Scam Watch #2: Our Licence Audit, the PAGCOR Licence That Cannot Exist, and 17 Brands Checked

Desk research. This edition summarises the operator reviews this site published between 12 August and 1 October 2026, and the licence audit behind our rankings, published on 30 September and 1 October. It is built from the brands’ own pages and page source, regulators’ public registers and notices, and the text of the laws involved, checked between 12 August and 2 October 2026. We have not registered an account, deposited, played or requested a withdrawal at any brand named here. Nothing below is a first-hand payment test. How we work: our methodology.

Short answer: at the end of September we re-checked the casinos our reviews had scored well, each against its regulator’s own register, and most failed. Eighteen casinos our pages had scored between 6.4 and 9.1 out of 10 now score 2 or 3, with no link to the operator; seven are ranked. Of the eighteen brands we reviewed for the first time since Scam Watch #1, seventeen score 2 or 3 as well; the eighteenth, Rizzy, passed the licence check and is ranked. Two false licence claims came up again and again: a PAGCOR licence, a category the Philippines cancelled in December 2024, and Curaçao’s old /JAZ numbers, above all #1168/JAZ, a number printed on brand after brand that no regulator’s current register contains.

This is Scam Watch #2. Scam Watch #1 covered seven brands and four patterns up to 10 August. This edition covers what has happened since, and it starts with a correction to our own rankings, because that is the biggest change on this site since the first edition. Every brand below that has a review on this site links to it.

Corrections First: What Our Licence Audit Changed

The rule is now simple. A casino is ranked only if the regulator’s own register confirms its licence. A casino whose licence cannot be confirmed, or is contradicted by the regulator, scores 2 or 3 out of 10, gets a “Not Recommended” verdict and loses its button. We applied that rule between 29 September and 1 October 2026.

Six casinos passed and were re-scored on what their registers and their own terms show: Dafabet (8.1), we88 (7.6), Surewin (7.6), BK8 (7.5), GOD55 (7.2) and Eclbet (6.6). All six had scored higher before, between 8.3 and 9.2. Rizzy was added on 1 October at 6.7 after a separate check. Eighteen casinos that our pages had scored between 6.4 and 9.1 failed, and this is why:

Our own pages were part of the problem. Until 30 September, our AW8, W88 and Dafabet reviews described PAGCOR licences as if they were current, and the AW8 and W88 cards on our ranking page did the same; that page’s own criteria also listed PAGCOR among the regulators we accepted. Those pages now say what the registers show. Dafabet still ranks first, on a Curaçao licence whose certificate names dafa888.com, the site its button opens; its review also notes that Dafabet’s own casino terms still cite Philippine licensing. If you signed up somewhere because of a score you saw on this site before 30 September, read that brand’s review again now.

The Licence That Cannot Exist: PAGCOR

A Malaysia-facing casino cannot hold a PAGCOR licence in 2026. That is not a judgement call; the Philippines closed the category twice.

December 2024. After Executive Order No. 74, PAGCOR cancelled all of its Internet Gaming Licensees and Authorized Providers effective 15 December 2024. Its offshore gaming notice, still online on 2 October 2026, says: “Any company or gaming website claiming to hold a valid offshore gaming/internet gaming license from PAGCOR is fraudulent and unauthorized.”

October 2025. Republic Act No. 12312, the Anti-POGO Act of 2025, approved on 23 October 2025, bans offshore gaming operations in the Philippines. Section 5 cancels the offshore licences PAGCOR and other agencies had issued and revokes PAGCOR’s power to issue new ones. The Act takes effect 15 days after publication.

So the test is binary. A PAGCOR badge on a site that takes ringgit is not a weak licence. It is a licence that cannot exist. This edition met it again and again: MrLucky88’s lobby says it is “Licensed by PAGCOR” next to a 2017 accreditation as a “Gaming Support Provider”; the only regulator Bila2Cuci-named pages cite is PAGCOR; and across eleven of JQK’s sites, the only regulator named in readable text is PAGCOR.

