How Scammers Exploit the World Cup: A Deep Dive into Purchase Scam Tactics

Major sporting events draw significant consumer attention, creating fertile ground for scam artists. As fans scramble to buy tickets, merchandise, and travel packages, scammers respond by launching elaborate purchase scams that siphon off unsuspecting victims' money.

The Payment Fraud Intelligence team at Recorded Future has uncovered a troubling trend: a method known as SEO poisoning, which compromises legitimate websites to attract organic search traffic to scam sites. Scammers cleverly avoid the need for expensive SEO campaigns or advertising to achieve high search rankings by leveraging existing, reputable sites.

At its core, the purchase scam operation is straightforward: fake sites showcase enticing products at discounted prices, take the payment, and then deliver nothing. Often, these scams use social media ads to redirect traffic toward sites that impersonate well-known brands.

The impact of these scams doesn't stop with the loss of goods. Victims often find their payment card information stolen, resulting in unauthorized charges if not caught promptly.

Here's the kicker: rather than launching new domains that require substantial SEO work to gain visibility in search results, scammers embed malicious redirects into already-popular sites. Only users clicking through a specific search link trigger the redirect, while regular visitors see the legitimate site. This form of cloaking allows scammers to operate under the radar, making detection difficult.

Moreover, the fraudulent domains aren't indexed by search engines, effectively hiding the nefarious payment infrastructure from scrutiny. Only the compromised legitimate sites appear in search results, complicating investigations.

The financial advantage leans heavily toward the attackers. By capturing organic traffic without the costs typically associated with ads, scammers can largely evade detection by ad platforms and security measures.

Scammers build resilience into their operations. They rotate domains, alter branding, and distribute payments across multiple merchant accounts, enabling their schemes to persist even after individual sites or accounts are taken down.

Low-value targets get exploited. Scammers often target less obvious sites—like blogs or small business pages—where malware can be injected, monetizing these sites without needing high-value e-commerce frameworks.

The scale of these scams is significant. In preparation for the upcoming World Cup, the Payment Fraud Intelligence team identified a cluster of scams termed AEGIR, which encompasses 41 fraudulent domains linked through three merchant accounts. Since their creation, these domains have accrued approximately 26 million visits, with 17 million occurring just in 2026. A common image hash connects these domains to an additional estimated 1,714 sites.

The harm extends in two directions: consumers lose funds for products that don’t arrive, and legitimate brands incur reputational damage as their names are tied to these scams.

Event-driven demand amplifies the appeal of purchase scams. As eagerness builds among fans seeking World Cup tickets and merchandise, the web becomes a hunting ground for fraud, promising appealing deals that can lead to financial loss.

While many World Cup-related scams superficially appear identical, fraudsters are employing varied tactics to ensnare victims. The combination of redirected traffic from compromised sites and targeted social media advertisements broadens their net of unsuspecting victims.

In a specific instance noted by the Payment Fraud Intelligence team, 33 World Cup-themed scam domains were discovered linked to approximately 2,500 online ads. Many of these domains utilized multiple merchant accounts, highlighting a pattern where operators refresh their victim-facing domains while sustaining cash flow through established illegitimate infrastructures.

The threat doesn't just impact consumers; financial institutions also face repercussions. Risks span fraud, compliance challenges, and erosion of customer trust. Detecting and intervening in these scams is complex for banks, particularly when customer card data is stolen and resold on dark web marketplaces, resulting in ongoing fraudulent transactions that are difficult to trace back to the original scam.

Defensive measures against these tactics can be effective. Recorded Future identifies recognizable patterns, such as cloaking behaviors based on referrers, domain rotation, and merchant discrepancies. Their Payment Fraud Intelligence platform can monitor these factors, enabling early identification and disruption of scams before significant losses occur.

This resilient fraud model is likely to replicate and evolve with other event-driven opportunities for scammers. With the 2026 World Cup on the horizon, vigilance is essential to stave off widespread exploitation through these effective tactics.

For a deeper understanding of these scams and their underlying infrastructure, explore how Recorded Future monitors these trends through their Payment Fraud Intelligence service.

Enhance your cybersecurity strategy with insights from experts and comprehensive reports tailored to meet evolving threats.