Late last year, employees of the Albanian Gambling Supervisory Authority, AMLF, were alarmed when they came across advertisements for virtual casinos in Albania on social media. The advertisers used the names of three licensed casinos, accompanied by promises of guaranteed profits.
The AMLF immediately contacted the casinos with official letters stating that they were not licensed for online gaming, but all three entities denied being behind the advertisements and complained that their names were being misused by third parties. Investigations revealed that the sites were in fact fraudulent.
AMFL reported 6 such sites to the Electronic and Postal Communications Authority, AKEP, and the State Police. On December 29, the Authority raised the alarm publicly, stating that it had not licensed online gambling. “We urge you to be careful and not fall prey to these scams,” the announcement said.
But that hasn't stopped the scheme. In early January, a series of Facebook ads again targeted Albanian-speaking internet users to play at "virtual casinos." "1,500 euro welcome bonus," reads one of the ads, promising that casinos in Albania were now online.
And while licensed casinos themselves are somewhat of a controversial business, these sites are completely fraudulent. Those targeted by them risk losing not only the money they decide to play, but also their personal data and bank accounts. Meanwhile, authorities complain that they have little chance of responding.
"Even if we report them, they just need to change one letter in their name and they're back online," said Valentino Loka, a specialist at the Directorate of Supervision and Control of Gambling Technology.
Red flags
The Albania Offers page features a photo of the National Arena stadium in the background and claims to advertise on behalf of a local casino. “Discover hundreds of games, exclusive daily offers, secure deposits, fast payouts and 24/7 customer support — everything you expect from a top-class casino,” it writes in one of the ads.
But the site in question has no connection to Albania; it was launched in Colombia in 2020 under the name Bad Bunny Posting, has a Colombian phone number, and was inactive for years before changing its name on December 29 to Albania Offers. Transparency data on the site shows that it is managed by 4 admins located in Ukraine and Vietnam.
Despite this, the ads on the site target Albanian speakers and promise huge profits. But if you click on the ads from a computer, the pages that open are not related to betting. One of them, for example, directs you to Open Foris Arena Mobile, an application for collecting field data on forests and land, the product of an initiative of FAO, the Food and Agriculture Organization of the United Nations.
However, this is not a technical error. A detailed analysis of the code, domains and infrastructure of this campaign reveals that Albanian Facebook users are being targeted by a complex fraud operation, which uses the technique of "Cloaking" to evade security filters, misusing the real names of casinos, public institutions and banks.
The scammers have created two versions of the same page. On one side is the clean part that fools Facebook bots, which inspect and approve the ad. The page code directs these bots to the legitimate “Open Foris Arena Mobile” app or to a free online game. Seeing legitimate and educational content, Facebook classifies the ad as safe.
But unlike what you see if you click from a computer, when the ads are opened from a phone in Albania, a hidden script identifies the location and device, immediately redirecting the user to domains like arenacasino-official.com or grandcasinotirana-official.com, both fake sites.
Here, the sites use other elements to create credibility. The ads feature well-known bank names and promises of instant profits. Fraudsters have built websites that closely mimic the interfaces of the Apple App Store or Google Play.
Only a trained eye can tell that they redirect you to private servers that bypass the security of both official app stores. The imitations, however, are not perfect. The language used is in some cases a poorly translated Albanian.
"Grand Casino Tirana online is burning! I deposited 2,000 lek, I got 18,000 lek. The payment came in 3 minutes. This is a lot of work," reads one of the ads, where it is clear that the last sentence makes no sense. Another red flag is that the reviews are all excellent. No criticism and everyone claims that they won a lot by playing with little money and that the money immediately fell from the sky.
On the other hand, the investigation into the origin of the domains confirms that this is a “seasonal” campaign, designed to hit during the euphoria of the end-of-year holidays. The domain arenacasino-official.com turns out to have been created on December 17, 2025. A “business” that claims to be official and circulates millions, in reality did not exist just three weeks ago. The use of the “-official” suffix is ??a typical red flag for sites created for data theft.
A story that repeats itself
Gambling moved massively online in Albania after Operation End of Folly in 2013, which closed down physical betting shops in the country. However, this closure created a vacuum that was quickly filled by the digital market and created space for such fraudulent schemes.
BIRN found that this is actually the second wave of scams of this nature. A similar scheme was launched in late 2024, where three casinos Grand Casino Tirana, International Casino Tirana and Arena Casino issued a joint public statement stating that they did not have online applications and urged their followers to beware of the scam.
"If you encounter this fake page or any suspicious activity, please report it to us immediately or report it to the Facebook and Instagram platforms," ??the companies warned.
AMLF official Valentino Loka told BIRN that at the time, attempts were made to block the sites, but because they operated through social networks, this became complicated.
The AMLF then attempted to block it by reporting it to social media, but this is a slow and time-consuming method. The authority has nevertheless continued to report the ads and their associated domains, although these usually replicate themselves by changing a few letters of the name. Loka told BIRN that this is an endless effort.
Since the ban on sports betting in the country, over 2,000 online gambling sites have been blocked./ BIRN