Median session timeout across 40 licensed operators is closer to 11 minutes than the 30 most players assume, and in a sample of 2,140 forced logouts, 28% of users had an open bet slip that never made it to the server. The gap between what regulators require and what operators actually deploy is where the money quietly disappears.

Where the 11 minutes comes from

We logged idle-timeout behaviour across desktop and mobile web sessions at 40 operators holding UK, Malta, or Curacao licences over a six-week window in Q1 2025. The distribution wasn't a clean bell curve. It clustered: a hard wall of operators sitting at 10–12 minutes of inactivity, a smaller group at 15, and a thin tail out past 25.

The 30-minute figure players cite usually traces back to two things — the session length they remember from a bonus T&Cs page, or the "you've been logged out for your security" email that arrives long after the fact. Neither reflects the actual timer running in the tab.

Idle timeout	Share of operators sampled
≤10 min	34%
11–15 min	41%
16–29 min	18%
≥30 min	7%

Mobile was consistently tighter. Median mobile-web timeout came in at 9 minutes 40 seconds, against 12 minutes 15 seconds on desktop. App sessions ran longer only because push notifications and background refresh kept the token alive.

Why 28% is the number that matters

A timeout on its own is friction, not loss. What turns it into money is the bet slip.

Across the 2,140 forced logouts we instrumented, 601 (28.1%) had at least one selection staged but unsubmitted. Of those, 71% never returned to the slip. The reasons split roughly evenly between the market moving (odds drifted past the player's tolerance) and simple abandonment — the moment of interruption killed the intent.

Sportsbook bet slips are the worst affected because they accumulate over time. A player building a five-leg accumulator over 20 minutes on a Sunday afternoon is almost guaranteed to hit a timeout mid-build unless they interact with the page. Casino sessions behave differently: a slot player spinning every 3–4 seconds resets the timer constantly, which is why the timeout problem is disproportionately a betting problem, not a casino-floor problem.

The pre-match window is the sharpest edge

Timeouts spike in the 15 minutes before a major kickoff. Operators with 10-minute timers see the highest abandonment exactly when handle should be peaking. One operator in the sample moved from 10 to 20 minutes in week four and recorded a 6.4% lift in pre-match bet submissions from returning sessions — small, but it cost nothing to implement.

What regulators actually mandate

Almost nothing specific. The UK Gambling Commission's remote technical standards require reasonable session controls but don't set a number. Malta's licence conditions are similarly open. The 30-minute figure that circulates in player forums is folklore, not a rule.

That leaves operators free to pick a timeout that suits their risk model — and short timers reduce support load, cut shared-device liability, and push re-authentication, which some fraud teams like. The player cost is invisible on a P&L until someone measures the abandoned slips.

The question nobody is asking

If a 10-minute timeout costs a mid-single-digit percentage of pre-match handle, and extending it costs nothing but a marginally longer token life, why hasn't the industry standardised on something closer to 25? Is it genuinely a security posture, or is it an unexamined default copied from banking software that was never designed for someone assembling a five-fold on a Sunday? Worth checking your own last logout — and whether the slip survived it. If you're chasing losses after one, that's the other reason to step away.