One distinction matters. Two casinos we rank still carry stale Philippine references in their own material: Dafabet’s casino terms, and an “Active” PAGCOR accreditation claimed on Surewin’s marketing site. They are ranked because a current licence on a regulator’s register covers the site their button opens; both reviews flag the stale line. A PAGCOR line next to a licence the register confirms is a sign of careless paperwork. A PAGCOR line instead of one is a reason to stop.

PAGCOR names the fake-certificate factories

The same PAGCOR page links two notices worth reading before you deposit anywhere. The first, on fake certificates, warns that entities on Facebook, X, Telegram and Viber are “using fake certificates to deceive the public on the legitimacy and legality of their operations.”

The second, a list of reported websites, names three domains that generate counterfeit PAGCOR certificates:

• verification.pagcorlicense.ph
• licensing.newwavelicensing.ph
• validator.pagcor-licence.ph

Each is named to look like a regulator’s verification tool. That answers the question readers ask most: “but I clicked the seal and it said verified.” A seal that opens a look-alike validator proves nothing. The only check that counts is the one you start by typing the regulator’s own address into your browser.

The rest of that notice is a long list of websites PAGCOR says are “not related to or endorsed by PAGCOR”. On 2 October 2026 it included aw8.com, mb8my.com, uea8my.com, w88.com and two Maxim88 entries, all brands whose reviews appear above. It also names “dafabet”, as a bare brand name with no web address. We rank Dafabet on its Curaçao licence for dafa888.com, not on any Philippine claim; as noted above, Dafabet’s own casino terms still cite Philippine licensing. The list is a notice about use of PAGCOR’s logo, not a finding that any listed site took anyone’s money, and we read it that way.

The 17-Brand Scoreboard

Eighteen reviews have gone live since Scam Watch #1 closed. One is Rizzy, which passed the licence check and joined our ranking on 1 October. The other seventeen all failed it. The worst finding in each, and the score each review carried on 2 October 2026:

None of these reviews accuses an operator of theft we cannot document, and each says so. The scores follow the licence rule: none of the seventeen publishes a licence that a regulator’s register confirms for its Malaysian site. In practice every row means the same thing: we do not recommend depositing. Our blacklist sets out how the blacklist and the watchlist differ.

The Licence Number That Keeps Coming Back: #1168/JAZ

One licence line turned up on brand after brand. On 2 October 2026 the footer of RM88 (rm88a.net, which names itself Richman88) read: “RICHMAN88 is a Registered Trade Mark, brand, and registered by Moon Technologie. Regulated & Licensed by the Government of Curacao and operates under the Master License of Gaming Services Provider, N.V. #1168/JAZ.” RM88 has no full review on this site; on this evidence it is not recommended.

Two primary sources settle that sentence:

• Gaming Curaçao’s own website, read on 2 October 2026, gives its master licence as 365/JAZ, not 1168/JAZ, and says it ceased operations on 18 August 2024, that every sub-licence issued under that master licence expired that day, and that any attempt to display active seals afterwards “will be considered fraudulent and illegal”.
• The Curaçao Gaming Authority’s online gaming licence registry (edition of 21 September 2026) has 665 entries. Every licence number in it begins OGL/ or CGA/. Not one ends in /JAZ.

RM88 is not alone. The same master-licence line, Gaming Services Provider N.V. #1168/JAZ, appears in SpinCity99’s footer and Alibaba66’s lobby footer, and as ready-made licence sentences in the shared platform files behind Telur33, Gardenia888, Kedai888 and i4 Malaysia, which do not display them. Three free-credit brands on our RM100 no-deposit page print it too. A licence number shared by that many unrelated-looking brands is not anybody’s licence. It is platform boilerplate.

