There are scam casinos out there, but they rarely last long as their reputation is quickly ruined and they get "blacklisted" in many places they might want to advertise. The reality is that casinos don't need to rip people off, at a certain size they start to make so much money legitimately that they would be dumb to risk it by arguing over petty things. The reasons they will keep excess winnings usually revolve around promotional abuse, like people creating multiple accounts in order to keep taking a generous welcome bonus - they design themselves things to be one person person and not an easy money stream that people think they can steal from. Besides that, using vpns can leave you vulnerable to accusations that you are from a banned country that they might be legally excluded from serving - but they should always give you back any deposited amount you have not lost.