Tesco has reported a fake “Tesco casino” to City of London Police after its name, branding and even its Clubcard loyalty tiers were used to promote an unlicensed online casino through adverts on Facebook and Instagram. The Guardian, which first reported the case on Sunday 13 September 2026, found that the casino had its own Facebook page until the newspaper put questions to Meta, and that the website behind the adverts was still reachable from the UK. The supermarket is the latest in a run of household names, including Barclays, Monzo, Coral and Gala Bingo, along with sports stars such as Lewis Hamilton and Tyson Fury, whose identities have been borrowed by offshore gambling operators that cannot legally serve British customers.
For a retailer that trades on trust at the scale of Britain’s largest grocer, the episode is more than an embarrassment. It exposes a gap between three regulators, a social media platform that says advertisers carry the compliance burden, and a police reporting system that has logged the complaint but not yet assigned it to a force. It also lands in the same week Tesco made headlines for a very different reason, its decision to ban 114 additives from own-brand food, a reminder of how much of the brand’s value rests on customers believing what carries the Tesco name.
In short
- What happened: a website calling itself “the official Tesco casino” was advertised on Facebook and Instagram, with slot games it claimed were “laid out as clearly as the aisles at a Tesco Extra”. Tesco has no casino and holds no gambling licence.
- What Tesco did: the grocer declined to comment publicly but referred the case to the National Cyber Security Centre and to Report Fraud, the reporting service run by City of London Police. Police confirmed receipt but said the matter had not yet been referred to a force for investigation “at this time”.
- Who else was hit: Barclays, Monzo, Entain’s Coral and Gala Bingo brands, and sports figures including Lewis Hamilton, Tyson Fury, Erling Haaland (via a lookalike), Jude Bellingham and Bruno Fernandes, according to the Guardian and follow-up reports.
- Why it keeps happening: the sites claim licences in Curacao or Anjouan, which carry no weight in Great Britain, and Meta is understood to hold that advertisers, not its platforms, are responsible for local compliance. Meta removed the adverts after being contacted.
- What comes next: the Gambling Commission says brand hijacking of this kind is “a particularly cynical” form of illegal gambling and expects stronger takedown powers from the autumn under the crime and policing bill, while trademark misuse remains outside its remit.
What exactly was advertised in Tesco’s name?
According to the Guardian’s report, the adverts ran on Facebook and Instagram and pointed users to a website that described itself as “the official Tesco casino”. The site leaned heavily on the supermarket’s identity, promising that its slot machine games were “laid out as clearly as the aisles at a Tesco Extra” and claiming the casino was “built on the trust of Tesco, a FTSE 100 company with 107 years of UK trading history since 1919”. None of that trust was ever lent. The site does not hold a licence from the Gambling Commission, which is a legal requirement for any operator offering gambling to consumers in Great Britain.
Follow-up reporting by TheLines, a UK gambling news outlet, identified the domain as TescoSlots.com and described loyalty tiers on the site named “Everyday, Extra, Finest and Clubcard Elite”, echoing Tesco’s own-brand ranges and its Clubcard scheme. The site also referred to Tesco debit cards and Clubcard points. As of TheLines’ report on 13 September, the website remained directly accessible to UK users even though the Facebook advertising had been removed.
A fake Facebook page for the casino existed on the platform until the Guardian sent questions to Meta, the Guardian said. Meta took down the adverts after the newspaper’s inquiries. The casino’s contact page, per the same report, did not work, a pattern shared with a Tyson Fury-branded casino whose contact page led to a page reading only “Silence is golden”.
What Tesco has and has not said
Tesco declined to comment when approached by the Guardian. The company instead referred its concerns to the National Cyber Security Centre and to Report Fraud, the national fraud reporting service operated by City of London Police. GB News, in its own coverage on Sunday afternoon, framed the referral as an “urgent warning” to customers that the supermarket has no connection to any casino. A City of London Police spokesperson told the Guardian the complaint had been received but had not been referred to a police force for investigation “at this time”.
Why did Tesco go to the police rather than the gambling regulator?
The route Tesco chose says a lot about where the problem sits. The Gambling Commission regulates gambling and can act against unlicensed operators that target British consumers, but the unauthorised use of a company’s name and logo is a matter of intellectual property and fraud, not gambling law. The Commission told the Guardian that trademark misuse is outside its remit and that it is working with the Advertising Standards Authority on the issue. That leaves the brand owner to pursue the deception itself, either through the platforms hosting the adverts or through the fraud reporting system.
