Check who owns the casino route.
The brand, company name, terms page, and support contact should all tell the same story.
Check the licensing language, not just the badge art.
If the page mentions MGA, UKGC, or Curacao, there should be enough surrounding information to verify that claim instead of taking it on faith.
Check the domain and SSL basics.
HTTPS is not proof of legitimacy on its own, but a secure domain is still the floor, not the ceiling.
Check responsible-play controls before the first deposit.
Limits, cooling-off tools, and self-exclusion options should exist before you need them.
Check whether the mobile route is browser-based or app-based.
If the offer jumps straight to a detached APK with unclear ownership, move on and use the browser route instead.