Casino and Gaming Identity Security: Help Desk Resets, Loyalty Accounts and Gaming System Access

In casinos the identity layer is the attack surface: the 2023 MGM Resorts and Caesars Entertainment incidents both started with someone persuading a help desk or IT support vendor to act for them, and ended with access to the identity platform and the loyalty database. Casino estates combine a large shift-based workforce, outsourced support, regulated gaming systems with their own access rules, and millions of player accounts holding identity numbers and redeemable value. This guide covers the identity controls specific to that environment: help desk reset verification, privileged and vendor access to the identity provider, user controls that gaming regulators require on gaming systems, player loyalty and online account protection, and the machine credentials that connect it all. It is for identity, security and IT compliance leads at commercial and tribal casinos, integrated resorts, online operators and gaming suppliers. For the wider threat picture and regulation by jurisdiction, see the Cybersecurity for Casinos and Gaming Guide.

Practice recommendations in this guide (verification tiers, rollout timings, metrics and targets) are NHI Mgmt Group recommendations; regulatory and incident details are attributed to the sources linked in the text, as checked in November 2026. Confirm against the official text before relying on it.

Key takeaways

• The help desk is a privileged system. CISA and FBI advisory AA23-320A describes Scattered Spider persuading help desk staff to reset passwords and MFA tokens, including at contracted help desks; reset authority needs the same controls as admin rights.
• Gaming regulators already require individual accounts. The US tribal minimum internal control standards (25 CFR 543.20(f)) require each user to have their own access credential and terminated users to be deactivated within a period approved by the tribal gaming regulatory authority.
• Identity provider admins are tier zero. MGM attackers, by their own account, gained administrator access to Okta and Azure tenants; admin roles need phishing-resistant MFA, separate accounts and a second approver for changes.
• Loyalty accounts are stored value. Player club accounts hold points, comps and identity numbers, so account takeover is both a fraud and a privacy problem that needs credential stuffing defences and safe card replacement.
• Online accounts start with verified identity. Great Britain's licence condition 17 has required remote operators to verify name, address and date of birth before a customer gambles since 7 May 2019; the account must then stay bound to that verified person.

The casino identity landscape

Help desk resets: verification that resists a convincing caller

AA23-320A lists the identity techniques casino help desks face: callers impersonating employees to have passwords and MFA reset, staff impersonating IT to obtain one-time codes, MFA fatigue, SIM swapping using gathered personal data and security question answers, and attackers registering their own MFA devices after takeover. The MGM attackers reportedly found an employee on LinkedIn before calling the help desk. Anything findable on social media, in a breach dump or from a phone carrier is not a verification factor.

• Outsourced desks: Caesars disclosed that attackers socially engineered its outsourced IT support vendor. Write the verification tiers into the contract, remove the outsourced desk's ability to reset privileged accounts, and sample call recordings monthly. See the Help Desk Identity Verification Policy Template.
• Shift workers without corporate phones: many floor staff have no company device. Register a FIDO2 security key or platform passkey at onboarding, or use in-person reset at the security office or HR window, so the help desk is not choosing between blocking a dealer before a shift and trusting a caller.
• Script and pressure: callers will claim urgency (a VIP event, a floor outage). The script should allow the agent to refuse and escalate without penalty. See the Vishing and Help Desk Social Engineering Awareness Guide.
• When it goes wrong: have a playbook that revokes sessions and new authenticators for the affected account and checks for identity provider configuration changes. See the Help Desk Social Engineering Incident Playbook.

Protecting the identity provider and tier zero

AA23-320A also describes attackers adding a federated identity provider to the victim's SSO tenant with automatic account linking, which lets them sign in as any user. The MGM Resorts breach moved from a help desk call to identity provider and cloud admin access, then to encryption of more than 100 ESXi hypervisors by the attackers' account.

