AI-fueled World Cup ticket scams surge ahead of 2026

What happened

Cybercriminals are using AI-generated websites, deepfake videos, and convincing phishing campaigns to impersonate FIFA and related organizations ahead of the 2026 FIFA World Cup. More than 13,000 FIFA-themed domains were registered between January and May 2026, with roughly one in 41 identified as suspicious or malicious by early May. Research identified more than 4,300 fraudulent domains impersonating FIFA's official presence, alongside six parallel fraud schemes and four independent threat actors.

Why it matters

The old warning signs—suspicious email addresses, broken English, obvious typos—are disappearing. AI is making attackers far more efficient by generating highly personalized, professional-looking emails at massive scale and helping them create convincing fake websites. The tournament's scale amplifies the risk: more than 150 million tickets were requested within the first 15 days of the sales window, making this edition approximately 30 times oversubscribed compared to previous tournaments, and roughly 6 million fans are estimated to fill stadiums.

What to watch

Common scams include fake ticket sales, fraudulent immigration or visa-related services, counterfeit merchandise, and newer tactics such as QR code scams, where attackers place malicious codes over legitimate ones in public venues. While cybersecurity firms are using AI for defense—analyzing data to detect unusual patterns and anticipate threats—experts warn that technology alone may not be enough, and fans should rely on collaboration between platforms, cybersecurity firms, and law enforcement to identify and disrupt coordinated scams.