In fairness, one thing does check out. A company called Moon Technologies B.V. holds a current Curaçao licence, OGL/2023/111/0069, listed as “Indefinite” in the same registry, and it does not appear in the regulator’s enforcement register (edition of 14 September 2026). But RM88’s footer spells the name “Moon Technologie”, never cites that number, and the registry lists companies rather than brands or websites. We cannot connect RM88 to that licence, and RM88 does not claim it.

RM88’s own pages show why the licence matters. On 2 October 2026 its promotions page advertised a “Register Free Bonus” of RM188, and its home page showed “Deposit Minimum: RM1.00” and “Withdraw Minimum: RM20.00”. A headline 188 times the smallest deposit (18,800%) is a number built for advertising. Whether any of it can be withdrawn is decided by the rollover and the cash-out cap, and holding a casino to those terms needs a regulator that has actually licensed it.

A check you can run yourself: read the page source

RM88’s page source carries something its visible pages do not. Its ready-made bonus help text works through its examples in Indonesian rupiah, on a site whose cashier and offers are in ringgit. That does not make the site Indonesian. It shows a regional platform serving several markets, which is also why the same licence sentence surfaces on so many brands.

On a desktop browser, right-click the casino’s page and choose “View Page Source”, then search (Ctrl+F) for JAZ, licen, IDR and Rp. A licence sentence that names another brand, or worked examples in another currency, tells you the licence line on the page may belong to the platform rather than to the casino in front of you.

Three Patterns That Are New Since Scam Watch #1

Scam Watch #1 named four: mirror-domain clusters, licence claims that cannot be checked, missing terms, and bonus numbers that disagree with themselves. All four repeated. Three more are now frequent enough to name.

5. Badges where the licence should be

Where a licence would normally sit, Kedai888’s footer says it is “an official verified partner in the 888 Partnership network” and shows five badges its own code labels as BMM Testlabs, iTech Labs, iovation, ThreatMetrix and an SSL seal. Peluang88’s About page, under the heading “Audit, Licensing, And Player Security”, says it “operates under the certification stack maintained across the SyarikatCuci partnership network”, naming iovation, BMM Testlabs, iTechLabs, “1st Verified” and “Verified & Secured”.

None of those is a gambling regulator. Testing labs check that a game’s random number generator behaves as specified. Fraud tools screen logins. An SSL certificate encrypts the connection. None of them authorises anyone to hold your money, and none can help you if a withdrawal never arrives. Our live, RNG and licence glossary explains what a licence actually is.

6. The partnership as a credential

The newest trust signal sounds like accountability: membership of a named network. Kedai888’s “888 Partnership” list names other casino brands, among them Gardenia888, which we score 2/10. Peluang88’s footer badge links to a review site that, as our review found, says every casino on it belongs to the same group and then scores those member brands between 9.37 and 9.79 out of 10. A marketing network is not a regulator and not an owner. If a site’s strongest credential is its club, and the club’s other members fail the same check, the badge counts against it.

7. “Independent” reviews built from one image account

On 2 September 2026 al-nisa.net, which calls itself “Al-Nisa - Live Casino Games”, published a review of i4 Malaysia. On 3 September the blog mnkystudio.com published another. They disagree on the basics: one rates withdrawals 3 out of 5 and mobile 2 out of 5; the other gives both four stars and the brand 7.6/10. On 2 October 2026 both still served their article images from the same Cloudflare Images account, P9OFiVM18PAr1SvRwzgU7w, the account behind the forty sites in our doorway network investigation.

A shared image account proves shared infrastructure: somebody with access to that account supplied the artwork for both. It does not prove common ownership, and we do not claim it. What it settles is narrower: two “independent” reviews built from one image account are not two pieces of evidence. When a search for a brand turns up glowing reviews, look at where their images come from (the page source again) before you count them.

