Mobile Casino Not on GamStop and Regulator Enforcement

A mobile casino not on GamStop takes payments from a phone bill rather than a card or bank account, and sits outside the Gambling Commission's licence. That cuts both ways: GamStop's block does not reach it, but neither do British withdrawal rules, deposit limits or the ADR scheme. Unlicensed sites are illegal to offer to British players, and the Commission disrupts them.

The pitch is always the same. No card, no bank login, no documents — just a phone number, a text, and a balance. Operators market a pay by mobile casino not on GamStop to people who want a deposit to leave no trace on a statement, and the mobile-billing rail does exactly that, up to a cap set by the network rather than by any gambling regulator.

I have watched this niche for years, and what strikes me is how little of the selling is about gambling at all. It is about plumbing. The phone bill is the product; the roulette table is the decoration. And the plumbing is where the trouble lives, because a payment rail designed for ringtones and app purchases carries no protections written for gamblers.

The Gambling Commission's angle is straightforward and worth stating plainly. Under section 33 of the Gambling Act 2005 it is an offence to provide facilities for gambling in Great Britain without an operating licence, whether the equipment sits here or abroad, and since April 2024 its Illegal Markets team has issued 3,140 cease and desist and disruption notices. That is the regulatory backdrop to every one of these sites. What follows is how the payment method actually behaves, why the licence gap matters more than the marketing suggests, and what a suspicious punter can check in five minutes.

What Pay by Mobile Actually Does to Your Phone Bill

Pay by mobile is carrier billing. The operator charges a payment aggregator, the aggregator charges the mobile network, and the network adds the amount to the monthly bill or deducts it from prepaid credit. The gambler never sees a casino name on a bank statement — just a short code or a generic merchant descriptor.

That is the whole appeal, and also the whole problem. There is no chargeback right in the way a card provides one, because the transaction did not run through a card scheme's dispute machinery. There is no bank gambling block, because bank blocks work by declining payments under gambling Merchant Category Codes, and carrier billing does not pass through that gate. The Gambling Commission's list of banks with gambling blocks, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling — and not one of them can decline a charge levied by a mobile network.

There is a ceiling, too, and it is lower than people expect. Mobile-billing limits are set by the network and the aggregator, vary by account and by how long a number has been active, and are routinely a few hundred pounds a month. A punter who wants to deposit £5,000 does not do it this way. Which is why these sites almost always offer a second route — crypto, an e-wallet, a bank transfer — once the mobile limit is reached, and why the mobile option functions as an on-ramp rather than a full payment system.

I would put the honest summary like this: pay by mobile is excellent at speed, poor at recourse, and silent about identity. The last point used to be its chief selling point. Under the current British framework it is a liability for the player, not a feature.

The Commission's Disruption Numbers for Illegal Sites

The checkable benchmark for this topic is what the regulator manages against illegal sites, and its own figures are the primary source. Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices — 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and 3 payment provider referrals — and referred 447,778 Bing and Google URLs, securing 287,961 removals. Measured across 160 illegal gambling websites, engagement fell by an average of 32 per cent after disruption action.

The breakdown of that figure is the interesting part, and it is published. Registrar blocks and website suspensions each produced an average fall in engagement of 91 per cent. GEO IP blocking produced 60 per cent. Bing removal produced 52 per cent, Google removal 30 per cent and Facebook removal 8 per cent. The Commission says this is why it prefers blocking to de-indexing: search-engine removal makes a site harder to find but does not stop anyone who has the address.

The trend is not calming down. In July to September 2026 the Commission referred 1,835 websites — 7,677,211 URLs — and issued 546 cease and desist notices. In the whole of April 2025 to March 2026 it commenced one prosecution, in October to December 2025. Anyone who assumes a takedown means the operation has stopped should note the sequencing: the domain moves, the licence stays offshore, the shortcode is reissued.

The Two Tiers, Side by Side

The comparison below is by licence, not by brand, and it is the only one worth making. A British-licensed site and an offshore site are not two shops selling the same thing. They are two different sets of rules wearing similar websites.

