See the offer
Current offer

A$5,200 + 150 FS — wagering 40x, minimum deposit A$30, maximum bet A$5 while a bonus is active.

See the offer

Australian edition, amounts in A$. WinSpin states it operates under an offshore Anjouan Gaming Board licence and holds no Australian licence, so no Australian regulator supervises it or hears player disputes; the Interactive Gambling Act 2001, enforced by ACMA, targets the operators that supply online casino games to Australians rather than the player who signs up. Free help: Gambling Help Online — 1800 858 858. BetStop is the national self-exclusion register, though it binds Australian-licensed services and an offshore site sits outside its reach.

  1. Home
  2. Signing in
Account access

Signing in

For players in Australia, three fields, and five reasons they occasionally refuse you.

Reviewed August 2026

Signing in is the least interesting page on any casino and the one people search for most often, usually because something has gone wrong. The mechanics are unremarkable: the email or username you registered with, your password, and a second factor if you enabled one. What makes it worth a page is the diagnosis, because the error messages are deliberately vague.

What you need Email + password The email address used at registration, not a later one added to the profile.
Second factor If enabled Worth enabling. A gambling account holds money and identity documents, which makes it a more attractive target than most people assume.
Not needed Your ID Documents are for verification before a withdrawal, never for a routine sign-in. Anyone asking for them at this step is not the cashier.
Go to the offer

No account yet? Start at opening an account.

Troubleshooting

When the login fails, in diagnostic order

Work down the list. Almost every case resolves in the first three steps, and the order saves you from resetting a password that was never the problem.

  1. Check which email you are actually using

    People commonly register with one address and try to sign in with the one they use daily. If a password reset reports no matching account, that is a strong signal you are at the right site with the wrong identity.

  2. Type the password rather than letting the browser fill it

    A saved credential from a half-completed earlier registration is the single most common cause of a repeated failure. Clear the field, type it manually, and see whether the result changes.

  3. Consider whether the account is restricted rather than wrong

    A self-exclusion, a cooling-off period or a verification hold produces a refusal that looks exactly like a bad password. If a reset email arrives normally but the sign-in still fails, the credentials are fine and the account state is not.

  4. Rule out the connection

    A VPN, a corporate network or a country-level block can prevent a session from starting. Turning off a VPN is worth trying, and worth knowing: connecting from a location you are not actually in creates verification problems far worse than a failed login.

  5. Then contact support, in writing

    Give the registered email, the approximate registration date and the exact error text. Never send a password to anyone, and never accept a request for one — no legitimate support process asks.

Security

Habits that prevent the lockout

A unique password Reused passwords are how gambling accounts get taken over, because a breach somewhere else hands over the credential. A password manager solves this permanently and costs nothing to start using.
Two-factor authentication Turn it on the day you open the account. An account holding a balance and a scanned passport deserves the same protection as online banking, and an authenticator app is stronger than a code by text message.
One account, permanently Never open a second because the first is inconvenient. Duplicates are detected, and the consequence lands on promotions and withdrawals rather than on the login screen where the mistake was made.
Sign in from your own device Shared computers keep sessions alive far longer than people expect. If you must, sign out deliberately rather than closing the tab, and never save the password to a browser you do not own.
Treat emails with suspicion Messages promising a bonus that require an urgent login are the standard phishing shape in this industry. Reach the account by typing the address yourself rather than by following a link you did not request.
Signing in from an app Playing on mobile
Support

Writing to support so the first reply solves it

"I can't log in" is not enough for an agent to act on — they need enough detail to identify the account and reproduce the failure, ideally in the first message rather than after a back-and-forth.

  • The exact registered email, typed out rather than described from memory.
  • The precise wording of the error, or a screenshot showing it.
  • What you already tried — a reset requested, a different browser, a VPN turned off.
  • Roughly when the account was opened.
  • Never the password itself — no legitimate agent needs it, and a request for one is a red flag on its own.
No account yet?
Two-factor, in depth

Choosing between an authenticator app, SMS and email codes

Authenticator app Generates a code on your own device with no network round trip involved, which means it cannot be intercepted by a SIM-swap attack the way a text message can. The stronger default whenever the account offers a choice.
SMS code Convenient because nothing needs installing, but a text message can be redirected if your number gets ported without your knowledge — a well-documented weakness of the format across the industry, not something specific to any operator.
Backup codes Shown once at setup on most platforms. Store them somewhere other than a screenshot on the same phone that generates the codes — a lost phone and a lost screenshot are the same failure at the same moment.
More than one device

Sessions on a phone and a laptop at once

Using the account from more than one device across a week is normal — it is one account and one balance regardless of what you are signed in on. Two behaviours are worth knowing before they read as a fault. A live-dealer seat is generally tied to one active session, so opening the same table on a second device usually replaces the first rather than letting both run it. And a device you have never used before can trigger a fresh verification prompt even when nothing about the account itself changed — that is the device check working as intended, not a sign of a problem. Most account-settings pages list active sessions and let you end them remotely; use that after signing in on any device that is not solely yours.

The harder case

Locked out with no working email and no 2FA device

The troubleshooting steps above cover the common case of a forgotten password with a working inbox. Losing the email account itself, or losing a phone with 2FA codes and no saved backups, has no self-service fix — deliberately. An account holding identity documents and money should not be recoverable by anyone who can simply guess an answer.

What actually moves that request: contact support from any address you can be reached at, state the registered email and roughly when the account was opened, and be ready to supply the same identity documents a withdrawal would require. Expect it to take longer than a routine reset, sometimes days rather than minutes — there is no faster route that would not also be a security hole.

Questions

Sign-in questions

I never got the password reset email. What now?

Check the spam folder first, then confirm you are using the registration address rather than a newer one. If a reset for that address reports no account, the account is under a different email — support can confirm without you resetting anything.

Can I change the email on my account?

Usually yes, though it often requires verification because the email address is part of the account's identity. Expect the change to be treated as a security event rather than as a profile edit.

Why does it say my account is restricted?

Most often a verification hold, a self-imposed cooling-off period or an active self-exclusion. None of those are fixed by a password reset, and a self-exclusion in particular cannot be lifted early by design.

Is it safe to stay signed in?

On a personal device with a screen lock, reasonably. On anything shared, no. Persistent sessions on a shared machine are how balances disappear, and the loss is not recoverable as a fraud claim.

Do I need to sign in to claim the offer?

The promotion is claimed inside the account after registering, so an account has to exist first. The offer page sets out the steps in order, including opting in before you fund rather than after.

Support asked for a code from an email. Is that normal?

A one-time verification code sent to your own address is normal. A request for your password, your card's full number or the code from an authenticator app is not, and should end the conversation.

Does clearing cookies fix a login that loops back to sign-in?

Often, yes. A stale session token can leave the site bouncing you back to the sign-in screen repeatedly. Clear cookies for that one site specifically, then reload.

Is it safe to let the browser save my password?

Reasonably, on a personal device with its own screen lock. On a shared or borrowed device, use a password manager with its own separate lock instead.

See the offer