The Two-Minute Check, Updated

1. Find the licence number in the footer. No number, or an image you cannot click? Stop. A seal that is a static picture is decoration.
2. If it says PAGCOR, stop. For a site taking ringgit, that licence category no longer exists.
3. If the number ends in /JAZ, stop. That is Curaçao’s old master-licence format. The current registry contains none, and Gaming Curaçao says the sub-licences under its 365/JAZ expired on 18 August 2024.
4. Type the regulator’s address yourself. Never follow the casino’s own “verify” link; that is what the counterfeit validators above are for. Curaçao: the CGA licence register, with domain certificates at cert.cga.cw. Anjouan: the licence register. Malta: the MGA licensee register. Isle of Man: the online gambling licensee register. Great Britain: the UKGC public register (a UKGC licence covers Great Britain, not Malaysia).
5. Check that the entry covers this domain, and read its expiry date, not just a status word. Emas44’s number was real and belonged to somebody else’s site; me88’s Curaçao certificate had been revoked.
6. Find the company name. No named legal entity means nobody to hold to account.
7. Open the T&Cs and find the rollover, the maximum bet and the cash-out cap. Our bonus T&C red flags and wagering and rollover explainer cover the clauses that decide whether an offer is worth anything.
8. On a desktop, view the page source and search for JAZ, licen and other currencies, as described above.
9. Check the payee before you transfer. Run the account number and phone number through PDRM’s Semak Mule.

Two register addresses have moved since Scam Watch #1. On 2 October 2026 the Malta Gaming Authority’s old register path (/support/online-gaming-licence-register/) returned “Page Not Found”, and the Isle of Man’s old licence-holders path now forwards to a page of approved businesses. The links above are the current ones. Before you sign up anywhere, our guide to registering at an online casino walks through what to check on the sign-up page itself.

A brand that fails steps 1 to 6 is not a “risky” casino. It is an anonymous stranger holding your money under rules it has not written down.

If You Have Already Deposited and Cannot Withdraw

Act fast. The National Anti-Financial Crime Centre says quick action can reduce losses, “although there is no guarantee that you will get your money back.”

1. Screenshot everything now. Balance, withdrawal request, transaction receipts, the exact domain you used and every support chat.
2. Call your bank’s 24-hour line. The number is on the back of your card.
3. Call 997, the National Scam Response Centre, so the authorities can block the accounts and transactions involved. The two official pages disagree on its hours: the NFCC’s NSRC page says 8.00am to 8.00pm every day, including public holidays, while the MyGovernment portal says “Daily (24 hours)”. Call your bank’s line as well either way.
4. Then lodge a police report anyway, at the nearest police station. A 997 call does not replace it. The NSRC’s own FAQ answers the question directly: “Yes. Reports must be made within 24 hours. If no police report is made, follow-up action cannot be carried out by the police.”
5. Check the payee on Semak Mule and include the result in your report.
6. Stop depositing. Do not send more money to “unlock” a withdrawal. That request is itself the scam.

Where the Licensed Options Are, and What a Licence Does Not Change

None of this means every offshore brand is a scam. It means the set whose licence a regulator confirms is far smaller than the search results suggest. Seven casinos meet that test today: Dafabet, whose Curaçao certificate names the site its button opens, and we88, Surewin, BK8, GOD55, Rizzy and Eclbet, all licensed in Anjouan. For two of them, BK8 and Eclbet, Anjouan’s register lists other web addresses than the Malaysian lobbies their players use, and their reviews say so. All seven, with their scores and the licence evidence for each, are on our Malaysia casino ranking. How the site is funded is on our transparency page.

The legal position, plainly: a licence from Curaçao, Anjouan or anywhere else is not a Malaysian licence, and it does not make playing legal in Malaysia. Section 6(1) of the Common Gaming Houses Act 1953 and section 6(1) of the Betting Act 1953 make it an offence for the player, with a fine of up to RM5,000, up to six months in jail, or both. In October 2023 the Court of Appeal upheld convictions for online roulette played on laptops in Melaka, holding that no physical gaming machine had to be on the premises. Our guide to Malaysia’s gambling laws sets out the detail.

