Most Secure Online Casino Canada 2026: Licensed Sites, Fast Payouts & Safe Banking

Security at Canadian online casinos breaks down into three things: who regulates the operator, how they protect your money in transit, and whether they'll actually pay you. Everything else is marketing. A casino can plaster badges across its footer and still route withdrawals through a shell company in a jurisdiction with no enforcement mechanism. The gap between a licence and operational integrity is where players lose money, and closing that gap requires looking past the seal to the regulator behind it, the encryption standard on payments, and the withdrawal track record you can verify.

Canada's regulatory landscape split hard in 2022 when Ontario launched iGaming Ontario (iGO), creating the country's first private competitive market under strict provincial oversight. Alberta followed on July 13, 2026, with 22 operators live on launch day. Everywhere else, you're either playing at a provincial lottery site or an offshore casino licensed in Malta, Curaçao, or Kahnawake. That's not illegal for the player, but it does shift the burden of due diligence entirely onto you.

This guide ranks the most secure online casinos serving Canadians in 2026, evaluating licensing authority, payment security, withdrawal reliability, and the operational red flags that separate a trustworthy platform from one that'll ghost you at cash-out. No fluff. Just the framework you need to separate real security from a polished landing page.

Top 10 Most Secure Online Casinos for Canadian Players

These operators earned their ranking through verifiable licensing, consistent payout performance, and robust technical security. Each has processed thousands of Canadian withdrawals without the pattern failures that flag systemic risk—delayed KYC requests timed to withdrawal attempts, sudden term changes, or opaque dispute resolution. The list includes both iGO-licensed operators and internationally licensed sites with multi-year Canadian track records.

BetMGM Ontario runs under iGaming Ontario's framework, which means quarterly financial audits, segregated player funds, and direct recourse through the Alcohol and Gaming Commission of Ontario (AGCO) if something goes wrong. Interac e-Transfer withdrawals clear in 6–12 hours. The platform uses 128-bit SSL across all endpoints and requires two-factor authentication on cash-outs above $500. Game RTP is published per title, not as a site average, which is transparent enough to be unusual.

Jackpot City operates offshore under a Malta Gaming Authority (MGA) licence, but it's been serving Canadians since 1998—long enough that any structural issues would've surfaced by now. Withdrawals via Interac land in 12–24 hours after KYC clears, and the support team doesn't play games with document requests. MGA oversight is strict: operators must hold player funds in segregated accounts and maintain a minimum capital reserve. It's not Ontario-level oversight, but it's enforceable.

PlayOJO stands out for ditching wagering requirements entirely, which eliminates the most common source of casino disputes. Licensed in Malta and Ontario, it clears Interac payouts in under 24 hours and doesn't cap withdrawals artificially. The "no bonus fine print" approach means fewer edge cases where the casino can cite a buried term to void your balance.

bet365 Casino leverages the parent company's sportsbook infrastructure, which has been handling high-volume Canadian transactions since 2010. Licensed in Ontario and Malta, it processes Interac withdrawals in 12–24 hours and has never missed a publicly documented payout. The KYC process is front-loaded—verify once at signup, not when you try to withdraw.

LeoVegas Ontario runs on iGO's registry with a clean compliance record since market launch. Payouts via Interac clear same-day if you request before 2 PM ET, and the mobile app uses biometric authentication on supported devices. RTP data is published quarterly, and game fairness testing is handled by eCOGRA, an independent third party with teeth.

Spin Casino holds a Kahnawake Gaming Commission licence, which sits in a grey zone—technically a Canadian regulator, but self-governed by the Mohawk Territory with limited external oversight. That said, Spin has operated cleanly since 2001, and Kahnawake's reputation depends on operators not defrauding players. Interac withdrawals process in 24–48 hours, and the casino uses Microgaming's Viper platform, which has a 20-year security track record.

Royal Vegas Casino runs under MGA licensing with a focus on mid-stakes players. Security protocols include mandatory session timeouts after 60 minutes of inactivity and automatic flags on deposit patterns that match problem gambling behaviour. Withdrawals via Interac take 24–48 hours, and the platform has never been breached in 23 years of operation.

Ruby Fortune is another MGA-licensed veteran (launched 2003) with a Microgaming backbone. The platform uses tokenized payment processing, meaning your bank details never touch the casino's servers—they're stored with the payment processor under PCI-DSS Level 1 compliance. Interac withdrawals clear in 24–48 hours, and customer support is staffed 24/7 with live chat response times under two minutes.

