Scams to Avoid: Fake Bonus Codes and the Pages They Lead To

Why a universal code cannot exist

Promotions are campaigns. A real code is attached to a specific offer, with a start date, an end date, an eligibility rule and usually a limit of one per account, and it is validated against your account record when you enter it. That is the entire mechanism.

• First-deposit codes work once, on an account that has never deposited.
• Reload codes are issued to selected segments, which is why your friend's code often does nothing for you.
• Codes expire, and an expired code produces a plain rejection rather than a bonus.
• An operator can withdraw a campaign at any time, and the code dies with it.
• Your own account's promotions area is the only place that can tell you what you are eligible for.

So when someone offers a code that works for everyone, forever, there are only two possibilities. Either the code is dead and harmless, or the code is not the product. The thing being delivered is the page you are sent to in order to use it.

What the code is really for

1. You are given a code and a link, because a code without a link is useless to the person sharing it.
2. The link goes to a look-alike login page on a near-identical domain, or to a 'claim portal' that is not the operator at all.
3. You enter your username and password to apply the code. That is the first half of the theft.
4. A real login is triggered on the real site, so a real one-time code arrives on your phone.
5. The page asks for that code to 'confirm the bonus'. That is the second half, and the account changes hands.
6. Sometimes there is a third step: a small deposit or 'activation fee' through a payment link, which is simply theft of cash on top.

The reason this works better than a threatening message is the mood. Nobody is defensive while claiming something free, and the one-time code that arrives feels like confirmation that the process is genuine. It is genuine. It is just not yours.

How to check a promotion safely, every time

1. Never claim from a code someone sent you. Treat every forwarded code as unusable on principle, and you lose nothing worth having.
2. Type the operator's domain yourself, or use your own bookmark. Never a link in a comment, a video description, a message or an ad.
3. Log in, then open the promotions area inside your own account. If an offer is real and you are eligible, it will be there.
4. Read the governing terms before accepting anything: wagering multiplier, expiry, max bet while a bonus is active, and game weighting. These are set by the operator and stated in its promo terms.
5. If an offer only exists outside your account, it does not exist.

Four more scams working the same angle

What a genuine KYC request never asks

• Your password. It can be reset but never read, so nobody legitimate asks for it.
• A one-time code, authenticator number or e-wallet MPIN, by any channel, for any reason.
• A payment to verify, unlock, release or speed up anything.
• Documents sent to a personal chat account rather than uploaded inside your logged-in account.
• Remote access to your screen or the installation of a 'verification' tool.
• Anything at all by phone call. Verification is an upload and a wait.

If you remember one line from this page, make it this one: a real one-time code arriving does not prove the person asking for it is real. It proves someone is trying to log in as you at that exact moment.

If you already entered something

1. Change the casino password immediately from a device you trust, then your e-mail password, then anywhere either was reused.
2. Check the account's registered e-mail and phone number; changing those is how a thief locks you out.
3. Open your e-wallet and bank apps yourself and review recent transfers.
4. Remove any app or 'claim tool' you were asked to install, then restart the phone.
5. Save evidence: the code, the link, the domain, screenshots, timestamps, amounts and reference numbers.
6. Escalate in the order below and keep every ticket number in writing.

The escalation route

1. The operator's own support, opened from inside your logged-in account, with amounts, references and timestamps, and a request for a written ticket reference.
2. The e-wallet's in-app help centre, which you open yourself inside GCash, Maya or your bank app. Never a number someone sent you, and never with a stranger walking you through it.
3. PAGCOR's published complaint channel, found on the regulator's own website through the complaint or contact route it publishes there. Bring your details, the operator's name, dates and your evidence.
4. The cybercrime route if money moved or your identity was used: the PNP Anti-Cybercrime Group or the NBI Cybercrime Division, both of which publish their own current contact details and office addresses on their official sites.

We print no hotline numbers here deliberately. Numbers change, guides go stale, and a wrong number published in good faith does the scammer's work for them. Take each number from the organisation's own site on the day you need it.

What we can and cannot do

GOJACKPOT can explain the mechanism and the escalation order. We cannot recover funds, cancel a transfer, release a payout, restore an account or see a balance, because we are an independent guide and not a party to your account. We hold no money and we run no games.

Some links here may be partner links, which never changes what a page says. And one honest word about ceilings, since this site writes about them: no code, tool or agent raises a game's published max win, and chasing a loss through a bigger bet is how a bad hour becomes a bad month. Our responsible gaming page lists the limits and free support that exist for that. 21+ only.