our bank hosted a give away for prom flowers - prom attendees just had to like & share the post. now marketing has posted a congrats to the two kids that "won" - they mentioned first & last names - no photos of the kids - also - posted the bank's phone number with an employee name to contact - I have concerns - should I?

A generic "Congratulations to our winners" with private messages to the winners with contact information would have been better, and avoided the question altogether.

I don't know that you have an issue listing their names. There names are already public on your page because they "liked" and "shared" the status. You can find them in the list if you click on the number next to the function button on the original post, so everybody already knows they entered.

What about just listing them as something like John Q and Marie P?

Typically there are rules when anyone enters a contest that, via their entry, they are consenting to listing their names as winners. However, banks should be careful with all contests because they could go astray of regulatory requirements and state law. For the prom flowers contest, were students given the chance to enter the contest with just a 3" x 5" card, for example? The FDIC has great guidance on contests, and some states have laws for contests will ward off insomnia for weeks.