888 Casino Ontario operates under iGO with one of the fastest KYC pipelines in the province: document approval typically completes in under two hours during business days. Interac payouts land in 6–12 hours. The casino uses geofencing to block access outside Ontario, which is an extra compliance layer but also proof they're not cutting corners on regulatory requirements.

Casumo holds dual MGA and Ontario licensing and differentiates on withdrawal speed—Interac e-Transfers often clear within four hours, even on weekends. The platform's "adventure" gamification layer is divisive, but the security stack is solid: 256-bit TLS, device fingerprinting to prevent account takeovers, and a mandatory cooling-off period if you reverse a withdrawal request.

Security Comparison: Licensing, Payouts & Banking

Casino	Primary Licence	Interac Withdrawal Speed	Min. Deposit	Welcome Bonus	Security Standout
BetMGM Ontario	iGaming Ontario	6–12 hours	$10	100% match up to $1,000	Quarterly financial audits
Jackpot City	Malta Gaming Authority	12–24 hours	$10	Welcome package up to $1,600	25-year operational track record
PlayOJO	MGA / iGO dual	Under 24 hours	$10	50 wager-free spins	No wagering requirements
bet365 Casino	iGO / MGA	12–24 hours	$10	100% up to $1,000	Front-loaded KYC at signup
LeoVegas Ontario	iGaming Ontario	Same-day (before 2 PM ET)	$10	100% match + 50 spins	Quarterly RTP reporting
Spin Casino	Kahnawake Gaming Commission	24–48 hours	$10	Up to $1,000 welcome package	20+ years on Microgaming platform
Royal Vegas	Malta Gaming Authority	24–48 hours	$10	Welcome package up to $1,200	Mandatory session timeouts
Ruby Fortune	MGA	24–48 hours	$10	Welcome bonus up to $750	Tokenized payment processing
888 Casino Ontario	iGaming Ontario	6–12 hours	$10	100% up to $1,000	Sub-2-hour KYC approval
Casumo	MGA / iGO	4–6 hours	$10	Welcome offer up to $1,500	Device fingerprinting

How Casino Licensing Works in Canada

There is no federal online gambling licence in Canada. The Criminal Code hands regulation to the provinces, and each province either runs its own lottery-operated site or—since 2022 in Ontario and 2026 in Alberta—licenses private operators under a regulated framework. Everywhere else, provincial law allows residents to play at offshore casinos, provided the operator doesn't have a physical presence in that province.

That's the legal backdrop. Security-wise, it creates a two-tier system.

Tier one: iGaming Ontario and Alberta's regulated market. Both provinces require operators to register with a provincial gaming authority (AGCO in Ontario, AGLC in Alberta), submit to quarterly audits, maintain segregated player accounts, and comply with responsible gambling standards set by provincial law. If a casino breaches terms or fails to pay, you can escalate to the regulator, and that regulator has enforcement power. As of September 2026, 84 gaming sites run by 49 operators are live in Ontario; Alberta had 22 on launch day and has since grown to 31.

Tier two: offshore licensing. Casinos serving Canadians outside Ontario and Alberta typically hold licenses from Malta (MGA), Curaçao, Gibraltar, or Kahnawake. These are legitimate regulatory bodies, but enforcement becomes a cross-border issue if something goes wrong. MGA is the strongest of the offshore group—operators must post bonds, undergo annual audits, and demonstrate financial reserves. Curaçao is the loosest: a single master licence can be sub-licensed to dozens of operators, and dispute resolution is slow. Kahnawake sits somewhere in the middle—strong for a First Nations regulator, but limited by jurisdictional reach.

One wrinkle: Ontario-licensed casinos cannot accept cryptocurrency. Provincial regulation requires all wagers and payouts in CAD, routed through licensed payment processors. If crypto flexibility matters, you're looking at offshore options.

Payment Security: Interac, Crypto & Bank Transfers

Your banking method is your first line of defence. The casino never sees your card number or bank credentials if you use Interac e-Transfer, because the transaction is authenticated through your own banking app and completed via the Interac network. The casino receives a notification that funds have cleared, nothing more. That's why Interac is the dominant deposit and withdrawal method among Canadian players—over 27 million Canadians use it daily, and it's built into every major bank's infrastructure.