Report Fraud is the front door for that system. It logs complaints from businesses and the public, assesses them and decides whether there is enough to pass to a local force or a specialist unit. The police statement that the Tesco case had not yet been referred “at this time” is not unusual for a complaint lodged days earlier, but it underlines how slow the enforcement path can be for a scam that can be relaunched under a new domain in hours.
The referral to the National Cyber Security Centre is a parallel track. The NCSC runs the UK’s reporting channels for suspicious websites and emails and can request that hosting providers and registrars take down domains used for fraud. For a retailer, the sequence resembles the early hours of a data breach response: report to the authorities, notify the platform, and document everything before a public statement, even when the retailer itself has lost no data.
Why silence from Tesco is a deliberate choice
Tesco’s decision to decline comment while reporting the case is consistent with how large brands handle impersonation. A public statement risks amplifying the fake site’s name and giving searchers a reason to look for it. Reporting quietly, and letting the platforms and regulators take the visible action, avoids that. It also keeps the company out of any suggestion that it has a view on gambling, an industry with which the supermarket has no commercial relationship.
Who else has been impersonated by offshore casinos?
Tesco is not an isolated target. The Guardian’s investigation lists a string of British businesses and sports figures whose branding or faces have been used without consent by casinos that cannot legally operate in Britain. The table below summarises the cases the newspaper and follow-up reports describe.
| Brand or person impersonated | What was used | Where it appeared | Response reported |
|---|---|---|---|
| Tesco | Name, “Tesco Extra” aisles claim, Clubcard-style loyalty tiers, FTSE 100 heritage | Facebook adverts and page, standalone website | Referred to NCSC and City of London Police; Meta removed adverts; site still reachable |
| Barclays | “Barclays Slots” branding with Lewis Hamilton’s face; AI-generated video | Facebook advert, now taken down | Barclays said it “does not endorse or have any involvement” and acted to protect customers |
| Monzo | “Monzo slots” using the bank’s imagery | Facebook and Instagram adverts | Monzo called it an “AI-enabled scam” and urged customers to be alert |
| Coral and Gala Bingo (Entain) | Licensed brand names impersonated by unlicensed casinos | Adverts and websites | Entain’s UK chief called for Ofcom to take “a harder line” on platforms |
| Lewis Hamilton | Face used in Barclays-branded promotional material | Representatives approached for comment | |
| Tyson Fury | Name used for a casino site | Website targeting UK users | Fury filmed an Instagram video disavowing it, saying he had turned down “millions” from gambling firms |
| Erling Haaland | Lookalike in a Norway shirt acting as a croupier for Rainbet, a crypto casino | Advertised via Meta; site not available in the UK | Representatives approached for comment |
| Jude Bellingham, Bruno Fernandes | Images used previously by rogue gambling firms | Various | Previously reported cases |
Banks: Barclays and Monzo
The bank cases are instructive because they show how far the creative goes. One Facebook advert for “Barclays Slots”, since removed, featured an apparently AI-generated woman who turned round to reveal a Barclays casino game on her phone. Barclays said it does not endorse or have any involvement with the material and had taken appropriate action to protect customers from misleading use of its intellectual property. Monzo described the material using its imagery as “an AI-enabled scam where criminals take advantage of our much-loved brand to trick people”.
Legitimate bookmakers: Coral and Gala Bingo
The impersonation of licensed operators is a different kind of harm. Entain, which owns Coral and Gala Bingo, is itself a Gambling Commission licensee. Bejay Patel, Entain’s managing director for the UK and Ireland, told the Guardian that any casino masquerading as a licensed operator was “exploiting British consumers and legitimate businesses alike and paying no taxes, while some of the world’s largest technology platforms continue to profit from hosting their adverts”. He added that “Ofcom needs to take a harder line on the companies facilitating this activity”.
Sports stars as bait
Sports figures give the adverts a second layer of borrowed credibility. Tyson Fury responded to a casino bearing his name by filming a video for his Instagram followers, disavowing any involvement and saying he would never promote the industry. The Guardian notes there is no suggestion the fake Fury casino was advertised on Meta platforms. Rainbet, a cryptocurrency casino that claims to be licensed by Anjouan, an island in the Indian Ocean, used an apparent lookalike of Erling Haaland as a croupier; the site is not available to UK users but was advertised via Meta.
