World Cup 2026 Scams: Fake Betting Apps, 'Free Stream' Malware, and the Data They Steal

The 2026 World Cup is live, and so are the scams: fake betting apps, malware 'free streams' and cloned FIFA ticket sites are after your data and money.

Image: a football stadium (illustrative; not a 2026 World Cup venue) · Photo: Alex ‘Florstein’ Fedorov / Wikimedia Commons · CC BY-SA 4.0 · source

The 2026 FIFA World Cup is the biggest yet, 48 teams and 104 matches across the United States, Canada and Mexico, and it is in full flow through the knockout rounds. Wherever a billion people are watching, scammers follow. This tournament has already drawn a specific FBI warning, a record-breaking US takedown of pirate streaming sites, and cybersecurity firms tracking thousands of fake World Cup domains. The lures are familiar, fake tickets, free streams, prize giveaways, and above all betting apps, but the goal is the same: your money and your personal data. Here is what is actually happening, and how to stay out of it.

On this page

Why the World Cup is a scammer's dream
The fake ticket trap
“Watch it free” and the malware behind it
Sports-betting apps: the biggest data risk
Prizes, merch and prediction groups
The scams at a glance
How to protect yourself
FAQs
Sources

41Spoofed FIFA ticket and merchandise sites named in the FBI's May 2026 warning

~400Illegal streaming domains seized by the US Justice Department in one operation

270,000+Fan logins found in info-stealer malware logs, per FortiGuard Labs

Why the World Cup is a scammer's dream

A global tournament combines the four things fraudsters need most: mass attention, urgency, money changing hands, and millions of people acting outside their usual routines. Fans rush to buy scarce tickets, hunt for a stream when the official broadcaster is not available in their country, and place bets in the heat of a match. That mix of excitement and haste is exactly when people click links they would normally ignore. Security vendors are watching the surge in real time. FortiGuard Labs reported more than 13,000 World Cup-themed domains registered between January and May 2026, of which it flagged roughly 8.8% as malicious or suspicious. These are not comparable to other counts you may see, each firm measures a different slice, but the direction is unmistakable: a flood of tournament-branded infrastructure built to catch fans.

The fake ticket trap

Tickets are the classic World Cup scam, and 2026 is no exception. On 27 May 2026, the FBI's Internet Crime Complaint Center (IC3) issued a public warning about typosquatting sites impersonating FIFA's official ticketing and merchandise pages, listing 41 specific fraudulent domains and cautioning that “new websites will continue to appear.” Around the same time, the security firm Group-IB detailed a campaign it named GHOST STADIUM, run by a Chinese-speaking group using a custom kit to clone fifa.com. Group-IB says it tracked more than 4,300 fraudulent FIFA-impersonating domains since August 2025, with 300-plus active phishing sites at once, and that the operators bought social-media ads to drive fans to the fakes. Group-IB's estimate of victim losses, in the tens to hundreds of millions of dollars, is an extrapolation from a sample rather than a confirmed total, but the scale of the operation is real.

The defence is simple. The only legitimate way to buy or resell a 2026 ticket is through FIFA's official platform at fifa.com/tickets and its official Resale and Exchange marketplaces. All World Cup tickets are digital only. Anyone selling a paper ticket, a PDF or a screenshot is selling you nothing.

“Watch it free” and the malware behind it

When your country's official broadcaster is paywalled or unavailable, the temptation to search “watch [match] free” is strong, and scammers own those search results. On 29 June 2026, the US Department of Justice announced Operation Offsides, seizing nearly 400 domains that were illegally streaming World Cup matches, its largest sports-piracy takedown to date and roughly five times the 78 domains seized during Qatar 2022. The operation was framed mainly as copyright enforcement, but investigators flagged the security cost too: a Homeland Security Investigations agent warned that illegal streams “expose viewers to potential threats, including malware attacks and unsecure connections that can compromise personal and financial data.”

Kaspersky, which counted more than 336 fake “official” World Cup sites in June 2026, documented a common trick: a fake streaming page asks you to register, then demands a cryptocurrency payment for “lifetime tournament access,” takes the money, and delivers no stream. Others simply harvest the card details you type in. The safe move is to stick to the official rights-holder in your country, and to treat any “free HD stream” that wants a card number, an app install or a crypto fee as a trap.

Sports-betting apps: the biggest data risk

Betting is where the money and the data risk are highest, and it is the most complicated piece because the law is completely different depending on where you are.

Picture the bait: a WhatsApp message with a slick graphic, “Watch Mexico vs Portugal free + get ₹5,000 bonus, download now,” linking to an app you install from a link rather than an official store. Apps delivered this way are the danger zone. To “verify” you, a rogue betting app asks for identity documents, in India that means Aadhaar and PAN, plus bank or UPI details, and often demands sweeping Android permissions (contacts, SMS, storage). That is a full identity-and-finance profile handed to an operator you cannot trace, who may rig the odds, refuse withdrawals, or simply vanish with your KYC data. Harvesting Aadhaar, PAN and bank details through fake or trojanised apps is a well-documented pattern, even though no World Cup-specific government advisory names a single case.