Deposits via Interac land instantly. Withdrawals take longer—not because of Interac, but because casinos batch payment requests and impose internal processing windows. The fastest operators (Casumo, LeoVegas) clear requests in 4–12 hours. The slowest stretch it to 48–72 hours, often citing "security checks" that are really just cash-flow management. If a casino consistently delays Interac withdrawals beyond 48 hours, that's a red flag.

Cryptocurrency—Bitcoin, Ethereum, Litecoin—offers speed and pseudonymity, but only at offshore casinos. Deposits confirm within minutes once the blockchain processes the transaction (10 minutes for Bitcoin, under a minute for Litecoin). Withdrawals are just as fast, assuming the casino doesn't hold the request for internal review. The security trade-off: if you send crypto to the wrong wallet address, there's no reversal mechanism. And if the casino folds or exit-scams, you have zero recourse through the blockchain. Use crypto at casinos with multi-year track records and verified licensing.

Credit and debit cards (Visa, Mastercard) are still common for deposits, but many Canadian banks block gambling transactions at the card-network level. Even when they go through, you're handing the casino your card details, which introduces risk if the platform suffers a data breach. Reputable casinos never store full card numbers—they tokenize via PCI-DSS Level 1 processors—but not all operators are reputable.

Bank transfers (EFT, wire) are secure but slow: 3–5 business days in each direction. They're typically reserved for high-stakes withdrawals above $5,000, where Interac's per-transaction limits become a bottleneck.

Withdrawal Speed as a Security Indicator

Fast payouts aren't just convenient—they're a proxy for financial health. A casino that processes Interac withdrawals in under 12 hours has automated workflows, sufficient cash reserves, and no liquidity issues. A casino that stalls for 5–7 days, requests redundant documents after you've already verified, or suddenly imposes withdrawal caps is either operationally incompetent or deliberately slow-rolling you.

Here's the pattern to watch: you request a withdrawal on Monday. The casino emails Tuesday asking for proof of address. You submit. Wednesday, they want a bank statement. You submit. Thursday, they ask for a selfie holding your ID. At this point, you're not dealing with compliance—you're dealing with a casino that's trying to frustrate you into reversing the withdrawal and playing the balance back down.

Legitimate operators front-load KYC. You verify your identity and address when you sign up, or at latest, before your first withdrawal. Once verified, subsequent cash-outs are frictionless. iGaming Ontario mandates this: casinos must complete KYC within 24 hours of receiving complete documentation, and they can't hold withdrawals longer than 5 business days unless there's documented evidence of fraud or bonus abuse.

Encryption, Data Protection & Technical Infrastructure

Every secure online casino uses SSL/TLS encryption to protect data in transit—that's the padlock icon in your browser bar. The standard is 128-bit or 256-bit encryption, which is strong enough that brute-forcing it would take longer than the heat death of the universe. If a casino's site loads without HTTPS, leave immediately.

But encryption only protects data moving between your device and the casino's server. What happens to your data once it's stored on their infrastructure? That's where PCI-DSS (Payment Card Industry Data Security Standard) and GDPR (General Data Protection Regulation, required for MGA-licensed operators) come into play. PCI-DSS Level 1 is the highest tier, mandatory for any business processing more than 6 million card transactions annually. It requires encrypted databases, restricted access controls, regular penetration testing, and immediate breach disclosure.

Casinos serving Canadians must also comply with PIPEDA (Personal Information Protection and Electronic Documents Act), which governs how private-sector organizations collect, use, and disclose personal information. In practice, this means clear privacy policies, the right to request deletion of your data, and a legal obligation to notify you if your information is compromised in a breach. iGaming Ontario and Alberta go further, requiring operators to store Canadian player data on servers physically located in Canada.

Two-factor authentication (2FA) should be standard on your account, especially for withdrawals. The best casinos mandate it; the mediocre ones offer it as an option; the sketchy ones don't support it at all. If 2FA isn't available, use a unique password for that casino—generated by a password manager, at least 16 characters, never reused from another site.

Game Fairness: RNG, RTP & Third-Party Testing

A secure casino doesn't just protect your money—it ensures the games aren't rigged. Every legitimate online slot, table game, and RNG-based live game runs on a certified random number generator, tested by an independent auditor like eCOGRA, iTech Labs, or Gaming Laboratories International (GLI). These labs run millions of simulated spins to verify that outcomes are statistically random and match the game's published RTP (return to player).

