FIFA Ticket Scam Uses Fake Sites to Steal Card Data

Cybercriminals are exploiting excitement around the 2026 FIFA World Cup through a sophisticated FIFA ticket scam that targets football fans searching for tickets online. Researchers have linked the operation to Chinese-speaking threat actors who created convincing copies of official ticketing websites and promoted them through social media platforms.

The campaign goes beyond traditional phishing. Attackers actively monitor victims during the purchasing process, allowing them to capture payment card information and intercept banking verification codes in real time.

Fake Ticket Websites Mimic Official Platforms

Researchers discovered hundreds of fraudulent websites designed to look nearly identical to official FIFA ticket portals. The fake pages replicate legitimate branding, layouts, and purchasing flows, making them difficult for users to distinguish from genuine websites.

Victims searching for tickets are directed to these fraudulent pages through Facebook and Instagram advertisements. Once they begin the checkout process, attackers collect sensitive information, including payment card details and personal data.

Security experts warn that many of the websites appear professional and convincing. This increases the likelihood that fans will trust the pages and complete transactions.

Attackers Capture Banking Verification Codes

The operation includes technology that allows criminals to intercept one-time passwords and other verification codes used by banks. These codes are commonly required to approve online purchases and protect cardholders from fraud.

By obtaining both payment card information and authentication codes, attackers can bypass security measures that would normally block unauthorized transactions. This significantly increases the financial risk for victims.

Researchers described the campaign as more advanced than a standard phishing operation because it enables real-time interaction with victim sessions during the payment process.

Social Media Plays a Key Role

Facebook and Instagram serve as the primary channels for attracting victims. Fraudulent advertisements promote ticket sales and direct users to fake websites that imitate official World Cup services.

Researchers found connections between multiple scam domains and shared advertising infrastructure. This suggests that a coordinated operation is running the campaign across numerous websites and social media accounts.

The approach allows attackers to reach large audiences quickly while taking advantage of increased demand for tournament tickets.

Security Experts Urge Caution

Cybersecurity researchers continue to warn that major sporting events attract large-scale fraud campaigns. The popularity of the FIFA World Cup creates ideal conditions for scammers because fans are often eager to secure tickets before they sell out.

Users should purchase tickets only through official channels and avoid clicking on ticket advertisements shared through social media. Verifying website addresses before entering payment information remains one of the most effective ways to avoid fraud.

Conclusion

The FIFA ticket scam highlights how cybercriminals are adapting their tactics to exploit global events. By combining fake ticketing websites, social media advertising, payment card theft, and verification code interception, attackers have created a highly effective fraud operation. As the World Cup progresses, fans should remain cautious and verify all ticket purchases through trusted sources.