The competition regulator is to take action against some online gambling companies which it suspects of breaking consumer law.
The Competition and Markets Authority (CMA) said some punters did not get the deal they expected from sign-up promotions offering cash bonuses to attract them to gaming websites.
The CMA also said the firms were "unfairly holding onto people's money".
Online gambling companies should "play fair", said the CMA.
Nisha Arora, CMA senior director for consumer enforcement said: "New customers are being enticed by tempting promotions only to find the dice are loaded against them.
"And players can find a whole host of hurdles in their way when they want to withdraw their money."
The CMA launched its investigation into the gambling sector in October 2016. It has since heard from about 800 "unhappy" customers and has "demanded companies answer questions about how they operate, and closely examined the play on a range of websites".
As a result it has identified "a number of operators engaging in practices likely to be breaking consumer law", which is why it is taking enforcement action.
How punters get trapped
The controversial promotions involve terms and conditions which prevent punters from walking away from play with their winnings at a point of their choosing.
For example, someone might bet £10 of their own money which is then matched by £10 from the online betting company.
However, in the terms and conditions of play it might state that the customer has to play several hundred times within a certain period of time before they can cash in their winnings.
In some instances, under these "wagering requirements" people have amassed winnings of several thousand pounds but they have had to keep on betting, said the CMA, meaning that their chances of losing money increase.
"They don't have the choice to quit while they're ahead and walk away with their winnings when they want to," the CMA said.
The Remote Gambling Association (RGA), whose members include many online gambling firms, said it would take "some time to digest and consider properly" the CMA announcement.
"However, where failings are identified companies individually will rectify them," it added.
"If there are generic lessons to be learned then, as ever, we will work with the Gambling Commission to bring those to the attention of the wider industry with a view to raising standards across the board."
Initially the CMA is talking to the companies involved, which it says it cannot name, demanding that they change their practices.
If they do not meet the requirements, the CMA can take them to court. The court could fine the companies or ultimately revoke their licences.
The Gambling Commission has been working alongside the CMA on the investigation.
It said identity checks were an "important duty" for the gambling industry to "prevent money laundering and to ensure responsible gambling".
But, it added, concerns had been raised that some operators might be "applying these requirements in a restrictive way, preventing consumers from legitimately withdrawing funds from their gambling accounts".
The online gambling sector has grown by about 150% since 2009 and is worth £4.5bn. The CMA said more than 6.5 million people regularly use the sites.
The CMA's George Lusty led the investigation. "If you're required to place hundreds of thousands of bets before you can make a withdrawal, then that is going to require you to invest a lot of time into these promotions," he told the BBC.
"Our main interest is these casino-type products, but we do also have some concerns in relation to free sports bets promotions as well."
The CMA is also asking for other people who have had trouble withdrawing their money to come forward by 31 August to help it "probe this issue even further".
One punter's story
Chris Sattin from Gloucester was playing roulette on a website called Maria Casino and won £35,000, but he wasn't allowed to withdraw his winnings.
He told Radio 4's You and Yours: "I was shaking, my adrenaline was pumping. I pressed on the iPhone to withdraw, but nothing was happening. Because I'd never won these sums of money before, I thought maybe it's only happening because it's a large sum of money and I need to contact customer services."
Maria Casino told Chris he had an account with its sister company Unibet, and he had used a self-exclusion feature on the site - something introduced by the Gambling Commission to help problem gamblers.
Chris told the company he had self-excluded only to close his account. But Maria Casino said this breached the company's terms and conditions.
You and Yours contacted Maria Casino about Chris's case and they decided to pay him the £35,000 winnings.