SkyHills Casino — Secure Login and Account Management

SkyHills login: access and security

SkyHills Casino — established in 2024 — protects every login session with multiple layers of security. This page not only documents how to log in, but also explains the technical mechanisms that protect your account: from TOTP-based two-factor authentication to session management and SIM-swap protection.

After logging in, you have access to your player account, your deposit and withdrawal management, your bonus balance (including the welcome bonus of 200% up to €1,500), your transaction history, and our responsible gambling tools. Security starts at the login page — read this guide in full before starting your first session.

Step-by-step guide to logging in to SkyHills

Step 1: Go to the official SkyHills website

Open your browser and navigate to skyhillscaasino.com. Always check the address bar: the padlock icon (HTTPS) must be visible and the domain must match exactly. Never click a login link from an email you did not request yourself — more on this in the phishing section.

The login button is located in the top right corner of the navigation bar. On mobile browsers, it appears as a button labeled "Log In" or as a person icon, depending on your screen resolution.

Step 2: Enter your login credentials

Enter the email address you provided during registration, followed by your password. Our system is case-sensitive for passwords. If you use a password manager (recommended), make sure it recognizes the exact domain skyhillscaasino.com — a different domain in the autofill is a direct indicator of a phishing site.

Only check "Remember me" on a personal device that you do not share. On a shared or public computer: never check this option.

Step 3: Two-factor authentication

If you have enabled 2FA — which we strongly recommend — a second input field will appear after entering your password. Here you enter the 6-digit TOTP code generated by your authenticator app. This code is valid for 30 seconds. If the timer is almost at zero, wait for the next code to avoid input errors.

The complete 2FA setup procedure is described in the 2FA setup guide below.

Step 4: Access your account

After successful verification, you will land on your account dashboard. You can see your current balance, active bonuses, recent transactions, and shortcuts to the game lobby and sportsbook. At the start of each new session, briefly check whether any unfamiliar activity is visible in your transaction history.

Two-factor authentication: complete setup guide

Two-factor authentication (2FA) adds a second verification layer that is independent of your password. Even if your password is exposed in a data breach elsewhere, an attacker cannot log in without physical access to your authenticator device. We support TOTP (Time-based One-Time Password) in accordance with RFC 6238.

What you need

A smartphone with a TOTP authenticator app. The most commonly used options are Google Authenticator, Authy, and Microsoft Authenticator — see the comparison table for a detailed overview. No special hardware is required.

Step 1: Open your account settings

Log in to your account and navigate to Account → Security → Two-factor authentication. Click "Enable 2FA". The system generates a unique QR code and a corresponding secret key in text format.

Step 2: Install an authenticator app

Download one of the supported authenticator apps from the official app store on your device (Google Play Store or Apple App Store). Check the app's publisher: Google Authenticator is published by Google LLC, Authy by Twilio Inc., and Microsoft Authenticator by Microsoft Corporation. Apps from unknown publishers with similar names are potentially malicious.

Step 3: Scan the QR code

Open the authenticator app and choose "Add account" or the plus sign. Select "Scan QR code" and point the camera at the QR code on your screen. The app immediately registers the secret key and starts generating 6-digit codes that expire every 30 seconds.

Step 4: Verify the connection

After the app has scanned the QR code, enter the current 6-digit code in the verification field on the website. Click "Confirm". The system validates whether the code matches the generated key. Only after successful verification is 2FA actually active on your account.

Step 5: Save your backup codes

After activation, our system generates a set of backup codes. Each backup code can be used once as a replacement for a TOTP code — for example, if you've lost your phone. Print these codes or store them in an encrypted password manager. Never save them as a screenshot on your phone itself, because if your phone is compromised, the codes will be immediately available to the attacker.

What to do if you lose your phone

Scenario A: You have backup codes. Use one code to log in, go directly to account settings, and link a new authenticator app. Then generate a new set of backup codes.

Scenario B: You have no backup codes and no access to the secret key. Contact our support team. There is no faster route — this is a security measure, not a shortcoming.

TOTP: how it works technically

A TOTP code is calculated as: HOTP(K, T) where K is the shared secret key and T is the number of elapsed 30-second intervals since the Unix Epoch (January 1, 1970 00:00:00 UTC). The result is a 6-digit number. Both the server and the authenticator app independently calculate the same value based on the same clock. Time differences of up to ±1 interval (30 seconds) are accepted to compensate for minor clock discrepancies.

TOTP app comparison: which authenticator is right for you

The choice of authenticator app has a direct impact on how easily you can restore access after losing a device. The table below compares the three most commonly used options based on security and recovery criteria.

Our recommendation: If easy recovery after device loss is important to you, Authy is the most robust choice due to its encrypted cloud backup and multi-device support. If you prefer not to use cloud backup, choose Google Authenticator and store the secret keys yourself offline.

