Home / Login
Account access
Signing in to WinSpin
For players in Australia, almost every failed login comes down to one of six causes. Here they are, with the fix for each, plus the security settings worth turning on while you are in there.
The normal path
-
Open the sign-in form
It sits behind the "Log in" control in the header on desktop, and inside the menu on mobile. The form asks for the email address you registered with and your password.
-
Type the email exactly
Autofill sometimes stores an old address, and a plus-tag or a dot in a Gmail address counts as a different string to most login systems even when the mail still arrives.
-
Complete any second factor
If you enabled two-factor authentication, a code from your authenticator app or SMS follows. Codes are time-limited — a stale one fails silently.
-
Land in the lobby
A successful sign-in drops you at the games lobby with the balance visible in the header. If the balance looks wrong, check whether part of it is bonus money before doing anything else.
What each error means
| Message | Actual cause | Fix |
|---|---|---|
| Incorrect email or password | Typo, caps lock, or a saved old password | Retype by hand once; then use the reset link |
| Account temporarily locked | Too many failed attempts | Wait out the cooldown rather than retrying immediately |
| Account under review | Verification or a compliance check is open | Check email for a document request; contact support |
| Session expired | Signed in elsewhere, or a stale browser tab | Close other sessions and sign in fresh |
| Self-exclusion active | A limit or exclusion you set previously | By design, this cannot be lifted early — that is the point |
| Not available in your location | Country or network restriction | Nothing to work around; a VPN breaches the terms and risks the balance |
Never use a VPN to reach a casino account from a restricted location. It voids terms, can forfeit balances, and turns a simple verification into an argument you will lose.
Staying signed in safely
Casino sessions are a compromise between convenience and exposure. Most accounts stay signed in on a trusted device for days, which is pleasant until the device is shared, lost or borrowed by someone who does not realise a payment method sits behind that icon. A device passcode plus a password manager entry that is unique to this account covers ninety per cent of the risk, and signing out on any machine that is not exclusively yours covers most of the rest.
If you ever suspect access you did not authorise: change the password first, sign out all sessions if the account offers it, then contact support with the timestamps. Do not create a second account in the meantime.
Signing in from a new device or country
A login from a phone after usually using a laptop, or from a different country after travel, is one of the most common reasons a normally routine sign-in suddenly asks for extra verification. That is the security system working as intended — an unfamiliar device or location is exactly the pattern account-takeover attempts follow, so the system treats it with more caution by default. Expect a one-time code sent to your registered email or phone, and possibly a short delay before the account fully unlocks. Answering it correctly the first time is faster than trying to bypass it, since repeated failed attempts on a flagged login tend to extend the lock rather than shorten it.
If you know you're travelling and plan to log in from a new country, doing so first on your normal home network, before leaving, is worth it where practical — a location change alone is a smaller flag than a location change combined with an unrecognised device and network together.
Making sure you're on the right site
Lookalike domains circulate in this space, with names one character off from the real thing, promising the same games or a bigger bonus. Bookmark the address after your first visit rather than searching for it each time, and check the address bar shows the expected domain and a padlock before entering credentials on any device. Neither habit takes more than a few seconds.
Public wifi and a stale browser cache
Signing in over a hotel, airport or café network is not inherently risky if the connection to the site itself is encrypted — check for the padlock and HTTPS in the address bar, which any legitimate casino site carries by default. What matters more than the network is the device: a public or shared computer can carry keyloggers or leave a session open for whoever uses it next, while a personal phone on the same public wifi is a far smaller exposure. If you must sign in on a device you don't control, use a private or incognito window, sign out explicitly rather than just closing the tab, and change the password afterwards if there's any doubt at all.
A separate, more mundane cause of sign-in trouble: a browser holding onto a stale cached version of the login page after a site update. If the form looks visibly broken — missing a field, a button that does nothing — a hard refresh or clearing the site's cached data resolves most of these before it's worth treating as an account problem.
Passwords, resets and security
Resetting a password
Use the "forgot password" link, then check the spam folder — reset mails are the ones most often filtered. The link is single-use and time-limited; if you request three of them, only the newest works, which is why the second attempt so often appears broken.
Two-factor authentication
If the account offers it, turn it on. An authenticator app beats SMS, because SIM-swap fraud targets exactly this kind of account. Save the recovery codes somewhere that is not the phone holding the app.
Shared devices
Do not tick "remember me" on a device other people use, and sign out rather than closing the tab. A casino session left open is a payment method left open.
Phishing
Support will never ask for your password, and legitimate document requests happen inside the account. Treat any message pushing you to a login page as hostile until proven otherwise.
If you are locked out entirely
Contact support from the email address on the account, state the account email and roughly when you registered, and describe the exact error text. Do not open a second account "just to play while it is sorted" — duplicate accounts are a terms breach and complicate the original case considerably. If the lock relates to verification, the fastest route through is to send the full document set at once; the payouts page lists what that means in practice.
Can I change the email on my account?
Usually only through support, and often only after verification, because the address is part of your identity on the account.
Why am I asked to log in again so often?
Sessions expire for security, and clearing cookies ends them early. Private browsing windows never keep you signed in at all.
Does the free-spins offer need a separate login?
No — the partner promotion uses the account you create on the offer page. See the free spins page.