Common World Cup 2026 scams and how to avoid them

The largest football World Cup in history will kick off in June, with 48 nations competing across the United States, Mexico, and Canada. With millions of fans expected to travel for the World Cup 2026, the risk of World Cup-related scams also increases.

Cybercriminals often take advantage of major global events to create themed scams and target fans. This guide outlines the most common World Cup scams for travelers and fans following along from home, as well as steps to help stay safe.

Common World Cup scams to be aware of

Scammers may use fan interest, limited ticket availability, and travel demand to make offers seem urgent or legitimate. Below are some of the most common World Cup scams and what to watch out for.

Fake or invalid tickets

Scammers often advertise fake or invalid tickets on fake websites, social media pages, or unauthorized resale platforms. You may make a payment and never receive a ticket or receive a fake or duplicate ticket.

Many victims only realize they have been scammed when they reach the stadium and are denied entry. In some cases, fraudulent websites may also attempt to steal your payment details. Remember, you should only buy World Cup tickets from official channels.

Learn more: How to avoid World Cup ticket scams

Fake hotel and accommodation listings

Hotel and accommodation scams often rise during major events like the World Cup. These scams can take many forms but often involve off-platform payments for a listing on a legitimate platform.

Scammers may also clone legitimate booking websites using altered domain names. These websites often advertise real properties without the owner’s knowledge or promote non-existent accommodations.

Red flags include prices that are too good to be true, listings posted on social media or messaging apps, and requests to pay for the booking outside the platform. You may also want to take a closer look at the offer if the photos appear to be altered.

It’s safer to book accommodation only through trusted platforms using their official app or website. If you need to contact the hotel or host, do so through the platform itself rather than through links sent by email or message, and avoid direct bank transfers or other unprotected payment methods.

Unofficial streaming websites

If you’re not traveling for the World Cup but plan to watch it at home, beware of unofficial streaming websites. Scammers may clone legitimate websites or lure you with promises of free live streams. While this may seem tempting, unofficial streaming and piracy sites may contain malware or malicious advertising. They may also be illegal, depending on your location.

Since these threats may compromise your device, it’s a good idea to check if a website is safe before engaging with it. Make sure you watch matches only through official broadcasters or licensed streaming platforms available in your region.

Fake merchandise stores

Team jerseys, scarves, hats, and other merchandise are always in high demand during the World Cup. This also creates an opportunity for scammers to set up fake merchandise stores, offering attractive deals. But you may receive counterfeit products or not receive the product at all, even after paying full price.

To avoid fake merchandise scams:

• Shop only from verified online stores.
• Be cautious of buying links sent through random text messages or social media marketplaces.
• Look for poor-quality markers, such as sloppy stitching, irregular markings, or missing labels. Criminals may use legitimate product photos and logos on their products, making it difficult to tell the difference.
• Avoid paying via crypto or direct bank transfer payments at the seller’s request.

Social media giveaway scams

Brands, businesses, and even football teams often run social media giveaways during the World Cup to drive engagement. However, scammers are also active during the tournament and may use giveaways to run social engineering scams.

They may impersonate a business, tag you in a comment saying you have won a giveaway, and then ask for financial details, such as bank account or credit card information, personal information, or login credentials to claim your prize. Other times, they may run completely fake giveaways of their own while impersonating popular brands.

Legitimate businesses do not need your financial information to give you a prize. Contact the business directly through its official website, email, or phone number if you want to verify the giveaway.

Betting scams

Betting and prediction market scams are another way fans can get targeted during the World Cup. Scammers may clone legitimate websites or create fake betting apps to lure fans. Victims may deposit money only to find it is never credited to their account, or that withdrawals and payouts are blocked.

Another common tactic is for scammers to pose as confirmed tipsters or insiders who claim to have reliable knowledge about upcoming matches. They often ask for an upfront payment in exchange for a limited-time bet with a guaranteed return.

Before placing a bet on an unfamiliar site, it’s a good idea to check user feedback on forums and review sites. You can also check whether the site is registered with a recognized betting authority. If you’re contacted on social media or a messaging platform about placing a bet, it’s best not to engage.

Stranded traveler scam

With many fans traveling abroad for the World Cup, scammers may take advantage of this by impersonating stranded travelers. If your social media accounts have been compromised, scammers may post public stories or send direct messages to your friends and family claiming that you have been stranded abroad.

They often create a sense of urgency, claiming that you have been robbed or lost your wallet and passport, and that you need money immediately to pay bills or return home.