RTP is the percentage of all wagered money a game returns to players over time. A slot with 96% RTP will, on average, pay back $96 for every $100 wagered—but that average is calculated over millions of spins, not your personal session. Casinos don't need to rig the RTP; the house edge is already baked in. What you're verifying is that the stated RTP is accurate and that the RNG isn't weighted to produce cold streaks during withdrawal-pending periods (a tactic some rogue operators have been caught using).

Check for two things: the testing lab's logo in the casino footer (eCOGRA, iTech, GLI), and publicly available RTP reports. iGaming Ontario publishes aggregated RTP data quarterly. MGA-licensed casinos are required to display per-game RTP in the game info screen. If a casino won't disclose RTP or claims "we don't have access to that data," they're either lying or using unlicensed pirated software.

Red Flags: When a "Secure" Casino Isn't

Some warning signs disqualify a casino outright, regardless of what licence badge they display.

Cloned or pirated games. If you recognize a NetEnt or Microgaming slot but the game info screen shows a different provider, you're playing a pirated copy with an altered RNG. Licensed game providers will not supply software to unlicensed casinos; if the casino is running popular titles without deals in place, those games are hacked clones.

No visible licence number. Every legitimate licence comes with a registration number you can verify on the regulator's public database. MGA publishes a searchable registry; so does iGaming Ontario. Curaçao is murkier—some sub-licensors don't maintain public directories—but the master licence holder (Antillephone N.V., Gaming Curacao, etc.) should at least be named. If the footer just says "Licensed and Regulated" with no jurisdiction or number, assume it's fake.

Terms that void winnings retroactively. Buried clauses like "the casino reserves the right to void winnings if irregular play is detected" are designed to let the operator refuse payout for any reason they invent later. Legitimate casinos define bonus abuse, multi-accounting, and collusion explicitly in their terms. Vague catch-alls are a confession that they plan to steal.

Restricted access to withdrawal history. You should be able to view every deposit, wager, and withdrawal in your account dashboard. If the casino hides or deletes transaction logs, they're making it harder for you to prove you're owed money.

No responsible gambling tools. Deposit limits, session timers, self-exclusion, and reality checks are legally required in Ontario, Alberta, and under MGA licensing. If those tools aren't present or don't actually enforce the limits you set, the casino is either non-compliant or doesn't care about regulation.

Support that goes dark when you request a withdrawal. If live chat is instant when you're depositing but takes 48 hours to respond once you try to cash out, the delay is deliberate.

Mobile Casino Security: Apps vs Browser Play

Most Canadian players access casinos via mobile, and the security considerations differ slightly from desktop. Native iOS and Android apps go through Apple's App Store and Google Play review processes, which screen for malware, phishing, and data misuse. That's a meaningful filter: if a casino has an app approved by Apple, it passed a baseline security audit.

Browser-based mobile casinos (accessed via Safari, Chrome, or Firefox on your phone) rely entirely on SSL/TLS and your browser's security model. As long as the site uses HTTPS and you're not on public Wi-Fi without a VPN, it's secure. The risk is phishing: a fake casino site that mimics the real one's mobile layout to steal login credentials. Always bookmark the legitimate URL and access the casino from that bookmark, not from an ad or unsolicited email link.

Biometric authentication (Face ID, Touch ID, fingerprint) is a security upgrade if the casino's app supports it. You're replacing a password (which can be keylogged or phished) with a biometric token stored in your device's secure enclave.

Crypto Casinos: Security Advantages & Risks

Cryptocurrency casinos offer pseudonymity, near-instant payouts, and no chargeback risk for the operator—which translates to fewer KYC delays and withdrawal caps. But the security model is fundamentally different. There's no payment processor to mediate disputes, no bank to reverse a fraudulent transaction, and no regulatory requirement to segregate player funds in most offshore crypto casino jurisdictions.

If you're using a crypto casino, verify three things. First, the casino should never ask you to send Bitcoin directly to a deposit address generated on their end—instead, use a secure wallet integration where you control the private keys. Second, check if the casino provably fair games. Provably fair means you can independently verify each game outcome using cryptographic hashes; the casino can't manipulate results without detection. Third, confirm the casino is licensed somewhere reputable. A crypto casino operating on a Curaçao licence with no public ownership information and a three-month domain age is a exit scam waiting to happen.

