If someone else used your BitStarz account, here is what the terms actually give you

What the terms do when you say someone else had access

BitStarz's published terms have no section called account security. They have one clause that decides most cases, and a set of deadlines that decide the rest. Clause 6.2.4 says it is your 'sole and exclusive responsibility' to keep your login details secure, and that BitStarz 'is not responsible for any abuse or misuse of Your Member Account by third parties due to Your disclosure, whether intentional or accidental, whether active or passive, of your login details to any third party.'

The word doing the most work in that sentence is 'passive'. It covers the password saved in a browser, the session left open on a shared laptop, and the login page that looked like the real one. The clause is not limited to a player handing their credentials to somebody. It is drafted to cover disclosure the player did not notice making, which is the way most account access actually happens.

What is left after that clause is procedural. The terms give you windows in which to ask, a rule about whose records count, and a forum where a dispute ends up. None of those three is a promise that money comes back, and each of them has a deadline attached that most readers only discover after it has passed.

The 24-hour window, and the 30-day window that only opens on a claim

Clause 8.8.1 sets the refund window: a request must be made 'within the first 24 hours of the transaction in question for it to be considered (or within 30 calendar days if you claim that another person has gained access to your account).'

The 30 days is not a grace period that applies to everyone who is late. It applies to a player who makes a specific claim, in those terms: that another person gained access. If you report a transaction you do not recognise and describe it as a mistake, a duplicate charge or a game error, you are on the 24-hour route, and on day three the request is outside it.

The two windows differ by a factor of thirty, which is the whole reason the wording matters. A day and a month are not two versions of the same courtesy; they are the difference between a request that arrives inside its window and one that does not.

Both windows run from the transaction, not from the moment you noticed. That distinction is the one that catches people. A player who reviews their balance on a Friday for a withdrawal that left on Tuesday has missed the ordinary route and is dependent on the 30-day one, which means the wording of the report matters more than the delay does.

The third clock: six months, and the only place it can be filed

Clause 15.1 sets an outside limit on everything else: any claim or cause of action 'must be filed within six (6) months after such claim or cause of action arose.' Clause 17.1 then says where: disputes 'shall be settled exclusively by arbitration in Curacao and in accordance with Curacao Civil Procedure Rules.'

That is a real forum, and it is also a long way from most readers. The operator behind the site is Gareton B.V., registered in Curaçao under number 160656 and licensed there by the Curaçao Gaming Authority under licence OGL/2024/165/0185, so the arbitration clause and the licence point at the same place. The terms name no arbitration institution, no seat beyond the country, and no allocation of costs. For a disputed balance of a few hundred euros, the arithmetic of travelling to a Curaçao arbitration is unlikely to work, and the terms neither hide that nor draw attention to it.

The six-month limit matters even if you never intend to arbitrate, because it is the point at which the operator can say the matter is closed regardless of what the earlier correspondence produced. Diarise it the day you open the complaint, not the day support stops replying.

Why 'it wasn't me' is hard to argue: the server-records clause

Clause 14.4 is one sentence and it shapes every account-access dispute: 'In the event of any dispute, you agree that the records of the server shall act as the final authority in determining the outcome of any claim.'

The evidence that would settle a takeover claim is login IP addresses, device and browser identifiers, session history and the timestamps of the transactions. That evidence sits on the operator's systems, and the terms do not oblige the operator to hand any of it to you. You are arguing against the authoritative record, using evidence you do not hold, about an event that happened inside a system you cannot inspect.

Clause 2.8.4 completes the picture. The player agrees to 'fully indemnify and hold harmless' BitStarz and its directors, employees, partners and service providers for costs, expenses, losses, damages, claims and liabilities arising from the player's use of the site. Read together with 6.2.4 and 14.4, the allocation is consistent: the account and its credentials are the player's risk, the records are the operator's, and the operator's records decide.

What the terms do not say about account security

A full-text search of the published English terms on 18 October 2026 returns no occurrence of 'two-factor', '2FA', 'authentication', 'unauthorised', 'hack' or 'session'. The word 'password' appears twice, both times in the registration clause about keeping login details secure. There is no clause describing what the operator does to protect an account, because the terms allocate the loss instead of describing the controls.

