Tesco alerts City of London police after fake casino ads hijack its brand on Facebook and Instagram

Key points

• Tesco reported fake endorsement advertisements to City of London Police after unlicensed casinos used the supermarket's branding without permission.
• The same campaign has impersonated Barclays bank, Jude Bellingham, Erling Haaland and Lewis Hamilton, according to The Guardian.
• Casinos behind the ads cannot legally operate in Britain, so the gambling they promote is unregulated and offers customers no legal protection.
• The ads appeared on Facebook and Instagram, both owned by Meta.

What actually happened?

Criminals running unlicensed casinos created paid ads on Facebook and Instagram that made it look as though Tesco, Barclays and several famous athletes were endorsing their gambling sites. None of those people or companies had any involvement.

This is a brand-impersonation scam: fraudsters borrow the trust a well-known name has built with the public and attach it to something those people would never promote. Tesco spotted the ads, confirmed it had nothing to do with them, and reported the matter to City of London Police.

The targets read like a catalogue of UK brand recognition: a supermarket most British adults shop at, one of the country's biggest banks, and three of the world's most famous sportsmen. That selection isn't accidental. The more recognisable the face or logo, the easier it is to convince someone the ad is legitimate.

Why does this matter for ordinary people?

Someone clicking one of these ads could hand money to a casino holding no UK licence, which means no obligation to pay out winnings, no responsible-gambling safeguards, and nowhere to complain if things go wrong.

Fake gambling sites also use sign-up forms to harvest personal data and payment details for resale or misuse. If a social-media ad shows a supermarket or a sports star apparently promoting gambling, treat it as fraudulent. Don't click through, and don't enter card details.

Why can't Meta just stop this?

Ad platforms should verify that a buyer has permission to use a brand's logo or a person's likeness before letting an ad run. That check clearly isn't working.

The ad buyer presents as a legitimate business, the platform takes payment, and the fake ad goes live. By the time the impersonated brand finds out and complains, the ad has already reached thousands of people. Then the criminals open a new account and repeat the process.

Meta's ad-verification failures are under sustained scrutiny right now: we reported on 26 August 2026 that Meta agreed to pay up to $18 billion to settle claims from 52 US states over platform harms, a settlement that touches how Facebook and Instagram are built and moderated. Meta has not commented publicly on this specific campaign.

If you see one of these ads, use the platform's reporting button to flag it. It takes thirty seconds and helps get the ad removed faster.

Common questions

How do I tell a real brand ad from a fake one?

Check the advertiser name shown in the "Sponsored" label, not just the images. An unfamiliar or slightly misspelled name is a warning sign. When in doubt, go directly to the brand's official website rather than clicking the ad.

Could two-step login have prevented this?

Not directly. This scam exploits ad-platform verification gaps, not stolen passwords. Two-factor authentication, confirming your identity with a second step such as a code sent to your phone, protects your own accounts but does nothing to stop someone buying ads under a fake identity.