The gambler who wants pay by mobile phone bill casino not on GamStop access is choosing the right-hand column, whatever the landing page says. The right-hand column is not automatically fraudulent. It is simply unaccountable to a British regulator, and the consequences of that land at the point of withdrawal roughly nine times out of ten.

Why the Licence Gap Matters More Than the Payment Method

Here is the fact that ought to stop more people than it does: a GamStop registration holds for its full term, and it then stays in place until the person contacts GamStop to remove it. It is not a timer that expires. An offshore site is never a way round that — it does not see the registration, so it does not enforce it, and the exclusion remains on the register regardless.

The other half of the licence gap is money. British-licensed operators must keep customer funds in a separate client bank account, must publish one of three insolvency ratings, and a "not protected" operator must remind customers every six months that their funds are not protected in the event of insolvency. Keeping funds in a separate account does not guarantee return if the business fails, and operators are legally allowed to hold customers' money in overseas bank accounts. In the offshore tier the disclosure is often thinner and sometimes absent.

Then there is the regulator's own view of who these sites serve. On 20 January 2025 the Commission issued an industry warning notice about licensed casino games appearing on unlicensed websites available to British consumers, noting that such sites often target customers who have self-excluded via GamStop and may have inadequate social responsibility and anti-money-laundering controls. That is not marketing copy. It is the regulator naming the customer base.

Illegal does not mean unpunishable, and it does not mean the player is the criminal either. The offences in the Act attach to those who provide facilities — section 33 applies whether equipment is in Great Britain or abroad and whether the offer is made inside or outside the UK — and section 330 covers knowingly advertising unlawful gambling. Adult consumers are not the target of the enforcement, though a disputed £4,000 payout at a vanished domain is its own punishment.

How Identity Checks Work, First Time and Later

If one thing decides how a session at an offshore mobile casino ends, it is identity verification, so it deserves its own section. The first deposit is usually frictionless: a phone number, a confirmation code, funds added. That is deliberate. Nobody is asked for a passport while the money is flowing inward.

The warning comes later. Under the Money Laundering Regulations 2017, remote casinos must identify and verify a customer once deposits, withdrawals or winnings reach €2,000 or more, and the threshold applies both to a single transaction and to transactions that appear to be linked — linked in practice meaning the same customer, the same game or the same logged-on session. A £40 deposit sent twelve times over a fortnight can therefore land squarely on the threshold.

At a British-licensed site the sequencing has been pushed the other way. Licence Condition 17 requires identity to be established before the customer is permitted to gamble, and operators are told to explain before the first deposit what documents might later be needed. Where they can verify electronically against credit reference or electoral roll data, no document is requested at all. Where the operator defers verification under the hybrid approach and then demands a passport at the point of withdrawal, that is a live compliance problem — Licence Condition 17.1.1 says a withdrawal request must not trigger a request for information the licensee could reasonably have requested earlier. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and it is one of the most common dispute types referred to ADR.

An offshore site has no such sequencing rule. It will verify when it suits it, and the moment it suits it most is the moment the balance is large and the account is about to be emptied.

The Warning Signs in the Check Itself

• A verification request that appears only after a substantial win, never before.
• Documents accepted at registration that are then rejected on withdrawal, with no explanation beyond "security review".
• A demand for source-of-funds paperwork out of proportion to the account's history.
• A "verification fee" or a requirement to deposit again before a payout is released. That one is not a rule being applied; it is a trap.
• A short deadline — "within 24 hours or the account is closed" — attached to a document request.

I would add a fifth-and-a-half. Any operator that asks for a selfie while the account was opened in someone else's name is doing the right thing for the wrong reason, and the account was never going to survive a check anyway.

Five Signs an Operator or Service Can Be Trusted

Trust here is not a feeling. It is a set of records that either exist or do not.

The Licence Is on the Public Register

A British licence can be checked in the Gambling Commission's public register, and the check is worth doing properly: the site's activities and its domain names both have to match what the register shows. For a Curaçao operator, click the Certificate of Operation seal and confirm it redirects to cert.cga.cw and that the certificate behind it displays the domain you are actually on. A certificate showing someone else's domain is either borrowed or forged. The speed of the check — under two minutes — is the reason there is no excuse for skipping it.

