Scams to Avoid: Cloned Look-Alike Domains First
Copying a website takes minutes. Copying its address is impossible, which is why the address is the only thing worth checking. PHSWERTE is an independent guide, not a casino; it takes no deposits and runs no games, and it has no login page at all. This page, for readers aged 21+, covers cloned domains first and their usual companions after.
What a cloned domain is
A clone is a copy of a real casino lobby, logo, colours, game thumbnails and all, placed on an address that resembles the original. You register or log in as usual. On a clone, the login captures your password, and any deposit goes to accounts controlled by whoever built it. The balance you then see is a number on a page with nothing behind it.
How the address is disguised
| Trick | Pattern | How to catch it |
|---|---|---|
| One character changed | A letter swapped, doubled or dropped | Read the address slowly, character by character |
| A different ending | Same name on another domain extension | Compare the ending with the one on PAGCOR's list |
| Extra words | 'official', 'login', 'vip' or numbers added to the name | Extra words are not proof of anything |
| Real name on the left | The brand appears before a dot, but the true domain is what sits just before the first slash | Find the last two parts before the slash; that is who you are visiting |
| Hyphens and look-alike letters | A hyphen inserted, or characters that resemble others | Type the address yourself instead of tapping |
A padlock in the address bar does not help here. It shows the connection is encrypted, and clones have padlocks too.
How people land on clones
- Sponsored search results placed above the real site.
- 'New link' or 'backup link' messages in chats and SMS.
- Links from social-media agents and comment threads.
- QR codes on posts and stickers.
- Searching for a casino after its real site was slow or down.
That last route is the most common. A real site having a bad hour sends its players searching, and the clone is waiting in the results.
Claims you will see, and the reality
| Claim | Why it is false | What to do |
|---|---|---|
| 'This is our new official link' | Operators announce address changes inside the site you already use, not by unsolicited message | Use your bookmark; ask support inside your account |
| 'Log in again to secure your account' | A login page reached by link exists to collect the login | Never sign in from a link |
| 'Same account works on this mirror' | If your password works on a copy, the copy now has your password | Change it immediately on the real site |
| 'Deposit here for a bigger bonus' | The deposit goes to the cloner | Deposit only through your usual cashier |
| 'The padlock shows it is safe' | Encryption says nothing about who owns the site | Check the domain, not the padlock |
Habits that defeat clones
- Bookmark the real address once, after checking it against PAGCOR's published list, and only ever use the bookmark.
- Let a password manager fill your login. It will not offer the password on a domain it does not recognise, which is a useful alarm.
- Use a unique password for each casino account.
- Before any deposit, glance at the address bar again.
- Treat every 'new link' as false until confirmed from inside your existing account.
Related scams
OTP phishing often runs on a clone: after the password, the page asks for the one-time code and relays both to the real site.
Fake support numbers appear on clone contact pages, and the 'agent' asks for codes or remote access.
Release fees follow a clone deposit: the fake balance cannot be withdrawn until a charge is paid, then another.
Predictor apps are advertised on the same pages, claiming to forecast slot results that are in fact generated at random on the studio's servers.
What a real KYC request never asks for
Clones copy the verification page too, so know the limits. Genuine KYC takes a government ID and usually a selfie, inside your account on the real domain. It never asks for an OTP, MPIN or password; never charges a fee; never requires a remote-access app; and never sends you to a chat account to submit documents. An ID uploaded to a clone can be reused by its operators, so the domain check comes before the upload.
If you used a clone
- Change the password on the real site at once, and anywhere else it was reused.
- Change your wallet MPIN if you entered it or an OTP.
- Report transfers through your wallet's in-app help with reference numbers.
- Save the clone's address and screenshots.
- If you uploaded ID, mention that in every report.
Escalation route
Tell the real operator's support, from inside your genuine account, that a copy exists and that your credentials were exposed. Use the e-wallet's in-app helpline for the payment, never a number someone supplies. PAGCOR's complaint channel, published on its official website, is the route for matters concerning licensed operators. Fraud goes to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division, and the CICC accepts online scam reports on its 1326 hotline. PHSWERTE cannot recover funds and has no part in these processes.
Frequently Asked Questions
Does PHSWERTE have a login or cashier?
No. PHSWERTE is a guide. If a page using the name asks you to log in or deposit, it is not this guide.
Is a site with a padlock safe?
A padlock only means the connection is encrypted. Cloned sites have them as well.
How do I know which address is the real one?
Compare the company name and domain with PAGCOR's published list of licensed operators, reached by typing the regulator's address yourself.
My password worked on the 'mirror'. Is that good?
No. It means the copy has now seen your password. Change it on the real site immediately.
Why do clones rank above the real site?
They buy ads and use the brand name heavily. Position in search results is not evidence of authenticity.