Dangerous Scam: Criminals Use Fake Google Play Stores to Promote Illegal Gambling

Cybercriminals have developed a particularly insidious method to lure unsuspecting smartphone users into the clutches of illegal gambling operators. These attackers rely on the trust that people place in globally recognized brands such as Google, Disney+, or the language-learning app Duolingo. Instead of leading users to the genuine applications, they are redirected via manipulated advertisements on Meta platforms like Facebook and Instagram to convincing copies of the Google Play Store. Once there, victims download what appears to be legitimate software but is actually a disguised gateway for unlicensed casino offers.

The technical implementation is highly professional. Instead of a classic app installation, a so-called Progressive Web App (PWA) is often used. This links the mobile device directly to the illegal provider's websites and allows criminals to send persistent push notifications with bonus offers. To the user, it looks as though the communication comes from a reputable source, while in the background, money is deposited on platforms that are subject to no regulatory control. This abuse of trust is at the heart of a campaign that cybersecurity researchers say is designed to systematically lower psychological barriers.

Numbers and facts

The scale of this coordinated campaign is both impressive and alarming. NordVPN's Threat Intelligence Team identified over 7,200 instances where casino pages were delivered directly to end users. To outsmart the automated review systems of advertising platforms, the scammers also used more than 3,100 decoy pages. This technique, known as cloaking, shows harmless content to Meta's moderation algorithms while the real user sees illegal gambling advertisements.

Another concerning point is the financial dimension within Meta itself. According to investigations, internal projections indicated that about 10 percent of Meta's advertising revenue in 2024 came from ads linked to scams or prohibited goods. This corresponds to a sum of approximately $16 billion. Criticism of the inadequate protective measures by tech giants is growing significantly. Authorities in the Netherlands and Thailand have already launched legal action to hold Meta accountable for the distribution of illegal gambling content.

Background

Scams of this type often follow a seasonal pattern. During major sporting events, such as the FIFA World Cup, black market activity increases drastically. Brand protection firms observed a 118 percent increase in betting-related phishing activities during such events compared to the previous month. Criminals use not only fake apps but also specifically hijack abandoned websites with high authority. In the past, this has included tourism sites or websites of political parties used to advertise non-GamStop casinos to users who had already chosen to self-exclude.

The UK Gambling Commission is particularly critical of the role of platform operators. It is hard to comprehend why companies capable of developing highly complex technologies continue to struggle with effectively filtering illegal advertising.

„The UK’s Gambling Commission has questioned why technology companies capable of developing cutting-edge products continue to struggle to remove illegal gambling advertisements, warning that weak enforcement by major platforms undermines broader efforts to protect consumers.“ - Spokesperson, Gambling Commission

Why it matters for German players

For German players, the danger posed by such fake app stores is very real. Since the German gambling market is strictly regulated by the State Treaty on Gambling 2021 (GlüStV 2021), illegal providers try everything to break through the protective barriers. Players in Germany are bound by a monthly deposit limit of 1,000 euros and a stake limit of 1 euro per spin on virtual slot machines. These rules are monitored by the central supervisory system LUGAS. Illegal providers promoted through these fake Google Play pages ignore these limits completely.

Anyone who falls for such a fake app not only loses all player protection but also takes on an enormous financial risk. Since these providers are not on the official GGL whitelist, there is no legal recourse for unpaid winnings. Furthermore, there is a risk that personal data and payment details will fall directly into the hands of criminals. The use of apps that do not come directly from the verified Google Play Store or the official websites of known, licensed providers should be avoided under all circumstances.

What it means for GGL-licensed casinos

For operators with a license from the Gemeinsame Glücksspielbehörde der Länder (GGL), this development represents an unfair competitive situation. While legal operators bear high costs for compliance, player protection, and taxes, black market operators can mass-recruit users through technical tricks and identity theft. The GGL is increasingly relying on IP blocking and payment blocking, but dealing with manipulated apps on social networks remains challenging. However, it underlines the importance of educational work: only those who play with providers authorized in Germany are safe from such scam tactics.