The Terms Name the Entity That Holds Your Money

Read the terms for a company name, a registration number and a stated insolvency rating for customer funds. Under British rules a licensee holding customer funds must state in writing whether those funds are protected if the business fails, at what level, and by what method, and the customer must acknowledge that disclosure before using funds for gambling. An operator that cannot tell you which company is holding the money has not told you anything.

Bonuses Are Capped in a Way You Can Verify

At a British-licensed site, wagering requirements cannot exceed ten times bonus funds for offers from 19 January 2026, and mixed-product promotions requiring two or more gambling products are banned outright. Those are bright lines. If a welcome offer quotes 40x on a bonus plus deposit, the number is legal somewhere, but it is not a British number, and the terms that surround it are unlikely to be either.

Withdrawal Terms Are Boring

A trustworthy operator has dull, specific withdrawal terms: a stated processing time, a named payment method, no maximum weekly withdrawal limit, and no option to reverse a payout. A maximum limit on what may be withdrawn from a deposit balance is a prohibited term in the British regime — the Commission's example of the offending clause is "You may withdraw up to £50 per day and up to £500 per week". Reverse withdrawals have been banned since 31 October 2021 under RTS requirement 14B, which states that consumers must not be given the option to cancel a withdrawal request. A cancel button beside a pending payout is a bright red flag with a bow on it.

There Is a Named Dispute Route

Look for the name of an approved ADR provider, the time limit for referring a dispute, and whether the service is free to the consumer. British licensees must offer referral to an ADR entity at no charge if a complaint is unresolved after eight weeks, though the customer must have gone through the operator's own procedure first — which is why 72.3 per cent of eCOGRA's invalid disputes in the year to 30 September 2025 had never been through it. One warning sign is worth more than the check: ADR providers will not accept complaints about customer service, or about an operator's refusal to accept a bet or a customer's custom. If the terms say disputes go to the operator's own management, there is no dispute route at all.

Five Checks Before Any Deposit Leaves a Phone

The steps below are ordinary, lawful and free. None requires an account.

1. Check the licence, then check the domain. Search the Gambling Commission's public register, or click through a CGA Certificate of Operation seal to cert.cga.cw. Do this before you look at the games. Reason: a licence claim costs nothing to make and about ninety seconds to disprove.
2. Confirm what GamStop does and does not cover. GamStop blocks accounts with operators licensed in Great Britain. It holds for the full term chosen and stays in place afterwards until the person contacts GamStop to remove it. Reason: knowing the boundary prevents the wrong conclusion — that an offshore site is a route around an exclusion. It is not, and nothing about it makes the exclusion weaker.
3. Read the bonus terms for three numbers. Wagering multiple, maximum cashout, and maximum bet while wagering. Reason: at an offshore operator, a 25x or 50x playthrough with a cashout cap is where a win quietly becomes a smaller win.
4. Test the cash-out before you need it. Make a small deposit, win or not, and request a withdrawal of a modest amount. Reason: withdrawal speed is the one thing that cannot be faked after the fact, and it is the number-one subject of consumer complaints to the Commission's Contact Centre.
5. Set up a block at the payment end. Ask the mobile network whether gambling charges can be barred on the account, and check whether the bank offers a gambling block on the card — a category block on the card will not touch carrier billing, but it will catch an e-wallet top-up. Reason: a block you control is worth more than a promise from an operator.
6. Keep the paper trail. Screenshot the terms, the bonus conditions and the withdrawal request, with dates. Reason: if a dispute ever goes to a third party, the operator's terms page will have changed and yours will not have.

If any of this feels like work, that is the point. The entire commercial pitch of a mobile casino not on GamStop is that none of it is necessary. The pitch is wrong.

What the Regulator Actually Does, and How Fast

I want to be fair to the enforcement side, because it is often described as either asleep or all-powerful and it is neither. The numbers above — 3,140 notices since April 2024, 287,961 URLs removed, a 32 per cent average fall in engagement — are real and they are published quarterly. One prosecution commenced across the whole of April 2025 to March 2026 is also real.