India: real-money betting is now broadly illegal. The Promotion and Regulation of Online Gaming Act, 2025 came into force with its rules from 1 May 2026 and bans essentially all “online money games,” whether based on skill or chance, with only narrow carve-outs for recognised e-sports and non-wagering social games. Penalties reach three years in prison and a ₹1 crore fine for operators, and up to two years for advertising. The government has blocked well over a hundred offshore betting apps, including names like 1xBet, as part of a sweep of thousands of gambling URLs, and the Enforcement Directorate has pursued networks such as the Mahadev Book for money laundering. Enforcement is not airtight: mirror sites and VPNs keep the offshore apps reachable, which is exactly why they lean on tournaments to recruit new users. One important caveat: the 2025 Act is a sharp reversal of India's earlier licensing approach, and legal scholars are already questioning whether a blanket ban on skill-based games will survive constitutional challenge, so the framework may yet shift.

Elsewhere: the picture is different. In the United States, sports betting has been legal since the Supreme Court struck down the federal ban in 2018 and is now regulated state by state in dozens of states, but offshore books that take US bets remain illegal. The United Kingdom licenses betting through the Gambling Commission, and the EU regulates it at member-state level. The universal rule, wherever you are: only ever use a licensed operator regulated in your own jurisdiction, and never one pushed to you through a WhatsApp link, a Telegram group or a “free stream” ad.

Prizes, merch and prediction groups

Around the marquee scams sits a ring of smaller ones. The FBI's alert specifically flags “prize-based reply-back fraud,” the classic “you've won World Cup tickets” email that harvests your details or an advance fee; Kaspersky spotted emails dangling a fake “$500,000 FIFA grant.” Counterfeit merchandise shops take your card and ship nothing. WhatsApp and Telegram “match prediction” and “betting analytics” groups charge fees for guaranteed tips that do not exist, and double as a funnel into the rogue betting apps above. FortiGuard also found more than 270,000 fan credentials, and even 260-plus FIFA employee logins, already circulating in info-stealer malware logs, a reminder that reused passwords from a fake login page can outlive the tournament by years.

The scams at a glance

Scam	The bait	What they take	The tell
Fake tickets	Cloned FIFA site or a “spare ticket” on social media	Card details, payment	Not fifa.com/tickets; a paper/PDF/screenshot ticket
Free streaming	“Watch [match] free HD”	Card details, malware, a crypto “access” fee	Asks for a card, an app install or crypto to watch
Rogue betting app	“Download + bonus” link, not an official store	Aadhaar/PAN/bank KYC, device permissions, deposits	Installed from a link; demands ID and heavy permissions
Prize / lottery	“You won tickets” or a “FIFA grant” email	Personal data, an advance “fee”	You never entered; pay-to-claim
Prediction / tips group	“Guaranteed” WhatsApp/Telegram tips	Fees, then a push into a rogue app	Sure-thing promises; upfront payment

How to protect yourself

Buy tickets only at fifa.com/tickets. Type the address yourself; do not click ticket links in ads, emails or social posts. Real tickets are digital only.
Watch on the official broadcaster in your country. Treat any “free stream” that wants a card, an app or a crypto fee as a scam.
Never install a betting or streaming app from a link. If you bet where it is legal, use only a licensed, regulated operator, downloaded from the official app store.
Guard your KYC. No legitimate app needs your Aadhaar, PAN and full bank details just to let you watch a match or claim a bonus. Do not hand them over.
Ignore “you won” and “guaranteed tips.” You cannot win a lottery you never entered, and no one can guarantee a bet.
Use unique passwords and two-factor authentication. Credentials stolen on a fake login page are resold for years; a unique password limits the damage to one site.
Report it. In the US, report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. In India, call 1930 and file at cybercrime.gov.in.

Frequently asked questions

Where can I safely buy World Cup 2026 tickets? Only at FIFA's official site, fifa.com/tickets, and its official resale and exchange marketplaces. All tickets are digital; paper, PDF or screenshot tickets are fake.

Are free streaming sites actually dangerous? Yes. Beyond being illegal, investigators warn they expose you to malware and to pages that steal card and personal data. The US seized nearly 400 such domains in a single 2026 operation.

Is it safe to use a betting app during the World Cup? Only if betting is legal where you live and the operator is licensed and regulated there, and you install it from the official app store. In India, real-money betting is broadly illegal under the 2025 Online Gaming Act, and the offshore apps advertised around the tournament are exactly the ones that harvest your Aadhaar, PAN and bank data.

A betting app wants my Aadhaar, PAN and bank details. Is that normal? Treat it as a red flag. Rogue apps demand full KYC and sweeping phone permissions, then rig odds, block withdrawals or disappear with your data.

I clicked a fake ticket or stream link. What now? If you entered card details, call your bank to freeze or dispute the charge, change any reused passwords, and report it (ic3.gov and reportfraud.ftc.gov in the US; 1930 and cybercrime.gov.in in India).

Sources

If you have been targeted by a scam like this, you are not alone. See our cybercrime help hub for step-by-step reporting and recovery guides.