Account Login
Sign in — 2FA and biometric available
Sign in to your Tao Fortune account
Enter your credentials to continue. 2FA and biometric login supported on the mobile companion app.
Forgot password? Reset via the help centre live chat. New here? Create an account on the sign-up form for new players.
Security you can verify
- TLS 1.3 end-to-end
- Argon2id password hashing
- 2FA via app or SMS
- Biometric login on iOS/Android
- Device attestation blocks jailbroken sessions
Full posture detailed on our privacy handling policy.
Login success by method
2FA options
| Method | Setup | Best for |
|---|---|---|
| Authenticator app | 30 s | Everyone |
| SMS OTP | 10 s | Non-app users |
| Biometric (app) | 20 s | Daily players |
| Passkey (WebAuthn) | 45 s | Advanced users |
| Symptom | Cause | Fix |
|---|---|---|
| Password rejected | Case sensitivity / typo | Use reveal button, retry |
| 2FA code invalid | Clock drift | Sync device time |
| Redirect loop | Cookie blocking | Allow tf_session cookie |
| App biometric refuses | Failed attestation | Update app, restart |
| Interac email missing | Bank filter | Whitelist Interac domain |
What happens after you sign in
The session key is stored in an HTTP-only cookie that never leaves your browser. The wallet state — Gold and Sweeps Coins — syncs in under a second from the two-currency wallet explainer. If it is your first login in a new city or a new device, we may ask a security question or send a magic link to your registered email; this is fraud prevention, not friction for its own sake.
Once you are signed in, the sweepstakes slot library is one tap away, the cash-out banking rails are a second tap, and the help centre live chat is a third. That is the intended interaction budget: three taps to anything meaningful.
Security posture snapshot
| Metric | Value |
|---|---|
| Argon2id iterations | 3 |
| Argon2id memory | 64 MB |
| Session TTL | 30 days |
| 2FA required over | CAD 500 redemption |
| Device attestation | Mandatory on app |
What to do if you're locked out
Contact the customer support portal with your registered email. We verify identity via a signed challenge and re-issue access in under fifteen minutes. Detailed process on the privacy handling policy.
Preferred sign-in method (Canadian users)
Frequently asked questions
Is my session shared across devices?
Yes — session state syncs live between web, iOS and Android. You can sign out remotely from Settings if a device is lost.
Do you support passkeys?
Yes — passkeys are supported on Chrome, Safari and the app. Enrol in Settings.
Where is 2FA required?
Always for redemptions over CAD 500, and for Panda Elite VIP actions — see the Panda Elite tier ladder.
Can I sign in with Google or Apple?
Yes on the app; web sign-in with third parties launches Q4 2026.
What if I suspect account fraud?
Message the help centre live chat immediately. We freeze the wallet within 60 seconds of the report.
Why we default to biometric on mobile
Biometrics beat passwords on every dimension we care about: speed, phishing resistance and shoulder-surfing resistance. Face ID on iOS and biometric on Android are the default sign-in for the mobile companion app because they let a player check their wallet balance without ever touching the keyboard. Behind the scenes we use device-level attestation to guarantee that the biometric prompt happened on a genuine, non-jailbroken device — this is why the app refuses to run on rooted phones. If you prefer, you can turn biometric off in Settings, and a passcode falls back automatically.
Biometric login is layered on top of a hidden session key that lives in the Secure Enclave (iOS) or Trusty TEE (Android). We never see the biometric itself, and we never see the raw key. This posture is documented in the privacy handling policy in more detail. If you switch phones, the new device receives a fresh key via a signed handshake with our authentication server; the old key is invalidated within 60 seconds.
Passkeys — the emerging standard
Passkeys (WebAuthn) are gaining traction as a replacement for both passwords and traditional 2FA. Tao Fortune supports passkeys on Chrome, Safari, Firefox and the app. When you enrol a passkey, your device generates a public-private key pair; the public key lives on our servers, the private key never leaves your device. Signing in becomes a single biometric prompt. Passkeys are phishing-resistant by design — a fake Tao Fortune page cannot request your passkey because the browser scopes it to our exact origin. Enrol via Settings on the Tao Fortune casino homepage or from the app.
If you're travelling
Sweepstakes rules are jurisdiction-specific. You can sign in and check your wallet from anywhere in the world, but new gameplay is disabled if we detect you are outside Canada. The intent is to preserve the promotional-contest exemption — which is Canadian federal law — and to avoid inadvertently offering games in a jurisdiction that would treat them as gambling. If you plan to travel, redeem before you leave via the cash-out banking rails and enjoy the trip.
If you cannot log in at all
Full lockouts are rare. If you find yourself locked out — a lost 2FA device, a forgotten password, a compromised email — contact the help centre live chat from any device, even a friend's phone. The recovery flow is a signed challenge sent to the email of record; complete it, wait fifteen minutes for the security review, and access is restored. If the email itself is compromised, we can pivot to a video-KYC recovery flow — slower (24 to 72 hours) but rock-solid. On any recovery flow, the wallet balance is preserved. Nothing on the Tao Fortune casino homepage is lost simply because a device broke.
Sign-in is deliberately simple
Nothing on this page should surprise you. Email plus password, or biometric, or passkey. 2FA is available and mandatory only where the cash-out banking rails or Panda Elite tier ladder require it. Recovery is fast, human and biased toward returning access.