Shuffle.us Closed My Account and Withheld $48,000 After a $10,000 Deposit (page 2)

The facts are all there and you defending them is so disappointing it makes me sad. This is shitty, they shouldn't be allowed to do this, and you're supposed to be here to stop them from getting away with it.

I understand that you strongly disagree with our position, and I’m sorry that you feel disappointed by the way this has turned out.

However, explaining the limits of what Casino Guru can verify is not the same as defending Shuffle. The complaint was reviewed based on the evidence available to the complaint team, including the information provided by the casino and the game provider. Your additional security timeline was also acknowledged, but it still does not allow us to independently establish who controlled the relevant session or who was responsible for the specific abnormal activity.

That kind of attribution would require a technical forensic investigation into a possible account takeover, which is unfortunately outside what we can determine through our complaint process.

I understand why you feel the facts are clear from your perspective, especially regarding the July 14 compromise report and the $10,000 deposit. But from Casino Guru’s side, the existing complaint decision remains the reference point. Continuing the same argument here on the forum will not change that decision.

If you believe a crime occurred or that Shuffle failed to act properly after being notified of a compromised account, the appropriate next step would be to pursue the matter with the relevant authorities or qualified legal support, as they may be able to request and assess technical records in a way we cannot.

Here's the thing... this can be viewed in a much narrower scope... Shuffle claims that the account owner is responsible for any and all action that is made on their account regardless of unauthorized activity. Unless, the account owner reports unauthorized activity to Shuffle first. Which is exactly the case here. I reported the account compromise prior to disputed activity. I did everything I was told to do but Shuffle failed to secure account. The liability is on Shuffle.

How did Shuffle react when I told them of compromised account? did they respond by telling me to email them and then wait up to 24 hours; Change password and 2fa? KYC me excessively? Cut off access to chatroom? Cut off access to live support?...

Yeah, that's all the effort they put in.

I complied with every suggestion, advice, and guidance they gave me.

Did that secure the account? Absolutely not!

I even asked them if there was anything else I could do to be proactive in securing my account. I was met with a message revoking my access to live support and was told to correspond via email.

Were my emails answered?... No! The only response I was given was by an automated, generic message saying they would get back to me when they can.

Did anyone from Shuffle take the time to assess possible vulnerabilities or insecurities that might remain on account... no, no they did NOT. If only I had been told about account sessions, and how despite password and 2fa changes, accounts that have been previously logged in remain logged in unless you kick/ end the session.

That is essential when securing a compromised account!

Their procedural response failed on multiple standard security principles:

1. Session Invalidation Failure: Standard authentication protocol requires that changing a password or rotating 2FA must programmatically terminate all existing JSON Web Tokens (JWTs) and active sessions. Leaving open sessions alive after an reported breach renders credential changes useless.

1. Deliberate De-escalation into a Void: Cutting off live chat access and routing an active, time-sensitive compromise to a slow email ticketing queue stripped me of the ability to take emergency action while leaving the unauthorized party free reign.

They cannot invoke platform terms to shield themselves from their own failure to execute basic account containment after receiving explicit, prior notice.

This whole situation comes down to a major failure in Shuffle security, procedures, and lack of respect for players & their money. Shuffle didn't loose anything here, in fact they scored $10k.

I think we’re starting to go in circles around the same points, so it may be better to take the matter further to an appropriate higher authority that could potentially help you.

Unfortunately, there isn’t much more we can do from our side, and based on what Michal has already explained, our position on the case isn’t going to change.

So if you still believe the matter is worth pursuing, I think the best option now is to continue with it through other available channels.

I'm not sure where the disconnect is. The original problem evolved into something quite complicated but can be broken down to some basics on how shuffle handled an account getting compromised.

Did Shuffle act in the players' best interest to protect their funds? Did they contradict their own terms of service by placing the all responsibility on the player despite the player notifying Shuffle of a compromise? Was confiscating players funds and closing the account justified? Who was liable?

Why are you not seeking answers from Shuffle about this? How is this out of your scope?

Because Michal has already found everything that was needed for us to assess the case.

As I mentioned, you can still take the matter to the relevant authority, and I’d actually be interested to see what their view on the situation is.