Two-Factor Authentication (2FA): Step-by-Step Setup

Two-factor authentication adds a second layer of security to your account. Even if your password is compromised, your account cannot be accessed without the second factor. We use the TOTP method (Time-based One-Time Password, RFC 6238): an algorithm generates a new 6-digit code on your device every 30 seconds.

What happens if you lose your phone? Without your phone and without backup codes, account access is blocked. Backup codes are one-time passwords — each code works exactly once. We provide several such codes during 2FA setup. Keep them stored separately from your phone. If you have neither your phone nor backup codes, you will need to verify your identity through our support process (KYC documents + manual review). This process typically takes several business days.

TOTP time window: TOTP codes are valid for exactly 30 seconds. For tolerance reasons, our system also accepts the immediately preceding and immediately following code — this corresponds to a window of up to 90 seconds. If your device's system time is significantly off, codes will fail. Enable "Automatic time zone" on your device to avoid synchronization issues.

TOTP App Comparison: Google Authenticator vs. Authy vs. Microsoft Authenticator

Not all authenticator apps are equal. The following table shows the most relevant differences for players who take their account security seriously.

Our assessment: Authy offers the most robust protection against device loss through its combination of encrypted cloud backup and multi-device support. Google Authenticator has also been suitable for everyday use since the 2023 update. Microsoft Authenticator is primarily recommended for users already working within the Microsoft ecosystem.

Password Requirements and Management

Our system enforces minimum requirements when creating a password. A valid password must be at least 8 characters long, contain uppercase and lowercase letters, at least one digit, and at least one special character. Passwords are hashed server-side with a cryptographic salt — neither support staff nor system administrators can view your password in plain text.

Common mistakes we observe in support:

• Reusing a password that is already used with another service — if that service suffers a data breach, your account here is immediately at risk
• Passwords that contain personal information (date of birth, name, place of residence) — these are easy to guess through targeted attacks
• Passwords saved in the browser but not protected by a master password or biometrics

Password managers: We recommend using a password manager (e.g., Bitwarden, 1Password, or KeePassXC). These generate random, long passwords and store them encrypted. The security risk from password reuse is thereby reduced to zero. Bitwarden is open source and available for free.

Changing your password: Navigate to Account Settings → Security → Change Password. You will need your current password and — if 2FA is active — your current TOTP code. After a password change, all active sessions except the current one will be terminated.

Account Recovery: Decision Tree (7 Scenarios)

Use the following decision tree if you cannot access your account. Each path leads to a specific course of action.

Encryption and Data Protection

Transport encryption: All connections between your browser or app and our servers run over TLS 1.3. Older protocols (TLS 1.0, TLS 1.1, SSL 3.0) are disabled on our infrastructure. This means data transmitted between your device and our platform cannot be read in plain text by third parties on the network.

Data storage: Passwords are stored exclusively as salted cryptographic hashes. Payment data (card numbers, bank details) is not stored in plain text on our servers — we work with PCI-DSS-compliant payment service providers who handle the storage of sensitive payment information.

What data we collect: During Verde registration we collect your name, date of birth, home address, email address, and — as part of the KYC process — identity documents. Transaction data is stored for compliance and anti-money laundering purposes. The exact retention periods and your rights (access, deletion, portability) are documented in our privacy policy.

Cookies and tracking: We use session cookies for authentication. Analytical cookies can be disabled in account settings. We do not share personal data with third parties for advertising purposes.

KYC Verification: Process and Documents

KYC (Know Your Customer) is a legal requirement under anti-money laundering (AML) regulations. We are obligated to verify the identity of our players before processing withdrawals. The 50 free spins after account verification also require a completed verification.

What happens if documents are rejected? You will receive an email with the specific reason for rejection. You can resubmit corrected documents. There is no limit on the number of submission attempts as long as the documents are authentic. Withdrawals remain blocked until verification is complete.

Responsible Gambling and Self-Exclusion Tools

We offer our own gaming control tools. As we are not GGL-licensed, these tools are not mandated by the GGL — we provide them nonetheless, because uncontrolled gambling can cause serious harm.

Available tools (own platform):

• Deposit limits: Set daily, weekly, or monthly caps on deposits. Limits take effect immediately. Increases only become effective after a waiting period.
• Session limits: Limit the duration of individual gaming sessions.
• Self-exclusion: Block your account for a defined period or permanently. A self-exclusion cannot be lifted early.
• Reality check: Regular reminders of how long you have been playing.

If you notice signs of problem gambling, contact the BZgA: phone 0800-1372700 (free, 24/7) or check-dein-spiel.de. Further resources: spielsucht-therapie.de and anonyme-spieler.org.

Phishing and Fraud Prevention

How to recognize official Verde communications: We send emails exclusively from verified domains. Check the full sender address in every email — not just the display name. An email from "Verde Support <[email protected]>" is not official communication from us.

What Verde will NEVER do:

• We will never ask for your full password via email, SMS, or chat
• We will never ask you to share your 2FA code with anyone
• We will never ask you to install third-party software to access your account
• We do not send unsolicited attachments containing executable files
• We do not require advance payments for withdrawals

Typical fraud scenarios: Fake "Verde" websites with slightly altered domains (e.g., "verde-slots.de" instead of the official domain), social engineering calls where someone poses as a support agent, and phishing emails claiming your account has been blocked and requires immediate action.

How to verify the official site: Check the TLS certificate in your browser (padlock icon in the address bar). Click on it and verify which domain the certificate is issued to. Bookmark the official domain — never navigate to your account through search engine ads.

8-Point Security Checklist for Your Account

Run through this checklist once per quarter. Each point addresses a specific security risk.

Lockout scenario — what exactly happens: If you make 5 login attempts with the wrong password, the system automatically blocks your access for 30 minutes. You will receive an email notification about the lockout attempt. After 30 minutes, access is automatically restored — no support intervention required. If you want to lift the block immediately, use the "Forgot Password" function: setting a new password lifts the block right away.