The Commission's stated preference is telling. Registrar blocks and suspensions produce a 91 per cent decline in engagement; Google removal produces 30 per cent. Its financial disruption work is younger: it made its first referral to the Visa Operator Scheme in January 2025 after a test purchase on an unlicensed site and has since made three more, and it describes payment-transaction reporting as critical and still early-stage. Payments are where this fight will be won or lost, because a casino that cannot collect deposits has no business model, however many domains it owns.

The scale is genuinely contested and worth reading with a sceptical eye. The Commission's own survey work, published 5 November 2026, estimates that among respondents who had gambled online in the past four weeks, 2.5 per cent had engaged with an illegal gambling website, with a further 1.5 per cent in the previous 12 months. H2 Gambling Capital puts the amount staked with illegal operators at £16.6 billion in 2025, up from about £5 billion in 2019. Frontier Economics, commissioned by the Betting and Gaming Council, estimated £2.7 billion a year — 2.1 per cent of stakes. Yield Sec, working for the Campaign for Fairer Gambling, put the unregulated share at 9 per cent of gross gaming revenue in 2025. When four credible outfits produce four different answers, the honest position is that the direction is up and the magnitude is unknown. The Commission's own methodology notes it does not capture activity hidden by VPNs, which is exactly the activity a pay-by-mobile user is most likely to be part of.

The Numbers That Ought to Be on the Landing Page

Offshore operators advertise speed and anonymity. Here is what the same rail looks like from the record-keeping side, using the regulator's own published figures.

Of 44.2 million withdrawals by customers of large online operators between June and September 2024, 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent within up to 48 hours. That is the British-licensed baseline, and it is good. Consumer research on trust published in July 2026 found 49 per cent of people who had gambled in the past 12 months agreed it was quick and easy to withdraw winnings, against 18 per cent who disagreed. Complaints coded "Withdrawals and/or financial transactions" to the Commission's Contact Centre fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025. None of those figures is generated by a licence-free site, because a licence-free site does not report to the Commission and its complaints go nowhere the statistics can see.

The offshore comparison is measurable in the ADR record, which does capture the disputes that reach a named body. eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes received, of which "Deposits & Withdrawals" accounted for 150 valid disputes; the average time to resolve domestic disputes was 31 days and 17.8 per cent of completed disputes were ruled in favour of the consumer. IBAS's annual report for 2024-25 records 3,721 domestic disputes, of which 217 were Banking/Financial, with an average completion time of 20 days. The disputes that reach a named adjudicator are the lucky ones. The rest are emails to a support address that stops answering.

Where to Get Help

GamStop is free and blocks online gambling accounts with operators licensed in Great Britain. It takes a few minutes to register, can take up to 24 hours to take effect, and cannot be cancelled during the period chosen. It is often typed "gamestop" — the word suggests itself — but the scheme is GamStop, run by The National Online Self Exclusion Scheme Limited. The registration holds for its full term and then remains in place until the person contacts GamStop to remove it. Registering is also the surest signal a player can send to unlicensed operators that they are worth targeting, which is precisely why the Commission's January 2025 warning notice flagged them as doing so.

The National Gambling Helpline is operated by GamCare, free of charge, on 0808 8020 133, 24 hours a day, every day of the year; the same number reaches live chat and WhatsApp. It is not a crisis line, and staff cannot transfer a caller at immediate risk of harm — they follow their own safeguarding procedures instead. For callers in Wales the number given is 0808 2819 265. GambleAware, the public-facing brand of the charity, directs people to the same Helpline. Gamblers Anonymous England, Wales & Ulster can be reached on 0330 094 0322 and runs around 250 meeting locations with no appointment needed. GamFam (registered charity No. 1191139) supports families through its GRA5P peer-support programme, and Gam-Anon UK & Ireland supports the family and friends of compulsive gamblers whether or not the gambler attends GA. NHS England has opened 15 specialist gambling clinics since 2019, and integrated care boards commission 8 regional services receiving almost 5,000 referrals a year against a target of 3,000. Citizens Advice gives free, confidential advice including on debt, and Citizens Advice Scotland runs a gambling support advice line on 0800 328 1131, Monday to Friday, 10am to 3pm.

