Is McLuck safe? The question actually splits into two very different halves. One is technical and checkable: encryption, login security, payment handling. The other is regulatory, and it doesn’t have a clean yes — McLuck operates as a sweepstakes, not a licensed casino, and that distinction is exactly what two active lawsuits are arguing about right now.

What Actually Holds Up: Encryption, 2FA, PCI DSS

McLuck runs account and payment data over SSL encryption, the same baseline any mainstream financial site uses. Two-factor authentication is available at login — a code sent to phone or email on top of the password — but it’s opt-in, not automatic, so a player who’s never opened the security settings is probably still running without it. Geolocation checks confirm eligibility before play starts, and card and payment processing runs under PCI DSS compliance rather than a homegrown system, handled by named companies: B-Two Operations Limited and its payment affiliate, B2Services OÜ, based in Estonia.

Turn on 2FA before you fund an account: it costs nothing, takes under a minute in account settings, and is the single cheapest security step most McLuck players skip simply because it isn’t required.

Purchase Limits and Self-Exclusion Are Both Real Tools

Beyond login security, McLuck offers purchase limits and a self-exclusion option that runs from a set cooling-off period up through a permanent lock, requested through customer support. Those tools exist specifically because Gold Coin purchases can feel like a bet even though the legal wrapper is a sweepstakes — setting a limit before playing is the safety step that matters more than any encryption standard for most players.

The Part No Encryption Fixes: No Regulator Behind It

Here’s the safety question technical controls can’t answer: if a redemption dispute ever went sideways, there is no state gaming commission to file a complaint with, because McLuck isn’t licensed as a casino anywhere — it operates under sweepstakes law instead. That gap is the live legal argument right now. In March 2026, the City of Baltimore sued McLuck’s operator, B2Services, along with five other sweepstakes-casino companies, seeking to shut the model down inside city limits on the theory that free-entry sweepstakes is a legal fiction covering real gambling. Starting in November 2025, plaintiffs’ attorneys filed a wave of Utah federal class actions against nearly every major sweepstakes brand, B2Services included, using a state statute that lets a losing player recover double their losses plus attorney fees.

What’s Actually Unresolved

  • Baltimore, filed March 2026: seeks to shut down the sweepstakes model inside city limits — no ruling yet
  • Utah, filed starting November 2025: double-damages class actions under state anti-gambling law — no ruling yet
  • In the meantime: McLuck keeps operating and redeeming normally in every state it served before both cases were filed

Neither case has produced a finding against McLuck, and a lawsuit is an allegation rather than a verdict. But it means the safety of the underlying model — not just the padlock icon in the browser — is a genuinely open question in court, not a settled fact.

States Where Playing Isn’t Actually an Option

Separate from the pending litigation, roughly 17 states already block McLuck outright: California, Connecticut, Delaware, Idaho, Indiana, Kentucky, Louisiana, Maine, Maryland, Michigan, Montana, Nevada, New Jersey, New York, Tennessee, Washington, and West Virginia. California's is the newest and firmest, under AB 831’s statewide sweepstakes-casino ban effective October 11, 2025. Signing up from a blocked state doesn’t just risk a rules violation; it risks a frozen account holding real Sweeps Coins with nowhere to redeem them.

So, Is McLuck Safe?

On the controls a security review can measure — encryption, optional 2FA, PCI DSS payment handling, geolocation checks — yes. On the question a security review can’t answer — whether a licensed regulator has your back if something goes wrong — no, because none does, and that’s exactly the argument playing out in Baltimore and Utah courts right now. Turn on 2FA, set a purchase limit before you fund an account, confirm your state isn’t on the blocked list, and treat any Sweeps Coin balance as a bonus outcome from entertainment play. 21+ where applicable.