Poker account security and recovery checklist
If you suspect someone else has accessed your poker account, stop using links supplied in the suspicious message and contact the operator through a route you independently verify. If you have simply forgotten a password or lost an authentication device, use the provider’s recovery process. Those situations can look similar from a login screen, but they need different information.
This checklist helps you organize that information without collecting it. The exercise asks only which fictional situation you want to inspect and whether the contact route is verified. It never requests a password, code, account name, identity document or payment detail. It cannot recover an account or confirm that one is secure.
Amina: “What changed in the account?” Ace: “I have only received an unexpected reset message.” Amina: “Keep that distinction. Verify the official route before entering anything.”
Check the warning · Verify support · Choose a route · Prepare a support request · Prepare future access
Separate a warning from evidence of access
An unexpected password-reset email does not by itself prove that an account was taken over. Someone may have entered your address, or the message may be fraudulent. An unfamiliar completed transaction, changed recovery address or security notification visible through your independently opened account is a different kind of evidence.
Keep your description factual. “A reset message arrived that I did not request” is more useful than “Everything has been hacked” when that is all you know. Conversely, do not dismiss a confirmed unauthorised transaction as an ordinary login inconvenience. Tell the operator what changed and when you noticed it.
A failed login can also result from a mistyped password, a lost second factor or a restriction applied by the provider. One symptom does not establish the cause. The route selector keeps those cases separate and sends you to the relevant official process.
Open support independently
Use the help area in an official app you already know, or navigate independently to the provider’s official website and its account-support pages. Check the actual destination rather than trusting a sender name, search advertisement, social profile badge or copied logo.
A message can display a familiar address while sending a click elsewhere. If the destination is uncertain, stop and establish the provider’s correct contact route before entering information. There is no need to complete a form just because someone has added a countdown or warned that your account will disappear today.
In the exercise, choosing “Not yet verified” always produces a route-verification step before the scenario checklist. That does not mean you must ignore an urgent incident while researching every detail. It means urgent contact should go through a channel you can establish independently, rather than through the person whose identity is in question.
Choose a recovery route
Choose an official recovery route
No account details, passwords, codes or documents are requested. Select a situation and the status of your support route. This does not contact a provider or recover an account.
Read the complete lesson without the controls
First verify the official provider contact route independently; do not follow a suspicious recovery link. An unrequested reset message alone does not prove takeover. Forgotten passwords use provider reset; unavailable second factors use provider lost-factor recovery; suspected access needs prompt security support and attention to the recovery inbox; restrictions need the process named by the operator. Keep private evidence and case references, but never send passwords, active codes, authenticator secrets or backup codes to helpers. Do not create replacement accounts or bypass protective restrictions. No action here confirms recovery.
Forgotten password with no other warning signs
Use the provider’s own password-reset option and follow the instructions for your account. Check that you initiated the request and that the destination belongs to the service. Enter any new credential only in the provider’s verified process, not into this lesson or a message to a helper.
A reset link or code can grant access. Keep it private. Do not forward it to someone claiming they will finish the recovery faster, and do not approve an authentication prompt you did not initiate. If the reset does not arrive, consult the provider’s troubleshooting instructions rather than repeatedly sending requests without checking which account you are trying to recover.
Do not create another poker account as a workaround. Operator account rules may prohibit that. PokerStars’ published password guidance specifically directs users back to recovery rather than a new account when a password is forgotten. Other services have their own rules, so obtain instructions from the relevant operator.
Lost phone or unavailable second factor
Losing access to an authenticator is different from forgetting a password. The original password may still be correct while the second step is unavailable. Follow the account provider’s documented lost-factor procedure or use a recovery method you previously configured, if that provider supports it.
Do not send backup codes, an authenticator setup secret, a QR code containing that secret or a screenshot of active codes to a stranger offering help. Those items can transfer control rather than merely describe the problem. A support conversation should establish the official verification process, not become a collection point for credentials.
If the device was stolen or may still be signed in, tell the provider that distinction. Ask about its process for ending active sessions and replacing the lost factor. Recovery options vary; this checklist does not promise that a backup code, SMS route or particular menu exists on every room.