Mobile login at SkyHills Casino

SkyHills Casino does not offer a native iOS or Android app. All mobile functionality is available through the mobile website at skyhillscaasino.com, which is fully optimized for smartphones and tablets. More information about the mobile experience can be found on our mobile page.

Open your mobile browser (Safari on iOS, Chrome or Firefox on Android) and navigate to the official domain. Add the page to your home screen via "Add to Home Screen" — this creates a shortcut that behaves like an app, but always loads the live website. When creating the shortcut, verify that the URL is correct.

Remember me on mobile

The "Remember me" option stores an encrypted session cookie in your browser. On a personal device with a screen lock, this is acceptable. On a shared device or a phone without a PIN or biometric lock: do not use this option.

Browser recommendations for mobile

Safari (iOS 16+) and Chrome (Android 10+) support all security features of our login page, including WebAuthn for biometric verification. Outdated browsers may experience compatibility issues with the 2FA input field. Keep your browser up to date.

Biometric login: fingerprint and facial recognition

Biometric login options are available through WebAuthn support in modern mobile browsers. Your biometric data never leaves your device — verification takes place entirely locally on your phone. Our system only receives a cryptographic proof that the verification was successful.

Android: setting up fingerprint verification

Requirements: Android 10 or higher, Chrome 89 or higher, fingerprint configured in device settings.

1. Log in once with email, password, and 2FA code.
2. After logging in, go to Account → Security → Biometric login.
3. Click "Add device". Chrome will request permission to create a WebAuthn credential.
4. Confirm with your fingerprint or screen lock code.
5. For future login sessions: enter your email address, click "Log in with biometrics," and confirm with your fingerprint.

The path in Android settings for fingerprint management: Settings → Security → Biometrics → Fingerprints. The exact path may vary by manufacturer (Samsung, Google Pixel, OnePlus).

iOS: setting up Face ID

Requirements: iOS 16 or higher, Safari 16 or higher, Face ID configured on the device.

1. Log in once with email, password, and 2FA code via Safari.
2. Navigate to Account → Security → Biometric login.
3. Click "Add device". Safari will display a system prompt: "Would you like to create a passkey for skyhillscaasino.com?"
4. Confirm with Face ID or Touch ID.
5. For future sessions, select the biometric login option and confirm with Face ID.

Manage Face ID settings via: Settings → Face ID & Passcode. Make sure "Other Apps" is enabled for Safari integration.

Biometrics and 2FA: the combination

Biometric verification via WebAuthn replaces both the password and the 2FA step — it is a so-called "multi-factor credential" that combines possession of the device (something you have) with biometrics (something you are). If you enable biometrics, a separate 2FA input is no longer required for that session. When logging in on a new device, the standard email + password + 2FA is required.

Overview of login methods at SkyHills

Can't access your account? Follow this decision tree

Use the scenarios below to find the right recovery path. Start with the scenario that best describes your situation.

Scenario 1: Forgot your password

1. Click "Forgot your password?" on the login page.
2. Enter the email address linked to your account.
3. You will receive a recovery email within 5 minutes. Also check your spam folder.
4. Click the link in the email — it is valid for 60 minutes.
5. Set a new password that meets the password requirements.

If the email hasn't arrived after 5 minutes: check whether you entered the correct email address. Try the address you may have used during registration. If you no longer remember your email address, see Scenario 7.

Scenario 2: Account locked after multiple failed attempts

After 5 consecutive failed login attempts, your account is temporarily locked. The lock lasts 30 minutes and lifts automatically. You will receive an email notification when your account is locked.

If the lock has not been lifted after 30 minutes, or if you suspect someone else made the attempts: change your password immediately and enable 2FA. Contact our support team if you have any indication of unauthorized access attempts.

Scenario 3: 2FA device lost or replaced

If you have backup codes: Use one backup code on the 2FA input page. Log in, go to Account → Security, and link a new authenticator app. Then generate new backup codes.

If you have no backup codes: Contact our support team. You will need to verify your identity via KYC documents (valid ID + selfie). Expected processing time: 1–3 business days. During this process, your account is secured and cannot be logged into.

Scenario 4: New phone, 2FA app not transferred

If you knew in advance you were switching phones and used Authy: restore via the Authy cloud backup on your new device. If you used Google Authenticator without a backup: follow the recovery process from Scenario 3 (no backup codes). Preventive advice: export your accounts in Google Authenticator via "Export accounts" before switching devices.

Scenario 5: Account hacked or compromised

1. Try logging in immediately and change your password if you still can.
2. Enable 2FA immediately if it was not already active.
3. Check your transaction history for unauthorized activity.
4. Contact our support team immediately — include the time of discovery and any suspicious transactions.
5. Also change the password of the email address linked to your account.

