World Cup Scams Are Getting Harder to Spot

AI-generated websites, deepfake videos, and polished phishing campaigns are making World Cup scams harder to detect as the 2026 tournament approaches, cybersecurity analysts warn. More than 13,000 FIFA-themed domains were registered between January and May 2026, with roughly one in 41 flagged as suspicious or malicious before a single match had been played [1]. The 2026 FIFA World Cup, cohosted by the United States, Canada, and Mexico, is the largest in history, with 104 matches across 16 cities [1]. FIFA estimates that more than 6 million fans will fill stadiums, and more than 150 million tickets were requested within the first 15 days of the sales window alone [1]. “The World Cup is the perfect opportunity for scammers—you couldn’t create a better one,” said David Holtzman, chief strategy officer at Naoris Protocol [1]. “This is soccer. It feels fun and harmless, which lowers people’s defenses.” [1] Research led by cybersecurity firm Group-IB identified more than 4,300 fraudulent domains impersonating FIFA’s official web presence, alongside six parallel fraud schemes and four independent threat actors [1]. Common scams include fake ticket sales, fraudulent immigration or visa-related services, and misleading accommodation offers [1]. Tarek Jammoul, regional managing director at TrendAI, noted that the threat categories have not changed dramatically since the 2022 tournament in Qatar. “At Qatar 2022, we saw fake streaming domains, data-bait survey scams, and crypto schemes using footballers’ likenesses. Those same categories are staging again now, only larger and more AI-polished,” Jammoul said [1]. Holtzman stated that there has been “an astronomical increase in scams over the past two years, and AI is a big reason why” [1]. The technology allows attackers to generate personalized, professional-looking emails at scale and build convincing fake websites [1]. Kristopher Russo, a principal threat researcher at Palo Alto Networks’ Unit 42, said consumers should recognize that traditional scam indicators are less reliable now [1]. “What consumers need to understand is that many of the old ways of identifying scams simply aren’t as reliable any more,” Russo said [1]. Defensive efforts are also leveraging AI. “We can predict what future attacks may look like by using the same technology attackers are using—but for defense,” Russo said [1]. Platforms and financial firms are collaborating through initiatives such as the Global Signal Exchange. Basma Ammari, director of public policy MENA at Meta, said the company worked with Visa via the exchange to identify and take action against a Facebook network using spoofed branding to collect personal or financial information [1]. The scale of the 2026 event has drawn comparisons to the bidding and hosting controversies that have followed recent World Cup cycles. The 2034 FIFA World Cup, formally confirmed to be hosted by Saudi Arabia in December 2024, has already attracted scrutiny over sportswashing and human rights concerns, according to reporting by The New York Times [8]. FIFA restricted hosting eligibility for 2034 to Asia or Oceania, a move observers characterized as bending its own rules to pave the way for Saudi Arabia’s bid [8]. The 2026 tournament’s massive digital footprint—spanning three host nations and 16 cities—has expanded the attack surface that cybercriminals can exploit, security researchers said [1].