TL;DR: In July 2026, Which? warned about Facebook and Instagram ads promoting fake apps posing as Google Authenticator, Disney+, Duolingo and Airbnb that lead to unlicensed online casinos asking for a deposit. NordVPN’s research found one network impersonating more than 400 brands; Malwarebytes found a kit called FriendlyDealer behind 1,500+ domains. The "app" is usually a web shortcut installed from a fake Google Play or App Store page. Unlicensed casinos offer none of the protections of UK-licensed ones. Delete the shortcut, clear the site’s data, block its notifications, and don’t deposit.
What Which? found
Which? reported on 29 July 2026 that NordVPN had found a criminal network running Facebook and Instagram ads that impersonate Google Authenticator, Disney+, Duolingo and Airbnb. The "apps" lead to unlicensed online casinos that ask for a deposit, and Which? says some victims only realise after they’ve paid into a casino they’ve never heard of. You came for language lessons and left with a slot machine.
How the trick works
NordVPN’s research (published 2 September 2026) walks through the steps:
- A Facebook or Instagram ad leads to a fake app-store page, often on an unrelated throwaway domain.
- A tracking system checks who’s visiting. Real people see the fake install page; scanners and ad reviewers may see a harmless page instead.
- "Install" adds a progressive web app (PWA), a web shortcut on your home screen that opens a website rather than a real app.
- The page may ask for notification permission, so it can send alerts later, and some interfere with the Back button.
- The shortcut opens a casino sign-up page asking for an email, password, country, age confirmation and a first deposit, often with a big welcome bonus.
- Affiliates get paid for every registration or deposit.
NordVPN says the network impersonated more than 400 brands, including Google Authenticator, Google Translate, Gemini and YouTube Kids, plus banks, lotteries, travel, streaming and VPN apps. NordVPN chief technology officer Marijus Briedis called it "essentially trust laundering."
Malwarebytes’ March 2026 report on a similar kit, FriendlyDealer, found 1,500+ domains and 20+ casino brands generated from one configuration file, with fake reviews on the fake store pages. Malwarebytes says this campaign doesn’t steal passwords or install traditional malware, but pushes people into unregulated gambling with no age checks, deposit limits or consumer protection.
Why "unlicensed" matters
UK-licensed gambling sites must verify age, offer safer-gambling tools and follow complaint rules. NordVPN lists what you risk on an unlicensed site: poor age checks, unclear deposit rules, unfair bonus terms, refused payouts and aggressive marketing.
The Gambling Commission calls the illegal market "unsafe, unfair and criminal." According to SBC News, its research found:
- some people use illegal sites to get around GAMSTOP self-exclusion or spending limits, and those people are more likely to experience gambling harm;
- some offshore sites openly advertise as "non-Gamstop casinos";
- many use Gambling Commission and GambleAware logos to look regulated.
So a logo on the page proves nothing. Check the operator’s name on the Gambling Commission’s public register before depositing anywhere.
How to remove a fake app
| If you... | Do this |
|---|---|
| Only opened the page | Close it; don’t install or allow notifications; report the ad |
| Added the shortcut | Delete it, revoke notification permission and clear the site’s data in your browser |
| Registered at the casino | Don’t deposit more; change any reused password; save evidence |
| Deposited money | Contact your bank or card provider promptly |
| Entered real logins (e.g. Google) | Change the password, turn on two-step verification, sign out other sessions |
That advice comes from NordVPN. On Android, clear site data in Chrome’s site settings; on iPhone, delete the home-screen icon and clear the site’s data in Safari settings.
Report the ad on Facebook or Instagram using the three dots in the top-right corner of the ad, then Report.
Spot the fake next time
- Real installs open the Play Store or App Store app, not a web page that looks like it.
- Check the address bar: NordVPN says scammers count on people checking the logo, not the URL.
- Search for the app yourself in the official store and check the developer name.
- A notification request during "install" is a warning sign.
- If an "authenticator" app starts talking about free spins, you have your answer.
Fake apps are a wider problem: in October 2026 Which? also reported McAfee finding 970 fake apps on Google Play targeting UK users. See also fake apps on copycat sites and scam casino websites.
If gambling is becoming hard to control, GAMSTOP lets you self-exclude from UK-licensed sites.
A free email exposure check covers the breach side of your footprint.
Frequently Asked Questions
What brands did the fake casino apps imitate?
Which? reported fakes posing as Google Authenticator, Disney+, Duolingo and Airbnb. NordVPN found one network impersonating more than 400 brands.
Are these real apps?
Usually not. They’re web shortcuts (PWAs) installed from fake store pages, not apps from Google Play or the App Store.
Is it dangerous to gamble on an unlicensed site?
Unlicensed sites can lack age checks, deposit limits and consumer protection, and may refuse payouts.
The site shows a Gambling Commission logo. Is it licensed?
Not necessarily. The Gambling Commission says many offshore sites copy its logo. Check the operator on its public register.
How do I remove a fake casino app?
Delete the shortcut, clear the site’s data in your browser and remove its notification permission.
Sources
- Which?: The latest scam alerts (casino apps, 29 Jul 2026)
- NordVPN: Fake social media ads can lead you to unlicensed casinos (Sep 2026)
- Malwarebytes: FriendlyDealer mimics official app stores (Mar 2026)
- SBC News: Gambling Commission illegal market findings