If you receive such a message from a friend, first contact them directly rather than sending money right away. If it is your account that has been compromised, secure your social media accounts, reset passwords, and proactively warn friends and family not to engage with suspicious messages sent under your identity.

ATM and card skimming fraud

During the World Cup, fans often use cards for payments or withdraw cash from ATMs while traveling between venues, hotels, and local businesses. Scammers may use ATM and POS skimming devices to steal card details.

These skimmer devices may be installed on the card reader or payment terminal, along with pinhole cameras or fake keypad overlays that capture PIN entries. Once collected, the data can be downloaded or transmitted wirelessly for later use in fraud.

Compromised ATMs and card readers are typically hard to spot since they’re designed to blend in. One of the simplest ways to help protect your accounts when using a card is to use contactless payment instead of swiping or inserting your card.

If contactless payment isn’t available, here are some tips for using your card at the World Cup:

• Inspect ATMs and POS terminals before use. Look for anything loose, damaged, or unusual.
• Pull at the edges of the keypad before entering your PIN.
• Cover the keypad when entering your PIN to help prevent hidden-camera recordings.
• Be extra cautious when using ATMs or card terminals in tourist areas or crowded places such as World Cup stadiums.

QR code payment scams

While on your World Cup trip, you'll likely be scanning QR codes for restaurant menus, parking, or payment portals. QR codes offer a convenient way to access services and make payments, but they can also be used in phishing scams.

For instance, a seemingly legitimate QR code might lead to credential-harvesting login pages, fake customer support portals, or redirect payments to a malicious party.

To stay safe from QR code scams:

• If the QR code has been scratched, taped over, or layered on top of another code, it may indicate tampering.
• Some devices show a preview link before opening the site. Inspect the URL carefully. If you notice inconsistencies, such as unfamiliar domains, misspellings, or unsecured (HTTP) connections, do not proceed.
• Be cautious of QR codes that create a sense of urgency or ask for unnecessary sensitive details.
• If you're unsure whether a QR code is legitimate, confirm its authenticity with a nearby representative.

Fake customer support scams

Fake customer or tech support scams are another way scammers may target World Cup fans. They impersonate legitimate customer support representatives and redirect victims to fake customer service agents via messaging platforms.

A victim might receive a message claiming that their ticket payment must be reverified and that they must do so by clicking a link. Under the pretense of helping with an issue, scammers often ask for remote access to a device or financial information. These scams may also begin through pop-ups, online advertisements, unsolicited text messages, emails, or phone calls.

Travel documentation scams

Scammers may lure users to websites that claim to help them with visa or passport renewals for a fee. Victims may pay to receive a simple PDF form that is available for free through official government websites.

Other times, these websites claim to offer expedited processing or fast-track visa programs for high fees. In more serious cases, they may trick you into entering personal information such as passport numbers, national ID numbers, phone numbers, or even addresses, all in the name of offering travel documentation assistance.

Make sure to apply for visas through official government websites and channels. If you have already purchased World Cup tickets, check official government visa websites for any priority appointment options or travel guidance related to the tournament.

General safety tips to avoid common World Cup scams

Watch out for phishing messages and fake apps

World Cup scams may start with phishing messages delivered via email, SMS, or other messaging apps. These messages usually contain a malicious link that, when clicked, may compromise your device or redirect you to a fake login page that asks you to enter your credentials.

World Cup phishing campaigns can create a false sense of urgency by claiming there’s an issue with your World Cup tickets, travel bookings, or account verification. Some messages may also appear to come from official ticketing platforms, making them seem legitimate.

Additional hints to help you identify phishing attacks this World Cup:

• Use of coercive language: The message uses threats, warnings, or deadlines, often related to ticket cancellation, payment verification, or account issues.
• Generic greetings: Messages that start with "Dear Customer" are likely phishing attempts, as official communications typically address you by name.
• Different sender address: Phishing emails often try to mimic official ticketing platforms, but the domain or sender name may include extra characters or misspellings.
• Links and attachments: Most phishing messages include suspicious links or attachments that often claim to be tickets, confirmations, or travel documents.

Keep your devices up-to-date

Scammers often exploit unpatched operating systems and app vulnerabilities to compromise devices. Vendors release regular updates to fix these security flaws, but if you continue using outdated software, you may face a higher risk of attack.

Before traveling for the World Cup, make sure all your devices and important apps are fully updated. Enable automatic updates where available, and install updates only through official device settings or trusted app stores.

Use two-factor authentication

A password alone may not be enough to protect your accounts, as credentials can be exposed through phishing attacks or data breaches. Make sure you use two-factor authentication (2FA) on all your important accounts. 2FA adds an extra layer of protection beyond a traditional username and password.

