Fake apps impersonating Google Authenticator, Disney+, Duolingo and Airbnb funnel UK users to unlicensed gambling sites

What is this scam?

Which? identified a wave of fraudulent apps in July 2026 circulating via third-party app stores and social media links, impersonating well-known applications including Google Authenticator, Disney+, Duolingo, and Airbnb. Instead of delivering the expected functionality, these fake apps redirect users to unlicensed online gambling and casino sites, and may install malware or harvest account credentials entered during a fake login flow. Apps should only ever be downloaded from the official Google Play Store or Apple App Store, not from links in ads or messages.

Example scam message

Red flags to look out for

• The message creates urgency — threatening a fine, missed delivery, or account closure.
• Links lead to unofficial domains that don't match the real company's website.
• You weren't expecting this message and can't verify the event it references.
• It asks you to confirm payment details or personal information via a link.
• The sender's number or email address doesn't match the company's official contact.

What to do if you receive this

1. Do not call any numbers or click any links in the message.
2. Log in to your account directly via the official website or app to check for any real alerts.
3. Forward the message to 7726 or email report@phishing.gov.uk.
4. Report it to Action Fraud at actionfraud.police.uk.