How does the scam actually work?
The mechanics are simple, and that is the point. An operator sets up a casino website under a licence from a jurisdiction such as Curacao, a Caribbean former Dutch colony known as a base for online gambling firms that lack licences in large markets such as the UK or the US. It then buys adverts on Facebook and Instagram, using a well-known British brand or face to make the offer look legitimate, and directs traffic to the site. Because the operator has no Great Britain licence, offering the service to British customers is illegal from the first click.
Several of the sites analysed by the Guardian claim Curacao licences. Those licences do not authorise gambling in Great Britain, where the Gambling Act requires a Commission licence to offer remote gambling to consumers. The practical consequence for a shopper who signs up is that none of the protections that apply to a licensed site, such as segregated customer funds, dispute resolution or age and identity checks, are guaranteed.
Borrowed trust from a supermarket
Why a grocer? Trust is the asset being stolen. Tesco serves millions of customers a week, and Clubcard is among the most widely held loyalty schemes in the country. Naming loyalty tiers “Everyday, Extra, Finest and Clubcard Elite” borrows vocabulary that shoppers already associate with value and reward. The same logic explains the attraction of banks: a Barclays or Monzo customer already trusts those brands with money, so a “Barclays Slots” advert lowers the guard that a generic offshore casino would trigger. It is the same failure mode that undermines trust in local marketplace payments: once a familiar name is attached, people stop checking.
AI-generated creative
Monzo’s description of the material as “AI-enabled” and the Guardian’s account of an “apparently AI-generated” presenter in the Barclays advert point to why volume has surged. Generating a convincing advert with a brand’s colours, a lookalike or a synthetic presenter now costs almost nothing. The Haaland lookalike in a Norway shirt is a case in point: close enough to trade on recognition, different enough to complicate a straightforward image-rights claim.
What does Meta say, and why do the adverts keep appearing?
Meta told the Guardian it had taken down the adverts after the newspaper’s inquiries. The company is understood to believe that advertisers, not its platforms, are responsible for complying with local regulations. That position is the crux of the dispute with UK regulators. The Gambling Commission has previously criticised Meta’s failure to act on unlicensed casinos as the regulator struggles to keep a lid on a surge in rogue operators, the Guardian reports.
The economics favour the advertiser. A takedown removes one advert or page, but the operator can relaunch under a new page and domain at trivial cost. Unless the platform blocks the advertiser account, the payment method and the destination domain together, enforcement becomes a game of whack-a-mole in which the regulator and the brand owner spend far more per case than the scammer. Entain’s call for Ofcom to take “a harder line” on facilitating companies reflects an industry view that only platform-level obligations will change that arithmetic.
Where Ofcom and the Online Safety Act fit
Ofcom’s role comes through the Online Safety Act, which places duties on large platforms to tackle illegal content, including fraud. Paid-for advertising is treated separately from user-generated content under that framework, which is one reason industry voices keep pressing for the regulator to look harder at how adverts are vetted before they run. None of the reports on the Tesco case indicate that Ofcom has opened any action, and the regulator has not been quoted on it.
What can the regulators actually do?
Three bodies touch this problem, and each holds a partial lever. The Gambling Commission can issue cease-and-desist notices to illegal operators and their affiliates, refer sites to registrars, hosting providers and search engines, and ask sites to geo-block British users. The Advertising Standards Authority can rule against misleading advertising and work with platforms to remove it. Police and the NCSC handle the fraud and domain takedown side. The Commission’s own published data shows how much of that activity is already happening, and how little of it results in sites disappearing.
| Gambling Commission disruption activity | April to June 2026 (Q1 2026-27) | April 2025 to March 2026 (full year) |
|---|---|---|
| Cease-and-desist notices to illegal operators | 217 | 494 |
| Cease-and-desist notices to advertisers and affiliates | 73 | 247 |
| Referrals to registrars and hosting providers | 103 | 442 |
| URLs referred to search engines | 147,721 | 338,272 |
| Websites referred to search engines | 366 | n/a |
| URLs removed from search engines | 19,678 | 266,595 |
| Websites removed from search engines | 276 | 779 |
| Websites geo-blocked after contact | 27 | n/a |
| Websites removed or suspended by registrar or host | 14 | n/a |
Source: Gambling Commission impact metrics on unlicensed gambling, published figures for the periods shown. No prosecutions or payment-provider disruptions were recorded for April to June 2026.
