Cybersecurity researchers warn that World Cup 2026 scammers are using AI-generated images, fake websites, and official-looking branding to make scams harder to detect than ever before.
Fans are being targeted through fake World Cup visas, bogus LEGO and Panini collectible stores, and fraudulent crypto coins designed to steal money, personal data, and digital wallet access.
Experts say consumers should avoid clicking links from ads or social media, double-check website URLs, and be wary of high-pressure sales tactics, countdown timers, and deals that seem too good to be true.
As excitement builds for the 2026 FIFA World Cup, cybersecurity experts are warning that scammers are already gearing up.
While fake ticket sales have long been a concern surrounding major sporting events, researchers at Malwarebytes say criminals are now using far more sophisticated tactics to target fans’ money, personal information, and even cryptocurrency wallets.
ConsumerAffairs spoke with Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes, who explained that scammers are creating convincing fake websites, AI-generated images, and official-looking branding tied to the World Cup to trick consumers into letting their guard down.
The scams range from bogus travel visas and fake collectible stores to fraudulent crypto tokens and unregulated betting platforms — all designed to capitalize on the hype surrounding one of the world’s biggest sporting events.
The scams are getting harder to spot
Shalev explained that the most current World Cup scams aren’t as easy for consumers to spot.
“Previously, consumers would see more obvious red flags like typos, awkward phrasing or pixelated imagery,” he said. “AI has helped scammers step up their game.”
“Today, AI-generated images, text, and cloned websites are making scams, including these new examples from the World Cup, significantly harder to spot. Year-round, cybercriminals are leveraging AI tools to generate deepfakes, storefronts and advertisements that mimic legitimate companies flawlessly. Scammers leverage cultural moments and seasons to target consumers in new ways.”
Some other signs to look out for:
High-pressure tactics
Fake inventory counters
Unrealistic deals
Malicious ads
Complex site redirects that send users to a different domain than the one they clicked
Integrating scams with popular brands, big events
These scams can take many forms, and scammers have gotten creative at incorporating popular brands and working around major events, like the World Cup, to start their schemes.
Shalev broke down three of the most popular scams geared towards the World Cup right now – the fake World Cup Visa scam, LEGO and Panini scams, and World Cup crypto scams.
World Cup Visa Scam
Here’s how it works:
Sites like "WC2026 Visa" are charging a fake $270 fee under the guise of an expedited tournament entry document.
The reality is that there is no special tournament visa.
The US government has confirmed that visitors must use standard B1/B2 visas or the Visa Waiver Program with an ESTA authorization.
“Beyond the $270 financial loss, the long-term risks are serious,” Shalev said. “By filling out these forms, fans hand over personal data like their full name, passport numbers, date of birth, travel logistics, and payment information. This gives cybercriminals the information to use for their own gain or package and sell for additional identity fraud activities.”
LEGO and Panini Scams
LEGO announced a partnership with FIFA in late 2025, so that part of the scam is legitimate – and what can confuse unassuming consumers.
However, where things get dicey is that scammers take advantage of consumers looking for collectible jerseys, trophies, and other World Cup memorabilia. Scammers exploit this by spinning up targeted storefronts that pretend to sell these niche products.
“These sites often use quiz-funnel scams to secure contact info or hide subscription billing flows disguised as shipping fees. Fans click on sponsored ads or social links looking for a hard-to-find item, only to have their credit card harvested by a site that will vanish shortly after the tournament ends.”
Similarly, Panini is the international distributor for stickers, trading cards, and other sports memorabilia. Scammers create websites that are lookalike versions of the legitimate Panini site, often with countdowns to inventory running out and other urgency tactics. If consumers order items from these sites, not only is there risk that they may never come, but their information is also stored for future scams.
Crypto Scams
“While FIFA has a real digital ecosystem (FIFA Collect, Right-to-Buy NFTs), it is strictly documented on FIFA-controlled domains, not third-party community token sites,” Shalev said.
“The first red flag is the claim itself. If a token claims to be an ‘official community coin’ or product of FIFA, stop right there. Once a fan engages, they either receive nothing, receive something they can’t sell, or sign a transaction that gives the operator access to their entire digital wallet.”
Protect your identity and your money
Shalev shared his top tips to help consumers protect their identities and their money during the height of these World Cup scams:
Go direct, and check URLs: Never click a link from an ad, text, or email. Look closely at the website address. Type FIFA.com or LEGO.com directly into your browser and avoid URLs like "official-worldcup-tickets.com.”
Ignore the clock: If a site has a countdown timer or says "only 100 left" to pressure you into buying, it’s likely a scam.
Watch out for Facebook groups: Facebook groups have been a hotbed for scammers. There is no reason to buy from Facebook groups, as they are very hard to authenticate.
Use a guard: Use free tools like Malwarebytes Scam Guard or Browser Guard to help you verify sites and offers in real time.
If you’ve been scammed: If you realize you’ve been compromised, do not wait. If you shared financial details, alert your bank immediately. If you shared personal data, drop an immediate credit/fraud alert on your profile and report the incident straight to the authorities.