Pages that rank for this question state that two-factor authentication is available at BitStarz. None of the ones this research opened cited the operator for it, and no first-party page found here confirms it, so this page does not repeat it as fact. The honest position is narrower: the published contract does not address two-factor authentication at all, so if it matters to you, ask support in writing whether it is available on your account and keep the reply.

The absence is worth pricing in rather than dismissing. A contract that puts credential security entirely on the player, and says nothing about the account controls that would make a stolen password insufficient, is a contract that has decided where the risk sits before any incident occurs.

If it happens: the order to do things in

Change the password first, and log out of every device you can. Do this before contacting support, because a support conversation takes time and the account stays open while it happens. Changing a password does not always end a session that is already open, so ask support to terminate active sessions as part of the same request. If the registered email address is also compromised, recover that account first, since every password reset runs through it.

Then put the report in writing rather than in live chat. Clause 14.2 directs complaints to customer service, and clause 14.3 says complaints are handled in the support department and escalated inside the organisation if support cannot resolve them. Ask for the complaint to be logged and escalated under 14.3, and ask for a reference. A chat transcript that disappears with the session is not the record you want six weeks later.

Use the wording the terms use. Say that you are claiming another person gained access to your account, and cite clause 8.8.1. That sentence is what puts you on the 30-calendar-day route instead of the 24-hour one, and it is also the claim you will have to support, so do not make it loosely.

Keep everything that ties you to the transaction and the intruder to it: deposit transaction hashes, withdrawal references, the timestamps from your own email notifications, and screenshots of anything unfamiliar in the account. The operator holds the authoritative records, but you can still build a timeline, and a timeline is what a reviewer reads first.

Finally, note the dates. The 30 days runs from the transaction, and the six-month limit in 15.1 runs from the cause of action. Put both in a calendar on the day you report, because the correspondence will outlast your memory of it.

What an active bonus changes about a takeover

If a bonus was active when the account was accessed, there is a second and independent way to lose the balance. Bonus terms clause 3.14 states that all withdrawals are subject to an internal audit before processing, and that BitStarz 'reserves all rights to void bonuses or any winnings resulting from failed audits', with players consenting to the policy in advance.

Clause 3.10 supplies the most likely reason an audit fails. While a bonus is active and playthrough is unmet, the maximum allowable bet is 5 EUR/USD/CAD/AUD/NZD/USDT, 0.00006 BTC, 0.0015 ETH, 0.05 LTC, 0.01 BCH or 25 DOGE, and the cap also covers double-up wagers and purchased in-game features. Someone using an account they did not open has no reason to respect a cap they never read, and one large spin is enough to breach it.

So a takeover with a bonus running has two loss routes rather than one: the disputed transaction itself, and an audit that can void the winnings around it. That is not a reason to give up on the report, but it is a reason to raise the bonus in the first message rather than waiting to be told about it.

What this means before you deposit

The terms treat the account as yours to protect. The operator's obligations are procedural: consider a request inside a window, run an audit, keep the records that decide the outcome. There is no clause in which the operator accepts custody of your balance in the way a bank accepts custody of a deposit, and a reader who expects that will be surprised at the worst possible moment.

That is not unusual for a Curaçao-licensed operator, and it is not by itself a reason to avoid this one. It is a reason to treat a balance here the way you would treat cash in your pocket: keep the login unique to this site, do not reuse the password, do not leave the session open on a shared machine, and do not leave a large balance sitting idle between sessions.

The useful test is not whether the terms are generous, because they are not. It is whether you can live with the allocation they set out, knowing that the 30-day claim, the six-month limit and the server-records rule are the whole of your route if the account is used by someone else. If that is acceptable, the terms are worth reading in full before you deposit rather than after.

One boundary on all of the above: this is a reading of the operator's published documents, checked on 18 October 2026, and not legal advice. A dispute over a specific balance turns on facts this page cannot see, and on whether a clause like the six-month limit is enforceable where the reader lives, which varies by jurisdiction.