The numbers show the shape of the problem. In a single quarter the Commission referred 366 websites and nearly 148,000 URLs to search engines, yet only 27 sites introduced geo-blocking and 14 were taken down by their registrar or host. Search-engine delisting removes the site from Google and Bing results, but it does nothing to stop a paid advert on Facebook sending users straight to the domain. That is why the Tesco case matters: the traffic came from social advertising, not search.
New powers from the autumn
The Commission told the Guardian it would act to take down unlicensed websites targeting UK consumers and would be better able to do so from the autumn, when it expects additional powers under the crime and policing bill. Industry reports have also described extra Treasury funding of about GBP 26 million over three years to expand this work, alongside a government-established illegal gambling task force. The Commission’s statement on the Tesco case was blunt: “Illegal activity linked to gambling is a threat we take seriously, and using a trusted brand’s identity to funnel people towards unlicensed casino products is a particularly cynical version of it.”
What remains outside anyone’s remit
The gap is the trademark. The Commission says the unauthorised use of intellectual property falls outside its powers; it is working with the ASA, but the ASA’s rulings bind advertisers who are, by definition, outside British jurisdiction. That leaves civil action by the brand owner, which is slow and expensive against an anonymous operator with a broken contact page, or a fraud investigation, which in Tesco’s case has not yet been assigned to a force.
What does this mean for Tesco shoppers and Clubcard holders?
The direct risk to shoppers is straightforward: anyone who deposited money with the fake casino has handed it to an unlicensed operator with no UK consumer protection, and there is no route through Tesco to recover it. The indirect risk is data. A site that mimics Clubcard tiers and mentions Tesco debit cards is well placed to harvest card details, dates of birth and login credentials from people who assume they are dealing with the supermarket. Holders of Tesco-branded financial products in particular should treat any gambling offer bearing the Tesco name as fraudulent by default.
The signals that separate a genuine Tesco channel from a fake are consistent, and most of them can be checked in seconds. The table below sets them out.
| Signal | Genuine Tesco or Clubcard | Fake “Tesco casino” pattern |
|---|---|---|
| Product | Groceries, Clubcard, Tesco Bank, Tesco Mobile; no gambling products | Slots, roulette, “official Tesco casino” |
| Domain | tesco.com and its subdomains | Lookalike domain such as TescoSlots.com |
| Licence | Not applicable; Tesco holds no gambling licence | Claims Curacao or similar offshore licence, or none |
| Loyalty language | Clubcard points and Clubcard Prices | Invented tiers such as “Clubcard Elite” |
| Contact details | Published customer service channels and store contacts | Broken contact page or placeholder text |
| Advert placement | Tesco’s verified social accounts | Paid advert from an unrelated page, often with AI-generated video |
What to do if you signed up
Anyone who has deposited money should contact their bank or card provider immediately and ask about a chargeback, then report the site to Report Fraud, the national reporting service run by City of London Police, and forward the advert to the NCSC’s suspicious website reporting channel. Passwords reused on the fake site should be changed everywhere they were used. The Gambling Commission also accepts reports of unlicensed operators, which feed the takedown activity described above.
What should independent retailers take from this?
A national grocer has legal teams and a direct line to Meta’s press office. Most independent shops do not, but the same tactic is cheap enough to be used against a local business with a strong reputation in one town. A scammer does not need a FTSE 100 name; a recognisable shop name and a copied logo can be enough to run a fake “closing-down sale” or a bogus loyalty scheme to a local audience on Facebook. The playbook for a counterfeit listing crisis applies almost unchanged: monitor for your name, report fast and in parallel, and tell customers through channels you control.
Three practical steps
- Register the trademark you actually trade under. A registered UK trademark makes reports to Meta and to domain registrars far faster to process, because platforms have defined intellectual property complaint routes that require proof of ownership.
- Set up brand alerts. Free search alerts on the business name plus words like “casino”, “slots”, “offer” or “sale” catch most lookalike domains and adverts before customers do. Meta’s Ad Library allows anyone to search live adverts by keyword.