Blocking software is a separate layer and worth naming. GamStop signposts Gamban and BetBlocker. BetBlocker is a 501(c)(3) non-profit registered in Delaware, requires no registration, is free worldwide, and states it blocks over 1,368,000 gambling websites and 3,100 apps. Gamban states it blocks licensed and unlicensed sites and is designed to be as difficult to remove as possible; TalkBanStop, its free UK licence scheme, ended on 31 March 2026, after which Gamban is free for residents of Wales but costs £4.99 a month or £29.99 a year in England and Scotland after a 7-day trial. Gamban's own description — that it blocks unlicensed as well as licensed sites — is the one feature carrier billing cannot offer.

Questions I Get Asked About Mobile Casinos and GamStop

Is a mobile casino not on GamStop legal?

Offering commercial gambling to consumers in Great Britain without a Commission licence is illegal, and the Commission states this applies even where the operator holds a licence elsewhere. Section 33 of the Gambling Act 2005 covers remote gambling if any equipment is in Great Britain, or if the provider knows or should know the facilities are likely to be used here. The offence attaches to the operator, not to the adult punter who deposits.

Can a pay by mobile casino not on GamStop get round a GamStop registration?

It does not get round it — it simply is not bound by it. A GamStop exclusion blocks accounts with operators licensed in Great Britain, and offshore sites are not connected to the scheme. The exclusion itself is unaffected: it holds for its full term and stays in place until the person contacts GamStop to remove it. Nothing about a carrier-billed deposit weakens the registration or shortens it.

Why do these sites insist on a phone bill rather than a card?

Carrier billing sidesteps the two controls built into the card system: bank gambling blocks, which decline payments under gambling Merchant Category Codes, and the card scheme's dispute machinery. The credit card ban imposed from 14 April 2020 also makes card deposits impossible at British-licensed operators. A phone bill carries none of that history, and it produces a merchant descriptor that rarely names the casino.

Do mobile deposits still trigger identity checks?

At a British-licensed operator, yes — identity must be established before the customer is permitted to gamble, and can often be confirmed electronically without documents. Under the Money Laundering Regulations 2017 a remote casino must identify and verify at €2,000 of deposits, withdrawals or winnings, whether in one transaction or several linked ones. At an offshore operator the timing is discretionary, which is why the request so often arrives at the cash-out.

What happens if an offshore site refuses to pay out?

There is no British route. The Commission is a regulator, not an ombudsman, and cannot resolve individual complaints or recover money, though it records them. An operator-designated ADR provider may take it, but only after the operator's own complaints process, and it will not look at customer service or a refusal to accept a bet. In practice the lever is the payment rail, which is why the Commission's referrals to the Visa Operator Scheme matter.

Are there safer ways to pay at an offshore site?

Safer is relative. The Commission's list of banks with gambling blocks — last updated 16 October 2026 — names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. Those blocks work at card level, must be set on each card, and generally impose a 48-hour or 72-hour cooling-off before gambling transactions resume. No bank block reaches carrier billing, so a mobile deposit bypasses every one of them.

The Regulator Moves Slower Than the Domain Does

A mobile casino not on GamStop is not a secret the authorities have missed. It is a known category, publicly warned about, measured quarterly and disrupted at industrial scale — and it survives because the address changes faster than the paperwork does. The Commission's own figures make that plain: registrar blocks knock engagement down by 91 per cent, Google removal by 30 per cent, and the quarterly website referrals went from 124 in July to September 2024 to 1,835 in July to September 2026. That is not a problem being solved. It is a problem being managed, in public, with the receipts published.

The punter's position is simpler than the regulator's. The protections that matter at cash-out — a fairness condition, a named adjudicator, a stated insolvency rating for the money sitting in the account — exist only in the column with the British licence. Carrier billing buys speed and buys nothing else, and the exclusion on the register does not lapse because a site did not look. The National Gambling Helpline, operated by GamCare, remains free on 0808 8020 133, 24 hours a day, every day of the year. It is worth saying once more: the offshore tier is not a loophole, because a loophole implies a rule that still applies.