The 2026 FIFA World Cup is underway, and so is a wave of digital fraud that Kaspersky has been documenting for weeks. Researchers have identified more than 336 fake websites designed to look exactly like the official tournament page — and that is only what they have been able to detect. Fake tickets, fraudulent streaming, merchandise that never arrives, $500,000 prizes that do not exist and holiday rentals that vanish with your deposit. This article covers the active patterns so you know exactly what to avoid.
1. Fake ticket websites
Scammers build websites that replicate the official visual identity of the 2026 World Cup and accept payment in almost any currency. After completing the fake registration and payment steps, victims do not just lose the money from their bank card — they also hand their personal data over to the attackers.
Ticket prices for the 2026 World Cup have officially been described as the highest in tournament history. That financial pressure makes fans easy targets for websites offering tickets at "competitive" prices. If the price is significantly below the official rate, it is a scam.
How to verify: Official tickets are sold exclusively through tickets.fifa.com. Any other website is unofficial — and likely fraudulent.
🔍 Suspicious message?
Analyze senders, links or files in real time with our scanner.
2. Fake match streaming
Scammers create websites promising free access to live match streams. The moment a user clicks "Watch Now", they are prompted to sign up and pay for "lifetime access" to the entire tournament. The match never appears — but the payment details do.
How to verify: Check the official broadcast rights in your country. Any website offering exclusive free streaming of World Cup matches is fraudulent by definition.
3. Fake merchandise with aggressive discounts
Another detected variant offers "official" tournament merchandise — mascot plush toys, shirts, balls — at steep discounts. To appear credible, scammers add a "Trusted store" badge and a registration form requesting personal and banking details.
The product never arrives. The goal was never to sell — it was to capture card data.
4. The $500,000 "prize" email
Kaspersky has detected email campaigns in which attackers inform victims they have "won" a $500,000 grant to cover tickets, flights and accommodation at the World Cup, with instructions to contact the sender to claim the prize.
The pattern is identical to any unsolicited prize scam — if you did not enter an official FIFA draw, you cannot have won anything. The goal is to open a conversation that eventually leads to a request for an upfront payment to "process" the prize.
5. Fraudulent holiday rentals
Given the extremely high demand for accommodation during the tournament, property owners have also become a target. Fake websites impersonating well-known holiday rental platforms have been detected, requesting account credentials.
In April 2026, Kaspersky detected a campaign targeting users in Mexico that exploited the branding of a well-known transport app: a fake Spanish-language website prompted users to enter their phone number and password to "claim prizes".
6. Dark web offers
Some cybercriminals operate a level lower and post their offers directly on the dark web. Kaspersky Digital Footprint Intelligence detected threads on shadow forums advertising tickets, flights and hotel bookings at 20% discounts. These offers are designed to attract users and can result in victims losing both their money and any services they expected to receive.
Warning signs common to all these scams
- Domain that is not official: FIFA operates exclusively from fifa.com. Any variant with hyphens, numbers or a different TLD is fraudulent.
- Price too good to be true: Tickets, merchandise or accommodation with impossible discounts are the most common hook.
- Artificial urgency: "Only 2 tickets left", "Offer valid for 10 minutes", "Reply within 24 hours to claim your prize".
- Request for banking data by email or external form: No legitimate platform asks for card details outside its official payment process.
- Unsolicited prize: If you did not enter an official FIFA draw, you cannot have won anything.
How to analyse a suspicious World Cup email or message
If you receive an email, SMS or WhatsApp message related to the 2026 World Cup — tickets, streaming, prizes, accommodation — and you are not sure whether it is legitimate, paste it into the ORTSLAB scanner. The engine analyses the real sender, included links, domain authenticity and social engineering patterns in seconds.
If you have fallen victim to one of these scams and need to document it for a formal complaint or bank claim, Oscar Orts — a certified judicial computer expert — issues forensic reports on digital fraud with full legal validity.