- Prepare the message before you need it. A one-paragraph statement on the shop’s own website and social channels, saying the business runs no gambling, prize or discount scheme beyond those listed, takes five minutes to draft and removes the ambiguity a scammer relies on.
Why does this case land now?
The timing is not accidental. The Gambling Commission has been publicly pressing Meta over unlicensed casino adverts for months, and its own quarterly figures show enforcement volume rising without a matching rise in sites removed. The Guardian’s decision to name Tesco, Barclays and Monzo turns an abstract regulatory dispute into consumer-facing news that a reader recognises. Sunday coverage was picked up within hours by GB News, the Daily Express and gambling trade outlets, which suggests the story will run into the working week and reach the Commons, where the crime and policing bill is due to give the Commission its expanded powers.
For Tesco, the reputational calculus is unusual. The company is the victim, not the subject, of the deception, and none of the reports suggest any failure on its part. But a retailer whose entire model rests on customers trusting the name above the door cannot afford to let a fake casino trade on it, which is why the referral to police came before any public statement. The question the case raises for every large consumer brand is whether platform takedowns on request are enough, or whether the burden should move to the platform before the advert runs.
What happens next?
Three things to watch. First, whether City of London Police refer the complaint to a force or a specialist unit, which would move the case from a logged report to an active investigation. Second, whether the TescoSlots domain is taken down by its registrar or host, or geo-blocked for UK users, in line with the Commission’s referral process. Third, whether the Commission’s autumn powers under the crime and policing bill arrive with the mechanisms industry has been asking for, particularly obligations on platforms to check gambling advertisers’ licence status before adverts run.
None of those steps will stop the next fake brand casino from appearing. What they can change is the cost to the operator of being caught, and the speed with which a brand like Tesco can make the fake disappear. Until then, the practical advice for shoppers is simple: Tesco sells groceries, and any advert offering a Tesco casino is a scam.
Frequently asked questions
Does Tesco have a casino or any gambling product?
No. Tesco has no casino, holds no Gambling Commission licence and has no gambling product. Any advert or website offering a “Tesco casino” or “Tesco slots” is not connected to the supermarket and should be reported.
What did Tesco do about the fake casino adverts?
According to the Guardian, Tesco referred its concerns to the National Cyber Security Centre and to Report Fraud, the service run by City of London Police. Tesco declined to comment publicly. Police said the complaint had been received but not yet referred to a force for investigation at the time of the report.
Where did the fake adverts appear?
The adverts ran on Facebook and Instagram, both owned by Meta, and a fake Facebook page for the casino existed until the Guardian sent questions to Meta. Meta said it took the adverts down after the newspaper’s inquiries.
Is the fake Tesco casino website still online?
As of 13 September 2026, both the Guardian and TheLines reported that the website behind the adverts remained accessible from the UK, even after the Facebook advertising was removed.
Which other brands have been impersonated in the same way?
The Guardian’s investigation lists Barclays, Monzo, and Entain’s Coral and Gala Bingo brands, as well as sports figures including Lewis Hamilton, Tyson Fury, Erling Haaland (via a lookalike), Jude Bellingham and Bruno Fernandes.
Why can’t the Gambling Commission simply shut the site down?
The Commission can issue cease-and-desist notices and refer sites to registrars, hosts and search engines, but it cannot directly seize a domain registered abroad, and misuse of a trademark is outside its remit. It says it expects stronger takedown powers from the autumn under the crime and policing bill.
What does Meta say about the scam adverts?
Meta told the Guardian it removed the adverts after being contacted and is understood to hold that advertisers, not its platforms, are responsible for complying with local regulations. The Gambling Commission has previously criticised Meta for failing to act on unlicensed casino adverts.
What should I do if I deposited money on the fake site?
Contact your bank or card provider immediately to ask about a chargeback, report the site to Report Fraud (City of London Police) and to the Gambling Commission, forward the advert to the NCSC’s suspicious website channel, and change any password you used on the site.
How can a small shop protect itself from the same tactic?
Register the trademark you trade under, set up search alerts on your business name combined with words like “casino”, “slots” or “sale”, check Meta’s Ad Library for adverts using your name, and keep a short pre-written statement ready to publish on your own channels if a fake appears.