Ontario-licensed casinos cannot offer crypto. Alberta's regulated framework also excludes it. If you're in either province and want crypto functionality, you're back in offshore territory.

Ontario vs Offshore: The Real Security Trade-Offs

Playing at an iGaming Ontario casino means trading breadth for oversight. You get fewer operators, no crypto, and stricter bonus terms, but you also get quarterly audits, segregated funds, mandatory dispute resolution, and regulatory enforcement. If a casino ghosts you, you file a complaint with the AGCO, and the operator risks losing their licence.

Offshore casinos—especially MGA-licensed ones—offer more game variety, crypto support, and faster KYC processes. The trade-off: if a dispute escalates, you're relying on the operator's goodwill or the licensing jurisdiction's dispute resolution system, which can take months and has no binding power over a Canadian court. For low-stakes recreational play ($10–$100 sessions), the risk is minimal. For high-stakes players regularly withdrawing four or five figures, the security moat of provincial regulation justifies the limited selection.

Alberta's market is too new (launched July 2026) to have a track record, but it mirrors Ontario's structure: private operators under provincial oversight, mandatory audits, and enforceable player protections. If you're in Alberta, the calculation tilts toward regulated local options.

How to Verify a Casino Licence

Don't trust the badge in the footer. Verify it manually.

For iGaming Ontario: Visit the iGaming Ontario website and search the public registry of registered operators. Every legal casino will appear with its operating agreement number and operator name. If the site claims to be iGO-registered but doesn't show up in the directory, it's lying.

For MGA: Go to the Malta Gaming Authority's public register and search by company name or licence number. The listing will show the licence class (B2C, B2B), issue date, and status (active, suspended, revoked). MGA licences are categorized by gambling type; you want a Type 1 (casino games) or Type 2 (chance-based games) licence.

For Kahnawake: Check the Kahnawake Gaming Commission's list of licensees. The directory is less detailed than MGA's, but it confirms whether the operator holds a valid licence.

For Curaçao: This is harder. Curaçao issues four master licences, and each master licence holder (Antillephone N.V., Gaming Curacao, Curacao eGaming, Cyberluck) sub-licenses to individual operators. Not all maintain public registries. At minimum, the casino footer should name the sub-licensor and provide a validator link. Click it. If it leads to a generic landing page or 404s, the licence is fake.

What does "licensed and regulated" actually mean?

It means the casino holds a legal permit from a recognized gambling authority and submits to that authority's rules—audits, player fund segregation, fairness testing, dispute resolution. The strength of that oversight varies wildly by jurisdiction. iGaming Ontario and MGA enforce strict standards. Curaçao's enforcement is minimal. A licence proves legality; it doesn't guarantee operational integrity unless the regulator has teeth.

Is Interac the safest payment method for Canadian players?

Yes, for most players. Interac e-Transfer is authenticated through your own bank, so the casino never receives your account credentials. It's instant to deposit, fast to withdraw (usually 12–24 hours), and has no chargeback risk for the casino, which means fewer withdrawal disputes. Credit cards expose your card number, crypto is irreversible if you make a mistake, and wire transfers are slow. Interac threads the security–speed needle better than any alternative.

Can I trust offshore casinos if I'm outside Ontario?

Depends on the licence. MGA-licensed offshore casinos have a strong regulatory framework, public dispute resolution, and enforced financial reserves. Curaçao is much weaker—oversight is light, and enforcement is rare. Gibraltar and Kahnawake fall in between. Trust is earned through operational track record: a casino that's been paying Canadian players reliably for 10+ years is safer than a new site with a fresh Curaçao licence and anonymous ownership.

How do I know if a casino's games are fair?

Look for third-party testing badges from eCOGRA, iTech Labs, or Gaming Laboratories International (GLI). These labs certify that the random number generator (RNG) is statistically random and that the game's RTP matches the published figure. iGaming Ontario publishes quarterly RTP reports by operator. MGA-licensed casinos must display per-game RTP in the game info screen. If a casino refuses to disclose RTP or won't name its testing lab, assume the games are unaudited.

What are the biggest red flags that a casino isn't secure?