1. Phishing-resistant MFA for admins: FIDO/WebAuthn or PKI-based MFA, which the advisory says resists phishing, push bombing and SIM swap. Start with identity provider, hypervisor, backup and casino management system administrators. See the Phishing-Resistant MFA Guide.
2. Separate admin accounts: no email or browsing on admin accounts; admins use a dedicated account and, ideally, a dedicated workstation.
3. Just-in-time elevation: no standing super-admin roles beyond break-glass accounts; elevation is requested, time-limited and logged. See the Privileged Access Management Guide.
4. Two-person rule for identity changes: adding identity providers, changing federation, modifying MFA policy or granting admin roles need a second approver and raise an alert.
5. Break-glass accounts outside the identity provider: held in a safe at security, monitored for any use. See the Break-Glass Account Guide.

For platform-specific settings, see the Identity Provider and SSO Security Guide.

Gaming system access: what regulators require

Gaming systems carry their own access rules. For tribal gaming in the US, 25 CFR 543.20 sets information technology minimum internal control standards; commercial jurisdictions set equivalent internal control standards through their regulators. The table summarises the 543.20 user, remote access and backup controls.

• Separation of duties: the cage, count, slot accounting and player rating functions exist to stop one person controlling a money flow end to end. Model those conflicts in the access request process so a role grant that breaks separation needs explicit compliance approval.
• Manufacturer technicians: slot and table system vendors often hold local accounts on servers and machines. Give them named accounts, enable them per visit, and document each remote session as 543.20(h) requires. See the Vendor Privileged Access Management (VPAM) Guide.
• Surveillance: surveillance systems hold evidence and see everything. Keep their accounts outside the general directory where possible and review access monthly.

In Nevada, Regulation 5.260 (as adopted and effective 29 January 2026) requires covered licensees to perform a risk assessment and adopt cybersecurity best practices, citing examples such as CIS Controls Version 8, ISO/IEC 27001 and NIST SP 800-53, to notify the Board Chair within 24 hours of activating incident response procedures, and, for Group I licensees, to designate a qualified individual and complete annual independent reviews. An identity programme aligned to those frameworks gives the evidence those reviews ask for.

Player loyalty accounts

Caesars disclosed theft of a copy of its loyalty programme database containing driver's licence and Social Security numbers for a significant number of members. Loyalty data is both an identity store and a wallet.

• Credential stuffing defences: mobile app and web logins for player accounts face reused passwords from other breaches. Use bot detection, rate limits, breached password checks and MFA or passkeys for players. See the Account Takeover Prevention Guide.
• Step-up before value moves: require re-authentication before redeeming points above a threshold, transferring comps, changing contact details or adding a new device.
• Card replacement at the club desk and kiosk: a replacement player card is an account recovery event. Require photo ID at the desk, and do not allow kiosks to issue replacement cards on PIN alone for accounts with high balances. See the Kiosk and Shared Device Security Guide.
• Staff access to player records: host and marketing staff need player preferences, not identity numbers. Keep identity numbers in restricted fields for compliance roles and log every view.
• Points fraud: watch for insiders adjusting points and for accounts redeeming immediately after a contact change. See the Loyalty Points and Gift Card Fraud Guide.

Online and mobile gambling accounts

In Great Britain, licence condition 17 sets minimum identity verification requirements, and since 7 May 2019 remote operators must verify a customer's name, address and date of birth before allowing them to gamble. Verification at registration is only the start; the account must then stay bound to that person.

• Bind authentication to the verified person: offer passkeys or app-based MFA at registration, and require step-up for withdrawals, payment method changes and password resets.
• Recovery without weakening verification: recovery through email alone lets an attacker who controls the mailbox take a verified account and its balance. Use re-verification against the original identity data for high-value accounts.
• Self-exclusion integrity: account takeover and duplicate accounts can be used to circumvent exclusion and affordability controls; match new registrations against verified identities and exclusion lists.
• Consumer guidance: see the Securing Online Gaming Accounts Guide for player-facing advice.

Where identity fits for machines

Casino integrations depend on directory sync agents, casino management system interfaces to loyalty and hotel systems, payment gateway keys, sports betting data feeds and vendor service accounts. Give each an owner, scope it to its integration, store secrets in a vault, rotate when vendors change staff, and alert on interactive logon by any service account. See the Service Account Security Guide.

