How Cybercriminals Are Exploiting the FIFA World Cup 2026
Poinews.com – As the FIFA World Cup 2026 nears, hackers are actively exploiting the online landscape to target fans. The event, featuring 104 teams competing across 16 cities in Canada, the United States, and Mexico, has become a prime opportunity for cybercriminals to launch scams. Governments in both Canada and the U.S. have issued alerts, urging spectators to remain vigilant against fraudulent activities. Below are key schemes identified by cybersecurity experts and what fans should watch for.
Fake Websites and Merchandise Stores
Cybercriminals have already established thousands of World Cup-themed websites, according to Fortinet and Check Point. These platforms mimic official FIFA pages to lure users seeking tournament updates or goods. A recent analysis revealed over 13,000 such sites registered between January and May, with approximately 8% deemed malicious due to deceptive tactics and scam patterns. The goal of these sites is to siphon personal details, payment information, and login credentials by duping fans into purchasing counterfeit tickets.
“These sites exploit urgency and scarcity to pressure rapid purchasing decisions,” Check Point noted.
Similar tactics have been observed at previous major events, including the 2022 World Cup and the 2024 Paris Olympics. Scammers often use messaging apps like Telegram to promote travel packages, redirecting users to counterfeit ticketing sites that mimic real checkout pages. Once payment is made, victims receive a fake invoice as confirmation.
Social Media Deception
In addition to traditional websites, cybercriminals have created 1,700 fake profiles on platforms such as Facebook and Instagram. These accounts mimic FIFA branding to spread misinformation and phishing attempts. The report highlighted that unofficial accounts increase the risk of brand abuse and fraudulent promotions. Fans are encouraged to verify domain names or email addresses before engaging with any World Cup-related content.
Phishing via Job Listings
LinkedIn has seen scammers circulate fake job postings, claiming to offer temporary roles in event management, hospitality, and media support. Hackers impersonate legitimate recruitment agencies, guiding applicants to phishing sites disguised as calendar schedules. These tactics aim to steal personal information under the guise of employment opportunities.
Fake Streaming Links
Social media platforms have also been used to distribute links to counterfeit streaming services. These URLs promise live coverage of specific matches, appearing just minutes before kick-off in private groups or channels. Users are tricked into entering their data quickly or downloading a spoofed “player” app to access the stream. However, Fortinet observed that many fans have already identified these fakes, often sharing concerns on forums like Reddit.
Despite these efforts, Euronews Next has yet to receive confirmation from platforms like Facebook, X, and Telegram about enhanced moderation or detection measures. Check Point recommends booking hospitality packages through FIFA’s official partner, On Location, and directly contacting hotels for reservations. With the tournament set to begin this week, awareness and verification remain critical to avoiding digital traps.