18+ only. Gambling should be entertainment, never income. The house holds a mathematical edge on every game, over every session. If gambling is affecting your money, work or relationships, Befrienders KL offers 24-hour emotional support on +603-7627 2929, and Gambling Therapy offers free online support. Our responsible gambling page lists more options.

Corrections: if a brand named here holds a licence that appears on an issuing regulator’s public register and covers its Malaysian site, that register entry, not a badge or an email, is the evidence that would change its review.

Scam Watch #2 FAQ

Is a PAGCOR licence valid for a Malaysian online casino in 2026?

No. PAGCOR cancelled all of its Internet Gaming Licensees and Authorized Providers effective 15 December 2024, and the Anti-POGO Act of 2025 revoked its power to issue offshore gaming licences. PAGCOR’s own notice says any company or website claiming a valid offshore or internet gaming licence from it “is fraudulent and unauthorized”. A PAGCOR badge on a site that takes ringgit describes a licence that cannot exist.

Adakah lesen PAGCOR sah untuk kasino dalam talian di Malaysia?

Tidak. PAGCOR telah membatalkan semua lesen permainan internet luar pesisir berkuat kuasa 15 Disember 2024, dan Akta Anti-POGO 2025 menarik balik kuasanya untuk mengeluarkan lesen baharu. Notis rasmi PAGCOR sendiri menyatakan bahawa mana-mana syarikat atau laman yang mendakwa memegang lesen luar pesisir yang sah daripada PAGCOR adalah “fraudulent and unauthorized”. Jika laman itu menerima deposit dalam ringgit dan memaparkan logo PAGCOR, berhenti di situ.

What does #1168/JAZ in a casino footer mean?

Nothing a regulator stands behind. Numbers ending in /JAZ come from Curaçao’s old master-licence system. Gaming Curaçao gives its own master licence as 365/JAZ and says the sub-licences under it expired on 18 August 2024, and the Curaçao Gaming Authority’s current registry (edition of 21 September 2026) contains no /JAZ numbers at all. The #1168/JAZ line appears on many unrelated-looking Malaysia-facing brands at once, which makes it platform boilerplate, not a licence.

Why did casinos you used to recommend drop to 2 or 3 out of 10?

Because at the end of September 2026 we started ranking only casinos whose licence the regulator’s own register confirms. Eighteen casinos our pages had scored between 6.4 and 9.1 failed that check, for reasons ranging from PAGCOR claims to licences that were revoked or did not cover the Malaysian site. They now score 2 or 3 and carry no link to the operator. The corrections table above lists each one and why.

I clicked the licence seal and it said verified. Is that proof?

No. PAGCOR has named three websites that generate counterfeit PAGCOR certificates, each named to look like a verification tool. A seal that opens a look-alike validator proves nothing. Type the regulator’s own address into your browser, search its register yourself, and check that the entry names the domain you are on.

Kena scam casino online — apa nak buat? (I got scammed by an online casino — what do I do?)

Simpan semua bukti dahulu (tangkap layar baki, permintaan pengeluaran, resit transaksi, sembang sokongan). Telefon talian 24 jam bank anda, kemudian 997, talian NSRC. Laman NSRC milik NFCC menyatakan talian itu dibuka 8.00 pagi hingga 8.00 malam setiap hari, manakala portal MyGovernment menyatakan 24 jam, jadi hubungi bank anda juga. Selepas itu buat laporan polis di balai berhampiran: panggilan 997 tidak menggantikannya, dan Soalan Lazim NSRC sendiri menyatakan laporan mesti dibuat dalam masa 24 jam. Semak akaun penerima di Semak Mule. Jangan hantar wang tambahan untuk “buka” pengeluaran.

Does calling 997 count as a police report?

No. Call 997 to get a freeze started, then lodge a police report at the nearest station anyway. The NSRC’s own FAQ asks whether you still need to file a police report and answers: “Yes. Reports must be made within 24 hours. If no police report is made, follow-up action cannot be carried out by the police.”