This means that even if your password is compromised, a scammer can’t access your account without the second verification step. The second factor may be a temporary code sent to your device or generated by an authenticator app that refreshes every few seconds.

Turn on Find My Device or Find My iPhone

If your phone is lost or stolen during the World Cup, scammers may use access to send messages or attempt unauthorized transactions. You can turn on Find My on iOS or use Find Hub on Android when traveling to crowded places.

Android’s Find Hub helps you locate lost or stolen devices. It allows you to remotely lock your device without a PIN or password and display a custom message on the lock screen for anyone who finds it. If you suspect the device has been stolen instead, you can also permanently wipe all your data to prevent misuse.

Apple also offers a similar Find My app, which lets you play a sound, lock the device in Lost Mode, or erase it remotely to protect your data.

Learn more: What to do if your phone is lost or stolen during the World Cup

Use a VPN on public WiFi

If you're traveling for the World Cup, you will likely use public Wi-Fi at hotels, cafés, airports, or stadiums. While they’re convenient and offer free internet, public Wi-Fi networks are often unsecured or shared, which increases the risk of packet sniffing, man-in-the-middle (MITM) attacks, and malware injection.

This is why you should use a VPN during the World Cup. A VPN like ExpressVPN creates a secure, encrypted tunnel between your device and the VPN server, protecting your data from anyone on the same network. It also masks your IP address, making it harder to track your activity or identify your location.

Set spending limits and card controls

Since you'll be making several payments while traveling for the World Cup, it's a good idea to set spending limits on your card or account beforehand. Most banking apps allow you to set daily or per-transaction limits as a personal finance control.

This can also help limit financial damage if your card is lost, stolen, or compromised, as unauthorized transactions cannot exceed the set limit.

What to do if you fall prey to a World Cup scam

Even with caution, it’s possible to fall prey to a scam while traveling. The first step is to stay calm and act quickly. Here’s what you should do:

Freeze or lock your bank cards immediately

If you’ve been scammed, freeze or lock your bank accounts and cards immediately to prevent further damage and keep your online accounts safe during the World Cup.

Many banking apps offer an option for this directly. If you can’t find it, contact your bank immediately, explain the situation, and ask for help.

You might also be able to freeze your credit, which prevents anyone from opening new credit accounts in your name.

Change passwords to important accounts

Change passwords for all important accounts, including banking, social media, and email. Make sure your passwords are strong and unique. You can also use passphrases to make them more secure yet easy to remember.

Avoid using the same password across multiple accounts, as a breach of one account can trigger a domino effect. You can also use a password manager such as ExpressKeys to generate and securely store strong passwords.

Review all your accounts

After securing your accounts, review them for any suspicious activity. Check your bank and credit card statements for any unauthorized transactions and report any unauthorized transactions immediately.

Also, check your social media accounts for unauthorized posts or messages. Scammers may impersonate you to ask your friends or family for money.

Save screenshots, emails, and receipts

The next step is to collect all evidence related to the scam. This includes:

• Taking screenshots of all communication between you and the scammer, clearly showing their names and the titles they used.
• Taking screenshots of social media profiles, group chats, posts, and any other online interactions you may have had with them.
• Saving the website URLs, email addresses, and phone numbers used during communication.
• Downloading and saving your recent credit card statements and transaction IDs. Likewise, if you have used cryptocurrency, store all relevant transaction details.

All these details will be useful when you file a complaint with the relevant authorities.

Report the scam to local authorities

Once you have collected all the necessary proof, you can file a complaint with the appropriate authority. For instance, for the World Cup in the U.S., you can report the scam to the Federal Trade Commission (FTC) or the FBI’s Internet Crime Complaint Center (IC3).

If you are in Canada, report it to the Canadian Anti-Fraud Center or the Competition Bureau Canada. In Mexico, you can file a complaint with Procuraduría Federal del Consumidor (PROFECO).

You can also report the incident to the local police, especially if it involves theft or financial fraud. Reporting scams helps authorities track patterns and prevent others from becoming victims.

Contact your embassy or consulate if needed

Contacting your embassy or consulate can be a last resort if you are stranded in a foreign country without access to money, identification, or travel documents. This may happen if your passport, wallet, or important belongings are lost or stolen.

Reach out to your nearest embassy, explain your situation, and arrange a visit if required. Consular officers can help you obtain emergency travel documents, contact family for financial assistance, or coordinate with local authorities.

However, note that financial losses from scams (for example, fake betting sites or phishing attacks) typically do not qualify as consular emergencies.