The cybersecurity firm published its findings on June 24, warning that fraudsters are exploiting fans' demand for match access and tournament tips. The scams include Spanish-language sites, pointing to coordinated, multi-regional operations rather than isolated incidents.

The domain count from Kaspersky is likely a fraction of the true scale. FortiGuard Labs tracked more than 13,000 new FIFA-themed domains registered between January and May 2026 alone, flagging 8.8% as malicious or suspicious. CybelAngel separately identified 344 domains actively cloning the official World Cup site, 125 of which were live and serving content as of June 9. The Canadian Centre for Cyber Security documented more than 4,300 fraudulent FIFA domain registrations, many pairing "fifa" with host-city names such as "fifawcdallas.com."

The FBI issued a formal advisory on May 27 (IC3 PSA260527) warning specifically about typosquatting techniques, including lookalike domains such as "fiffa.com" and fake subdomains like "jobs-fifa.com."

How the Scams Work

Fake streaming sites are a common entry point. They advertise free match access and then redirect visitors to registration pages demanding a cryptocurrency fee for "lifetime tournament access." Because crypto transactions are irreversible, victims have no recourse once funds leave their wallets.

"The danger of this scheme lies in the potential loss of both registration data and cryptocurrency funds," Kaspersky noted in its report.

Fraudulent betting and prediction platforms take a different approach, collecting full names, national IDs, phone numbers, and email addresses during account creation, then following up through WhatsApp to evade detection.

A separate scam variant involves phishing emails offering a USD 500,000 "grant" from supposed FIFA representatives, asking recipients to hand over personal and financial details to claim travel funds.

A fourth variant targets fans seeking an analytical edge. Phishing emails advertising fake football analytics services deploy artificial urgency, with subject lines such as "ONLY 10 SPOTS AVAILABLE," and demand fees often exceeding USD 200. Kaspersky identified this approach as a distinct and growing component of the World Cup fraud ecosystem.

Olga Altukhova, a Senior Web Content Analyst at Kaspersky, offered a clear recommendation for fans: "We recommend that users stick to official broadcasts to help protect their data and finances."

The Crypto Trail

Blockchain analytics firm TRM Labs examined scam-linked addresses connected to the World Cup fraud wave, finding that at least four identified wallets had already received funds, with proceeds moved through a Polygon-to-Tron bridge to obscure the trail. The total received across those identified wallets was less than USD 1,700, a figure that signals early-stage operations rather than mature laundering networks.

TRM Labs notes that Tron is a preferred settlement network in many developing-world fraud ecosystems because of its low transaction fees and high stablecoin liquidity, particularly USDT on the TRC20 standard.

Globally, roughly USD 35 billion flowed to scam-linked wallets in 2025, according to TRM Labs' 2026 Crypto Crime Report, with investment fraud accounting for 62% of those inflows.

Regional Exposure: Pakistan and Africa

The impact is acute in markets where crypto adoption is high but consumer protection infrastructure is thin. Pakistan ranks third globally for crypto adoption, behind India and the United States, with an estimated 18.2 to 27 million crypto users. The Pakistan Virtual Assets Regulatory Authority was established only in 2025 under the Virtual Assets Ordinance, and financial literacy among Pakistani adults sits at roughly 26%, according to State Bank of Pakistan data.

The country recorded more than 500 cybersecurity incidents in 2025, a 35% increase from 2024, driven by the same attack vectors being used in World Cup campaigns: phishing, WhatsApp scams, and financial fraud. Banking malware detections exceeded 166,000 and spyware incidents topped 126,000 in the same period, underscoring the breadth of the threat landscape facing Pakistani users.

For many Pakistani fans, official broadcast subscriptions are out of reach financially, making fake "free streaming" offers especially hard to dismiss.

In Kenya, the sports-betting sector recorded the country's highest suspected fraud rate at 15.6% in 2025, with a 97% year-over-year surge in fraud volume, according to TransUnion data. The median loss per fraud victim reached KES 108,132 (approximately USD 836), the highest among surveyed African nations.

Nigeria, with around 25.9 million active crypto users and a strong culture of peer-to-peer crypto trading via WhatsApp and Telegram, is a prime target for fake token airdrops and giveaway schemes tied to the tournament. FortiGuard Labs found that nearly 90% of the 1,700-plus FIFA impersonation accounts it identified across social media were concentrated on Facebook and Instagram, the dominant platforms across the region.

What Comes Next

INTERPOL concluded a major Africa-focused anti-scam operation in June 2026, resulting in 651 arrests and the recovery of USD 4.3 million, a sign that enforcement is intensifying even as scam infrastructure expands.

Security industry reporting indicates the total count of World Cup-related fraud domains has already surpassed 19,000. Compounding the threat, researchers have documented AI-generated phishing kits equipped with real-time multi-factor authentication bypass capabilities, a development that significantly lowers the barrier for sophisticated credential theft at scale. For fans in markets with limited official broadcast access, both trends point to a fraud wave that will keep building through the tournament's conclusion.

Kaspersky's Anna Lazaricheva put the underlying logic plainly: "Major sporting events are never overlooked by scammers. Seemingly harmless emails often conceal dangerous links and malicious attachments."