How to implement

1. Weeks 1 to 4: list everyone who can reset credentials (in-house and outsourced), every identity provider and hypervisor admin, every vendor with remote access and every shared gaming system login.
2. Weeks 4 to 8: introduce reset risk tiers and remove privileged resets from the outsourced desk. Pilot at one property's desk, then extend.
3. Weeks 8 to 16: enforce phishing-resistant MFA for admin roles after a report-only period, with monitored break-glass accounts; add the two-person rule for identity provider changes.
4. Months 4 to 6: replace shared gaming system logins with named accounts and fast re-authentication, one department at a time; drive leaver disablement from HR events into each gaming system.
5. Months 6 to 9: player account protections: breached password checks, step-up on redemptions and contact changes, card replacement rules.
6. Test: run a red team call to the help desk and a tabletop where the identity provider is lost on a peak weekend.

Rollback: if enforced admin MFA locks out a critical operator, use the monitored break-glass account and fix enrolment, rather than disabling the policy. If shared terminal re-authentication slows a cage at peak, extend the timer at that terminal only.

Decision guidance

• Single tribal or regional casino: start with the 543.20 user controls or your jurisdiction's equivalent, a written reset procedure with in-person verification for privileged users, and an MSP bound by contract to it.
• Multi-property operator: central identity governance, a tier zero team that owns all privileged resets, phishing-resistant MFA for every admin, and a security operations function watching identity events across properties.
• In-house or outsourced help desk: both work if the outsourced desk cannot touch privileged accounts and its calls are sampled. Outsourcing the reset of an admin account is the decision to avoid.
• Online operator: customer identity and wallet protection carry more risk than workforce identity; prioritise player authentication and recovery.

Detection and measurement

Alert on: MFA resets followed by new device registration; new authenticators registered outside business hours; new identity providers, federation changes or admin role grants; help desk resets for admins; service accounts logging on interactively; bulk queries against loyalty databases; and player accounts redeeming value soon after a contact change.

Framework mapping

Common failure patterns

• Knowledge-based verification: employee ID, date of birth or manager's name accepted on a call; all are findable.
• Outsourced desk with admin reach: a contracted help desk that can reset any account, including identity provider admins, the path described in the Caesars Entertainment breach.
• No alert on new authenticators: attackers register their own MFA device after a reset and nobody notices.
• Shared cage and slot logins: every transaction recorded under one login, breaking both the individual credential rule and separation of duties.
• Leavers in local gaming accounts: directory disablement works, but local accounts on casino management or surveillance systems survive.
• Kiosk card replacement on PIN: player cards reissued without photo ID, letting a thief redeem another member's points.

Practitioner checklist

• Define reset risk tiers and remove privileged resets from outsourced help desks.
• Issue FIDO2 keys or passkeys at onboarding for floor staff without company phones.
• Enforce phishing-resistant MFA and separate accounts for identity provider, hypervisor, backup and CMS admins.
• Require a second approver and an alert for identity provider federation and MFA policy changes.
• Give every gaming, cage and surveillance user an individual credential and model separation of duties in access requests.
• Drive leaver disablement from HR into every gaming system holding local accounts, within the regulator-approved period.
• Broker, document and record every vendor and manufacturer remote session.
• Protect player accounts with breached password checks, step-up before redemptions and photo ID for card replacement.
• Inventory service accounts and API keys for CMS, loyalty, payment and data feed integrations.
• Test the help desk with authorised social engineering calls at least annually.

Standards and references

• eCFR: 25 CFR 543.20 Minimum internal control standards for information technology
• Nevada Gaming Commission: Regulation 5.260 Cybersecurity
• CISA and FBI: Scattered Spider (AA23-320A)
• CISA: Implementing Phishing-Resistant MFA
• Gambling Commission: New age and identity verification rules
• NIST: SP 800-63B-4 Digital Identity Guidelines, Authentication and Authenticator Management
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Cybersecurity for Casinos and Gaming Guide · Account Recovery and Help Desk Security Guide · Scattered Spider Threat Actor Profile · Identity Provider and SSO Security Guide · Loyalty Points and Gift Card Fraud Guide