure.
Review Transactions Regularly
Early detection can reduce the time an attacker has to operate.
Use the Official App or Website
Avoid login links delivered through unsolicited messages.
Can Someone Hack Your Betting Account With Only Your Phone Number?
Usually, a phone number alone should not be sufficient to access a properly secured account.
But it can still be useful to an attacker when combined with:
- leaked passwords;
- phishing;
- access to your SIM;
- access to your email;
- personal information used in account recovery.
So do not treat your phone number as a password.
And do not share OTPs simply because the person contacting you already knows your number or account name.
Can Someone Withdraw Without Your Password?
The answer depends on the sportsbook’s authentication and payment process.
Some platforms require:
- an authenticated session;
- payment verification;
- OTP;
- matching bank details.
Others use different controls.
Instead of assuming a particular safeguard exists, inspect your own account security options.
If a withdrawal you do not recognise appears in your history, report it immediately regardless of how you think the attacker gained access.
Will the Betting Site Refund Money Lost After a Hack?
There is no universal rule.
The answer can depend on:
- operator terms;
- whether the transaction was completed;
- whether the sportsbook detects an account-security failure;
- whether valid credentials were used;
- evidence available;
- applicable regulation.
Do not promise yourself a refund before the investigation is complete.
Your immediate task is to:
secure → report → document.
Let the sportsbook determine liability and settlement under the relevant account rules.
When Should You Contact Your Bank?
Contact your bank or payment provider quickly if you identify activity affecting it directly, such as:
- unfamiliar card transaction;
- bank transfer you did not authorise;
- account details altered;
- compromised banking credentials.
The sportsbook can investigate what occurred inside the betting account.
Your bank is responsible for protecting access to the financial account itself.
One does not replace the other.
If Support Freezes the Account, Do Not Panic
A temporary restriction during investigation can be protective.
The sportsbook may need to prevent:
- further betting;
- withdrawals;
- profile changes;
while it verifies ownership.
A security freeze should therefore be distinguished from a normal withdrawal delay.
Ask support:
Why is the account restricted?
What verification is required?
Which transactions are being reviewed?
Keep the case/reference number if one is provided.
What Information Should You Send to Sportsbook Support?
Keep the report structured.
Account Details
Provide the account identifier requested by the official support process.
Time You First Noticed the Problem
Be as precise as possible.
Last Activity You Recognise
This helps separate legitimate activity from suspicious activity.
Suspicious Transaction IDs
Provide individual references instead of saying:
“Some bets are wrong.”
Contact Information Changes
Mention any email, phone or payment detail you did not change yourself.
Supporting Evidence
Attach screenshots where the official support channel allows them.
Do not send:
- passwords;
- OTP codes;
- full payment credentials.
What to Do If Support Does Not Resolve the Problem?
First make sure you used the sportsbook’s genuine complaint process rather than only a casual social-media message.
Request:
- written explanation;
- transaction references;
- outcome of the investigation;
- available escalation process.
If the operator is regulated in the jurisdiction where you use it, check whether the relevant regulator provides a complaints route.
This is another reason operator legitimacy matters before depositing money.
The NaijaScore9 guide to identifying a legitimate betting site in Nigeria explains how to check the legal operator, licensing information and complaint route rather than relying only on the sportsbook’s appearance.
A Fast Emergency Checklist
If you suspect your betting account has been compromised, use this order:
- Stop entering credentials through suspicious links.
- Secure the linked email account.
- Change the sportsbook password.
- Change any other account using the same password.
- Sign out other sessions/devices.
- Turn on 2FA where available.
- Contact the sportsbook through its official support channel.
- Identify and report unauthorised bets or withdrawals.
- Protect linked bank/payment accounts if necessary.
- Save screenshots and transaction records.
The objective is to contain the compromise before investigating every detail.
Conclusion
When you suspect a betting account has been hacked, the worst response is to spend hours trying to identify the attacker while the account remains accessible.
Containment comes first.
Secure the email linked to the sportsbook because that email may control password recovery.
Change the sportsbook password and any other account using the same credentials.
Terminate existing sessions where possible.
Enable two-factor authentication.
Then contact the sportsbook and identify the exact activity you dispute.
After the account is contained, build a timeline:
What was the last activity you recognise?
When did the suspicious login or transaction appear?
Were your phone number, email or payment details changed?
Were bets placed or was money withdrawn?
That distinction matters because different problems require different responses.
An unknown bet needs to be reported as unauthorised betting activity.
A pending withdrawal needs urgent transaction investigation.
A compromised email must be secured separately.
A bank account showing suspicious activity needs attention from the financial institution as well as the sportsbook.
Most importantly, do not make recovery harder by opening another betting account, sending OTPs to strangers or paying unofficial “agents” who promise to release the balance.
Use the operator’s real recovery process.
General cyber-security guidance recommends exactly this pattern for compromised online accounts: contact the provider, secure the associated email, replace compromised and reused passwords, log out existing sessions and add two-step verification where available.
For a sportsbook account, add one more step:
document every financial action you do not recognise.
That gives you the strongest basis for a proper investigation.
The practical sequence is:
Secure the linked email → change passwords → terminate sessions → enable 2FA → contact the sportsbook → review transactions → protect linked financial accounts → preserve evidence.
The quicker those steps are completed, the less opportunity an unauthorised user has to continue operating the account.