Skip to main content
Secure intake / Case report

Report a case

A withdrawal that never arrived. An account closed with a balance in it. Verification documents demanded a fourth time. Tell us what happened, in your own words, and a reviewer will read it.

Private by defaultContact details encryptedNo account requiredReference issued once

What happens to what you send

This is the whole contract. There is no separate policy that contradicts it.

  1. 01

    Your report is private by default

    It is written to a table that no public page, feed, sitemap or search index can reach. The one thing that leaves here is the case reference shown to you at the end — and that is a secret you hold, not a public identifier. Nothing is published under it, nobody can look you up by it, and we keep only a one-way hash of it. Treat it like a password.

  2. 02

    It is not published automatically

    Nothing here publishes itself by ageing, by status, or by volume. A report does not become a case file because time passed or because several people reported the same operator.

  3. 03

    What gets published is a case file, not your report

    The account a reader sees is written and redacted by a reviewer, and it carries a note stating what was withheld. Only an account holding the publication permission can publish one, and doing so stamps that person and the time onto the record permanently.

  4. 04

    You approve the exact version, or it is not published

    If a reviewer writes a case file from your report, you are shown that precise text and that precise exhibit list — through the reference above, on the status page, with no account — and asked to approve it. Nothing is published until you do, and you can withdraw at any time before it goes out. Your approval covers the exact version you were shown: if it is edited afterwards, the approval stops covering it, and the edited version cannot be published unless a fresh request is put to you and you approve that one too. The box on this form is not that approval: it only says the question may be put. There is no anonymised basis and no public-interest test that substitutes for it, and none of your uploads can appear anywhere public without it. We may still publish research produced independently from lawful public sources — but as its own record, not as your report, and never using your files.

  5. 05

    Evidence is graded, and the grade is published with it

    A reviewer checks what can be checked against the registers and enforcement records we hold. Verification is not a precondition of publication: a case file with nothing behind it can still be published, but only as unassessed, only with the reviewer recording that there is no evidence, and the reader is shown that grade on the record itself.

  6. 06

    Contact details are encrypted at rest

    Your email address is encrypted before it reaches the database, with a key held outside it. A case reviewer can decrypt it; nobody else can, and every time one does it is written to the audit log.

  7. 07

    The reference is issued once

    It is shown on the next screen and never again. We will not re-send it: we have no way to confirm that the person asking is the person who filed the report, and in most cases we hold no contact address at all. Save it — it is the only way to check your report's status.

Do not send us these

Please leave these out

  • Identity documents — passports, ID cards, driving licences, selfies holding a document
  • Full card numbers, CVV codes or card photographs
  • Passwords, PINs, one-time codes or recovery phrases
  • Online banking credentials, or full bank statements you have not redacted

Why: we do not need any of it. A reviewer assesses whether an operator did what you say it did, and none of those documents helps answer that question. If you send them anyway we have to destroy them, which means someone has to open the file to confirm what it is first — so the safest version of this is the one where you never attach it. If a document you do need to send contains a card or account number, black it out before you upload it.

A file whose name suggests an identity document is flagged for a reviewer before it is opened, precisely so this rule is not forgotten.

The report

Four fields are needed: who it is about, what kind of issue it is, what happened, and a confirmation that you have read the above. Everything else is optional and improves what a reviewer can do with it.

The operator
01

Who the report is about

The name you saw when you deposited. It is often not the company holding the licence — that is one of the things we check.

The domain only. Do not paste a full link from your account — it can carry a session token we neither need nor want to store.

Where you were when you played. It decides which authority the case belongs to, and it is optional.

When it started — the withdrawal request, the account closure, the first refusal. An approximate date is fine.

Category of issue
02

What happened (required)

Choose the one that fits best. If two apply, pick the one that cost you money and explain the rest below.

The money
03

The money involved

All three fields are optional. A published case file only ever shows a band — under 100, 1,000 to 5,000 — never your exact figure.

The type of route, not your account or card number.

Your account of what happened
04

In your own words (required)

Between 40 and 20,000 characters. A reviewer reads this by hand, so plain chronology helps more than emphasis. Do not include passwords, full card numbers or copies of identity documents.

If you have already complained elsewhere, the reference helps a reviewer see where the case has got to.

Evidence
05

Attachments

Up to 6 files · 8 MB per file · 24 MB in total. PDF, PNG, JPEG, WebP, TXT or CSV only — every file is checked against its actual contents, not the name or the type your browser declares. Attachments are stored outside the public web root under a generated name and have no public URL.

This is the one field that cannot be restored. If the form comes back with anything to correct, everything you typed is kept, but your browser does not allow a file selection to be put back — please choose your files again before you submit.

Contact and consent
06

Contact and consent

Optional. Encrypted at rest with a key held outside the database and readable only by a case reviewer, whose access is written to the audit log. Without it we cannot come back to you with questions, and a case that needs a question answered usually stops there.

Only about this case, and only from a reviewer. No newsletters, ever.

This is not permission to publish. If a reviewer writes a case file from your report, you will be shown that exact text and exhibit list and asked to approve it — through the reference above, on the status page, with no account needed. Nothing is published unless you approve that version. If it is edited afterwards, your approval no longer covers it, and the edited version cannot be published unless you are asked again and approve that one. Leaving this unticked means you would rather not be asked at all.

Some cases are best resolved by the body that licenses the operator. We will not do this unless you tick this box.

I understand that this report is an allegation until it is verified, that GambleLABS is not a regulator and cannot compel an operator to pay, that no response time is promised, and that the reference issued on the next screen is shown once and is the only way to check the status of this report.

Submitting sends the form to GambleLABS over TLS. Your contact address is encrypted before it reaches the database, and nothing you write here is published automatically.