You tapped an ad for Disney+ and landed in a casino. Over 400 brands are being used as bait.

September 23, 2026

By Kim Komando

Scroll Facebook long enough, and an ad for Disney+ shows up. Tap it and you could end up in a casino you’ve never heard of, being asked for a deposit.

🎣 Bait and switch

The ads run on Facebook and Instagram, wearing real logos. Disney+. Delta Air Lines. Duolingo. Google Authenticator. Even state lotteries. More than 400 brands in all, which are chosen carefully. These are companies you’d expect to have an app, so nothing feels off. 

Tap one and you land on a page built to look exactly like the Google Play Store. Star rating, screenshots, review count, green Install button. Everything is right except the web address.

Here’s what you actually install. 

It’s a progressive web app, which is a bookmark in a costume. It puts a real-looking icon on your home screen and subscribes you to push notifications. Because it never passed through Apple or Google, nobody reviewed it, nobody scanned it and it won’t show up in your list of installed apps when you go looking for it later.

Those notifications are the whole point. Casino offers land on your lock screen all day, forever, from something you can’t find to uninstall.

Then comes the redirect to an unlicensed casino. Unlicensed means no regulator, no complaint process and an offshore operator holding your card number. Deposits go in easily. Winnings have a habit of not coming out.

🥅 Why doesn’t Facebook catch it? 

Cloaking. The same link shows a clean, boring decoy page to Facebook’s automated reviewers and the casino to everyone else. NordVPN counted over 7,200 casino handoffs against 3,100 decoy pages built purely to fool the moderators.

Nord traced the activity to an affiliate platform called Betterlinks, with hundreds of accounts getting paid per player delivered. Shut one down, and 40 more are waiting.

Nord’s CTO calls it “trust laundering.” Crooks spend credibility that real companies took decades to earn.

🛡️ Don’t take the bet

• Never install from an ad. Open the App Store or Google Play yourself and search the name.
• Watch where “install” opens. A real app install never happens inside Safari or Chrome. If you’re looking at a browser, you’re looking at a fake.
• Check notification permissions. Chrome on Android: Settings > Notifications. iPhone: Settings > Apps > Safari > Notifications. Revoke anything you don’t recognize.
• Delete home screen icons you don’t remember adding. Press and hold, then remove.
• If you already deposited, call your card issuer today, dispute the charge and ask for a new card number.

🦸🏼‍♀️ My pro move

I use NordVPN, the official VPN of my show. It will protect you from junk like what I talked about above.

• Blocks fake sites before you land. Nord checks 12 million web addresses a day and blocks about 130,000 bad pages.
• One account covers 10 devices. Phone, laptop, iPads, the TV.
• Next-gen built in. I’m talking ad and tracker blocking.
• Nobody logs what you do. Independently audited six years running.
• 30-day money-back guarantee.

✅ Get up to 76% off, just $3.37 a month, plus 4 extra months free.*

The house always wins. Especially when the house built the ad, the fake store and the app.

🎯 Send this to someone who taps ads in their Facebook feed.

📱 Text-worthy: Heads up, crooks are running Facebook ads with real brand logos like Disney+ and Delta, then sending people to fake app pages and unlicensed casinos. Never install an app from an ad. Search for it in the App Store yourself.