Suspected unauthorised access
Contact the operator’s security or account-support route promptly. Describe the observable changes and ask for the provider’s containment and recovery instructions. If the registered email may also be compromised, use that email provider’s official recovery route as well. Control of a recovery inbox can affect more than one account.
From a trusted device, follow the relevant provider’s instructions for password changes, session revocation and authentication review. A changed password is not proof that every old session or recovery route has been invalidated. Confirm what the service actually does and what further steps it requires.
Keep a short incident record in your own controlled files: when you first noticed the issue, which official support channel you contacted, and any case reference. Record observations rather than guesses about who caused them. This page does not offer remote access, take control of your device or contact anyone on your behalf.
Treat the email account as part of recovery
A poker account can depend on an email account for resets and alerts. If the inbox is affected, recovering only the poker password may leave the recovery route exposed. The email provider’s instructions may include reviewing recovery details, signed-in devices and forwarding rules. See the NCSC account-recovery guidance for a general recovery sequence.
Do not assume a visible inbox tells the whole story. An unexpected forwarding rule or changed recovery contact belongs in the account-security review. Use the provider’s own help for the steps; different email services expose those controls differently.
Keep separate notes for the email provider and the poker operator, with each case reference under its own heading. That avoids mixing instructions from two systems or sending one provider material intended for the other. You can ask for help before you have gathered every detail.
What to include in a support request
Start with a concise description of the symptom, when it began and which official recovery steps you already tried. If you have a case number, include it through the same verified support route. Let the provider tell you which evidence its process needs.
A cropped error message may be more useful than a full desktop screenshot. Before sending any image, inspect it for account balances, private chats, recovery codes, browser tabs and unrelated personal information. Redact material that is not required for the issue, while preserving the error text support needs to identify it.
Some legitimate recovery processes require identity checks. Submit requested documents only through the provider’s verified secure process after understanding what is requested. This lesson does not collect them, decide whether a document is sufficient or tell you to share them with a club contact or unofficial agent.
If an unauthorised payment or bank transaction is involved, contact the relevant payment provider through its official channel too. Local reporting procedures differ. Do not send money to someone who promises to recover stolen funds or unlock the account in return for an extra transfer.
A restriction needs its own explanation
An account restriction is not automatically evidence of a stolen password, and a successful password reset does not necessarily remove it. Providers can apply restrictions for different reasons. Read the notice through the verified account channel and ask which process applies to your case. PokerStars lists several possible restriction reasons; those examples do not diagnose a different provider’s notice.
Do not use another person’s account, create a replacement account or try to disguise your location to bypass a restriction. Those actions can add a separate problem without resolving the original one. Keep the support request focused on the notice and the information the provider asks for.
If a restriction concerns a safer-gambling measure or self-exclusion, use the relevant support process. Treat it as a protective account condition rather than an obstacle this recovery checklist should help remove. The exercise offers no bypass route.
Prepare access before the next problem
Use a unique strong password where passwords are required, and consider a reputable password manager to keep different accounts separate. Use stronger sign-in options offered by the service, such as a passkey or multi-factor authentication, according to its current instructions. Availability differs by provider. The NCSC explains password managers and passkeys and two-step verification.
Plan recovery before losing the device that receives codes. Keep any provider-issued recovery material in a secure place you can access when needed, separately from a public note or shared chat. Protect the email account and password manager that support the rest of the setup.
Review whether recovery contact details are current when you change phones or email addresses. Install security updates through trusted system and application channels. These are protective habits, not a guarantee that an account can never be compromised.
Use the route selector without entering secrets
Choose the scenario that matches the question you want to study: an unrequested reset message, forgotten password, lost second factor, suspected unauthorised access or an unexplained restriction. Then state whether the contact route has been independently verified. The output gives a short ordered checklist and the evidence to keep private.
Changing either choice clears the old route. Reset returns to the unexpected-message example with route verification still pending. Nothing is stored or sent by the module. Its result is guidance about the next official channel to use, never a claim that recovery has succeeded.
Before leaving, make sure you know which official support route to use and how to describe the problem. Keep passwords, authentication codes and recovery material private throughout the process.
Continue with Info & tools. Guidance checked on 18 October 2026. Follow the current instructions for your own provider.