Can You Withdraw Gambling Winnings After Using a VPN? What Terms, Regulators and Courts Say

Players who reach a betting or casino site through a virtual private network (VPN) often find out about the consequences at the cashier rather than at sign-up. The question of whether winnings can be withdrawn is settled less by technology than by three documents: the operator's terms, the licensing rules the operator answers to, and, when a dispute escalates, the courts.

Do betting sites allow VPNs?

Most offshore and licensed operators prohibit using a VPN to disguise location. Stake.com, operated by Curaçao-licensed Medium Rare N.V., is explicit. Clause 14.4 of its Terms of Service states: "The attempt to manipulate your real location through the use of VPN, proxy, or similar services or through the provision of incorrect or misleading information about your place of residence, with the intent to circumvent geo-blocking or jurisdiction restrictions, constitutes a breach of Clause 5 of this Terms of Service."

Clause 14.3 lists the "Prohibited Jurisdictions", including the United Kingdom, the United States, Australia, France, Spain, the Netherlands, Brazil and Ontario, and adds that the restriction "applies equally to residents and citizens of other nations while located in a Prohibited Jurisdiction".

The same terms say the operator may look for such techniques, including "examination of Players device properties, detection of geo-location and IP masking, transactions and blockchain analysis" (clause 5.1(g)).

What happens to winnings if a VPN is detected?

The consequence in Stake's terms is not limited to account closure. Clause 5.2 says that on a breach of the clause 5.1 warranties the operator may "close or suspend Your Stake account at its own discretion and void any bets to the extent applicable by law". Clause 4.21 goes further for suspended or closed accounts: Stake may "void any bets placed by You following such actions by You or to withhold and/or retain any and all amounts which would otherwise have been paid or payable to you (including any winnings) to the extent permitted by law."

The phrase "to the extent permitted by law" matters. It means the outcome depends on the law that applies to the player, not on the clause alone, a point taken up below.

Why withdrawals are where the check happens

Many sites let a customer deposit and play with light checks but verify identity before paying out. Stake's clause 4.8 reserves the right "to ask for any KYC documentation it deems necessary to determine the identity and location of a Player" and to "restrict the Service, payment or withdrawal until identity is sufficiently determined". Clause 8.2 allows it to "delay or decline further deposits, withdrawals and/or game play" during an investigation and notes the operator "may not be in a position to provide an explanation".

A passport, bank account or crypto transaction history that points to a different country from the IP address used to play is the kind of mismatch these checks are built to find. Licensed markets handle identity checks differently; AskSpinner has explained why Philippine online casinos ask for KYC verification.

How licensed markets enforce location

In regulated US markets the location check is a legal requirement, not a house rule. New Jersey's regulation N.J.A.C. 13:69O-1.2(e) requires an internet gaming system to "detect the physical location of a patron upon logging into the gaming system and as frequently as specified in the Internet gaming permit holder's approved submission". If the patron is outside an authorised area, "the system shall not accept wagers until such time that the patron is in an authorized location." The same chapter requires operators' terms to include a "prohibition from engaging in Internet or mobile wagering activity, unless they are physically present in New Jersey". The state also sets other player-protection duties for online operators, such as its mandatory responsible gaming triggers.

In Great Britain, licence condition 17.1.1 of the Gambling Commission's Licence Conditions and Codes of Practice says: "Licensees must obtain and verify information in order to establish the identity of a customer before that customer is permitted to gamble. Information must include, but is not restricted to, the customer's name, address and date of birth." It adds that a withdrawal request "must not result in a requirement for additional information to be supplied as a condition of withdrawal if the licensee could have reasonably requested that information earlier." That protection applies to customers of British-licensed operators. It does not reach a site that is not licensed in Great Britain and is used by a customer in Britain who has hidden their location. (Source: Gambling Commission, LCCP 17.1.1)

What courts have said about VPN use

Two published rulings show how VPN use and location evidence have counted against players.

Curaçao, 2025. In ECLI:NL:OGEAC:2025:295 (Court of First Instance of Curaçao, judgment of June 9, 2025, published Jan. 28, 2026), a player sued Medium Rare N.V. over losses at Stake. The court found the player had knowingly given false information to appear resident in India while playing from the United Kingdom and "made use of a VPN connection which made it impossible to trace where he was" (court's Dutch, translated). It held that Stake could, in those circumstances, rely on the information it had been given. The claim was dismissed and the player was ordered to pay costs.

Germany, 2024. In a judgment of Aug. 8, 2024 (case 29 O 13516/23), the Munich I Regional Court dismissed a player's claim to recover €24,747.52 in losses from a Malta-based operator. Claims of this kind depend on the player showing the stakes were placed from Germany. The operator produced login data showing sessions from Bosnia and Herzegovina and said the player had also played from Spain; the court found the player had not proved where the play took place.

Neither case is about a withdrawal refused over a VPN as such. Both show that once location is in dispute, the burden tends to fall on the player, and VPN use weakens the player's own evidence.

Can a player challenge a withheld withdrawal?

Licensed operators must offer a complaints route. In Great Britain, operators must appoint an approved alternative dispute resolution (ADR) body. The Gambling Commission lists eCOGRA as an approved ADR entity whose outcome is "non-binding", and IBAS states that the Commission requires businesses to follow its rulings up to £10,000. eCOGRA says its remit covers "account management" and "misleading terms and conditions" and that a complaint must first go through the operator's internal procedure.

Stake's terms route disputes to CADRE B.V., an ADR entity certified by the Curaçao Gaming Authority, after the operator's final decision, with the courts of Curaçao named as the forum (clauses 23 and 25).

A player who reached a site from a country it does not serve is usually outside that country's regulator's protection. The site is not licensed there, so the local regulator has no complaint process for it. Location controls are also being enforced from the other side, as when India withheld Polymarket's official social media profile in the country.

What a VPN does not change

A VPN changes the IP address a site sees. It does not change the player's legal location, the documents that will be requested at withdrawal, the payment trail, or the terms the player accepted. Where an operator's terms treat location masking as a breach, those terms give it grounds to void bets and hold funds. Whether the operator can keep the money in a particular case depends on the applicable law and on how a court or ADR body reads the clause.

If you hold rights to images used in this article and have concerns, please contact us at support@askspinner.com.