With anticipation for the 2026 Fifa World Cup nearing fever pitch, criminals are looking to take advantage of the enthusiasm, a cyber security firm has warned.
Kaspersky is warning that with weeks to go until the big kick-off, there has been a rise in "scam activity" involving bogus World Cup tickets, fake websites and deceptive emails.
"Major sporting events that attract large audiences are never overlooked by scammers," said Anna Lazaricheva, a senior spam email analyst for Kaspersky. "Seemingly harmless or even appealing emails can often conceal not only dangerous links and malicious attachments."
Kaspersky shared screenshots of what it described as fraudulent websites. In one instance, a site provided the option to purchase tickets to various World Cup matches "with payments accepted in almost any currency" and used the event's colour scheme to mislead fans.
"After completing the fake registration and payment steps, users risk not only losing money from their bank cards but also exposing sensitive personal data to attackers," a news release from Kaspersky read.
Another fake website offers the chance to purchase World Cup merchandise such as shirts and plush toys, but Kaspersky said it is a ploy to obtain banking and credit card details. Kaspersky also said it was seeing a significant rise in phishing campaigns using language borrowed from World Cup advertisements.
Phishing campaigns involve using digital social engineering methods to try to manipulate people into clicking links that may extract and compromise data. In worst-case scenarios, phishing victims can lose control of their computers. Some of the emails seen by Kaspersky are designed to catch the attention of people who have plans to attend World Cup games.
"Fans received emails allegedly sent by official representatives of the event regarding a fake decision from a dispute resolution chamber," the company said, adding that the link in the email "leads to a phishing page".
In another instance, an email informs fans that they have won a "$500,000 grant to cover tickets, flights and accommodation, followed by instructions to contact the sender to claim the prize funds". This is a scam designed to drain bank accounts.
Kaspersky said it is best to exercise extreme caution when clicking links and responding to emails. Double-checking URL formats, spelling, grammar and punctuation can also help to identify fake websites, the company added. It also emphasised the need to be cautious about downloading and opening emailed attachments.
The warnings from the cyber security firm echo similar concerns from other entities about cyber criminals and hackers seeking to take advantage of emotions related to major events and even geopolitical tension.
Last week, the Abu Dhabi Emergencies, Crises and Disasters Management Centre warned the public that cyber attacks are likely to rise during times of confusion and fear, as these emotions can lead to "rushed digital decision-making without adequate verification”.
The 2026 Fifa World Cup will begin on June 11 and will take place in the US, Canada and Mexico.