Our support team can freeze your account immediately while the investigation is underway. Provide as many details as possible about the suspicious activity.

Scenario 6: Session expired

Sessions expire after a period of inactivity as a security measure. You will be redirected to the login page. Log in again using your usual method. If you were in the middle of a game round: your balance and bonus progress are preserved. Active game rounds interrupted by a session expiry are handled in accordance with our game rules.

Scenario 7: Wrong email address or email address no longer in use

Contact our support team. Provide: your username (if known), date of birth, country of registration, and the email address you believe you used. Identity verification via KYC is required. Processing time: 2–5 business days.

Scenario 8: Browser issues (cookies, cache, extensions)

Some browser configurations block the session cookies required for login. Check the following:

1. Make sure cookies are enabled for skyhillscaasino.com.
2. Temporarily disable ad blockers or privacy extensions.
3. Clear browser cache and cookies for the domain (not all cookies).
4. Try a private/incognito window — if that works, the issue is with an extension.

Scenario 9: VPN or proxy connection blocked

Our system may block login attempts via known VPN or proxy servers as a security measure against account takeover. Disable your VPN and try logging in again via your regular internet connection. If you use a VPN for privacy reasons, contact our support team for a tailored solution.

Scenario 10: Country restriction

Access to our platform is restricted in certain jurisdictions. If you see a message stating that your region is not supported, your account may be restricted based on your current location or IP address. Contact our support team for information about the specific restriction.

Scenario 11: Self-exclusion active

If you have requested a self-exclusion through our own responsible gambling tools, logging in is blocked for the duration of the exclusion period. This is a deliberate security measure: the exclusion cannot be bypassed by contacting support. Wait until the period has elapsed, or contact us if you wish to extend the exclusion.

We are not affiliated with CRUKS. See the responsible gambling section for more information about our own tools and external resources.

Scenario 12: Account deactivated or closed

Accounts may be closed due to: violation of terms of use, incomplete KYC verification after a certain period, or at the player's own request. Contact our support team for the specific reason and reactivation options. Not all cases are eligible for reactivation.

Securing your SkyHills account

Password management

Use a unique password that is used exclusively for your SkyHills account. Passwords that you also use with other services pose a risk: if that service experiences a data breach, attackers may attempt to use the same password at other platforms via "credential stuffing."

A password manager (such as Bitwarden, 1Password, or KeePass) generates and stores strong, unique passwords for each service. You only need to remember one master password. Bitwarden is open source and free; 1Password offers extensive features for a subscription fee; KeePass stores data locally without a cloud service.

Responsible gambling and self-exclusion

We offer our own responsible gambling tools, including deposit limits, session limits, and self-exclusion. These are accessible via Account → Responsible Gambling. A self-exclusion through our own tools blocks login for the chosen period.

Help with gambling problems

If you find that gambling is having a negative impact on your life, there are specialized organizations that offer free support:

• AGOG (Anonymous Gamblers Support Environment): agog.nl
• Jellinek: jellinek.nl — phone: 0900-1090
• Loket Kansspel: loketkansspel.nl

Logging out on shared devices

Always log out explicitly using the "Log Out" button when using a shared device. Then close the browser window as well. Clear your browsing history and cookies if necessary. An active session cookie on a shared device gives anyone who uses the device afterwards direct access to your account.

SIM-swap protection and session management

What is a SIM-swap attack?

In a SIM-swap attack, an attacker convinces your mobile carrier to transfer your phone number to a SIM card controlled by the attacker. The attacker can then intercept SMS messages sent to your number — including SMS-based verification codes.

Why we do not offer SMS-based 2FA

Our 2FA system is based exclusively on TOTP (authenticator apps), not SMS codes. TOTP is inherently protected against SIM-swap attacks because the codes are generated based on a secret key stored on your device — not via your phone number. An attacker who has taken over your phone number cannot generate TOTP codes without also having physical access to your authenticator device.

Session management: monitoring active sessions

Via Account → Security → Active sessions, you can see an overview of all devices and browsers from which you are currently logged in. For each session you can see: the device type, browser, location (based on IP), and the time of last activity. If you see a session you did not start yourself: end it immediately via "End session" and change your password right away.

Automatic session expiry

Sessions expire automatically after a set period of inactivity. This is a security measure that prevents forgotten active sessions from becoming an access risk. The exact duration depends on your device and browser settings. On mobile browsers, sessions may remain active longer due to the use of "Remember me" cookies.

IP anomaly detection

Our system monitors login locations. If you log in from an IP address that significantly differs from your usual location — for example, a different country — an additional verification step may be required. This is not an error message but a security check. Confirm your identity using the requested method.

Security audit: 8-point checklist for your account

Perform this check when creating your account and repeat it every 3 months. Each item has a priority level: Critical (immediate action required), High (within 24 hours), Medium (within one week).