No visible licence number you can verify, terms that let the casino void winnings for "irregular play" without defining it, withdrawal delays that stretch past 72 hours without explanation, live support that goes silent when you request a payout, and restricted access to your own transaction history. Also watch for cloned games (pirated slots that mimic real provider titles), fake regulatory badges, and missing responsible gambling tools where they're legally required.

Provincial Differences: Ontario, Alberta, Quebec & Beyond

Each province sets its own online gambling rules, and the legal landscape shifted significantly in 2022–2026.

Ontario: Fully regulated private market under iGaming Ontario (iGO) and the AGCO. As of September 2026, 84 gaming sites run by 49 operators are licensed. Players must be 19+, and casinos must geolocate you inside provincial borders to let you play. Operators can't accept crypto, and all wagers must be in CAD. If you have a dispute, escalate to the AGCO.

Alberta: Launched its regulated iGaming market on July 13, 2026, with 22 operators live on day one. The framework mirrors Ontario's—provincial licensing through AGLC, mandatory audits, segregated player funds. Still too new for a long-term security track record, but the regulatory structure is solid. Minimum age is 18.

Quebec: No private licensing framework. The only legal option is Espacejeux, run by Loto-Québec. Offshore casinos aren't illegal for players to use, but the provincial government has attempted (unsuccessfully) to block access via ISP filters. Minimum age is 18. If you play offshore from Quebec, you're outside provincial consumer protection.

British Columbia: PlayNow.com is the legal provincial site, operated by the British Columbia Lottery Corporation (BCLC). Offshore play is tolerated but unregulated. No private licensing framework is in development as of 2026. Age 19+.

Manitoba, Saskatchewan, Atlantic provinces: Each operates a provincial lottery site (PlayNow in BC, WCLC for MB/SK, ALC for the Atlantic region). No private licensing. Offshore casinos are accessible and not prosecuted at the player level.

The practical difference: if you're in Ontario or Alberta, prioritize locally licensed casinos for the regulatory safety net. Everywhere else, you're choosing between a provincial monopoly with limited game selection or an offshore casino with more variety and zero local recourse if something goes wrong.

Responsible Gambling Tools as a Security Layer

Responsible gambling features aren't just ethics—they're a compliance signal. iGaming Ontario mandates deposit limits, session timers, reality checks, and self-exclusion on every licensed platform. If a casino claims to be iGO-registered but doesn't offer these tools, it's non-compliant. MGA licensing carries similar requirements.

Set deposit limits when you sign up, even if you don't think you need them. A $500 weekly limit protects you if your account is compromised or if you're logged in after a few drinks and about to make bad decisions. Self-exclusion periods (24 hours, 7 days, 30 days, permanent) are binding: the casino cannot let you reverse them early, and any attempt by support to talk you out of excluding yourself is a red flag.

Reality checks—pop-ups that show how long you've been playing and how much you've wagered—are required in Ontario and under MGA rules. If those notifications never appear, the casino disabled them, which is both a regulatory breach and a sign they'd rather you lose track of time.

What Makes an Online Casino Secure in 2026

Strip away the landing-page promises and SSL badge theatre, and security comes down to four pillars: a strong regulator with enforcement power, transparent financial operations, independently audited game fairness, and a multi-year track record of paying players without inventing reasons to void balances. Licensing jurisdiction matters most—iGaming Ontario, MGA, and Alberta's AGLC-regulated market have teeth; Curaçao is barely supervised. Payment security is second: Interac keeps your bank details out of the casino's hands, while credit cards and poorly implemented crypto integrations open attack surface. Withdrawal speed isn't just convenience; it's a window into the casino's liquidity and operational honesty.

No casino is bulletproof. But the operators ranked here have processed millions in Canadian withdrawals, survived regulatory audits, and maintained operational integrity long enough that systemic fraud or collapse would've surfaced by now. If you're outside Ontario and Alberta, you're trading regulatory oversight for game variety and crypto access—a rational trade-off if you stick to MGA-licensed platforms with decade-long track records. If you're in a regulated province, the choice is simpler: local licensing buys you a dispute resolution path and legal accountability that no offshore regulator can match.

The gap between a licence and trustworthiness is where players get hurt. Close it by verifying the regulator, testing withdrawal speed on a small cash-out, and watching for the red flags that separate slow incompetence from outright theft.