Scams to Avoid: Fake Bonus and Promo Codes

Why a free code is worth faking

Nobody is suspicious of a gift that asks for nothing. A bonus code arrives in a comment, a group, a video description or a page built to rank for 'free bonus code', and all you have to do is log in and type it. The login is the point. Either the page you log into is not the operator's, or the code is the reason you open a chat with someone who then asks for a one-time code to 'activate' it.

There is a second, quieter version where no fraud is involved at all: the code is real but attached to terms that make it expensive. The wagering requirement, the maximum bet while a bonus is active and the expiry date are what decide whether an offer is worth taking, and they are published by the operator — which is where to read them, rather than in the post that handed you the code.

The shapes it takes

Where real promotions live

• Inside your account, on the operator's own promotions page, after you logged in yourself.
• In the operator's own emails to the address you registered — read, not clicked.
• On the operator's own site, with terms linked from the same page as the offer.
• Nowhere else. Not in a comment, not in a group, not in a video description, not on a coupon aggregator.

If an offer only exists somewhere other than inside your account, the safest assumption is that it does not exist. Checking takes thirty seconds: open the app from your own icon and look at the promotions page.

One more habit worth forming: do not search for codes at all. The search itself is what creates the market — pages are built to rank for it, adverts are bought against it, and chat accounts monitor who is asking. An offer you did not go looking for and cannot find in your own account is not a missed opportunity.

Four companion setups

• The release fee. An 'approved' payout held back until you send a tax, clearance or courier charge to somebody's personal e-wallet. Genuine charges come out of the payout; nothing is ever paid in to let money out.
• The fake agent. An account you did not contact, carrying the brand's artwork, offering to hand you a bonus or unstick a withdrawal. Support that arrives unasked is not support.
• The cloned domain. A copy of the lobby one character away from the real address, often reached from an advert or a 'mirror' link. The login never reaches the operator.
• The recovery service. An offer to retrieve money you already lost for an upfront fee — the first fraud resold, often by the same group.

What a real verification request never asks

Genuine KYC happens inside your account and is triggered by a stage in that account, not by a message about a bonus: a government ID, sometimes a selfie taken in the app, sometimes proof of address.

• Your password: never requested, and useless to support in any case.
• A one-time code: never requested, in speech, in a chat or by forwarding a text.
• An e-wallet MPIN or a card's CVV: never requested.
• Remote-control or screen-sharing software: never requested.
• A payment, for verification or to unlock a bonus: never requested.
• A messaging app or SMS: never the channel. Verification that is due is already in your account.

One line disposes of almost every variant: nobody legitimate will ask you for a code they have just caused to be sent to you.

If you used a fake code page

1. Change the password on the gambling account first, then anywhere the same password was used — email and e-wallet above all.
2. Enable two-factor authentication wherever it is offered.
3. Log out other sessions and check for devices you do not recognise.
4. Check whether a payout destination or linked account changed, and whether any email forwarding rule appeared.
5. Screenshot the page or the chat before it is taken down.
6. If any money actually moved, report it fast through the help section inside your e-wallet's or bank's own app.
7. Expect a recovery offer afterwards and ignore it.

Where to report

1. The operator's support, in writing, opened from inside the account — with screenshots and references kept.
2. Your e-wallet or your bank, approached through the help section inside its own application.
3. PAGCOR's own published complaint route, in the contact and player-complaint sections of its website.
4. The PNP Anti-Cybercrime Group or the NBI Cybercrime Division, for fraud, using details published on their own sites.
5. The platform carrying it: report the post, the group, the video or the advert.

We describe channels instead of printing numbers deliberately — a number on a third-party page is the easiest link in this chain for a fraudster to replace with their own.

Where BINGOMAX stands

We are an independent guide: no games, no deposits, no balances, no access to your account and no power to release or speed a withdrawal. We do not issue bonus codes, we have no exclusive offers to hand out in chat, and anyone using this site's name to give you a code is not us.

This site has nothing to sell you — no tips, no predictors, no recovery service — and it publishes no installers and no mirrors. Gambling is a paid adult pastime, 21 and over.