FIFA World Cup 2026: fraud and payments lessons from the biggest tournament yet

A true stress test for the payments industry, the 2026 World Cup has been as much a payments and fraud event as a sporting event. Tickets, accommodation, merchandise, and even job offers became targets for fraudsters, all while cross-border strain took the centre stage. With the World Cup final just days away, The Paypers’ Diana Vorniceanu takes a close look at the impact this football event has had on the payments industry and the key lessons merchants can take away from it.

Hosted in North America (across the US, Canada, and Mexico), the 2026 edition of the World Cup ran 104 matches that pitted 48 teams against each other over 39 days, a significant increase from the 2022 Qatar edition, which brought together 32 teams and featured 64 matches. More matches meant more buyers, more money, and more cross-border transactions than any tournament before.

Official prices pushed fans toward scammers

By June 10, 2026, FIFA announced that it had sold more than six million tickets, with demand rising tenfold from the previous edition. However, many of the fans who queued up online were shocked at the cost. For the first time in its history, FIFA used dynamic pricing, moving the price of admission to a match based on interest from buyers.

As a result of the use of dynamic pricing, for the 2026 World Cup, prices for group-stage games that were originally set at up to USD 575 (a significant increase from USD 220, the price of the most expensive group match tickets at the 2022 World Cup in Qatar) ended up being priced at USD 1,000 at the first round of resales.

To put this into perspective, according to the London School of Economics and Political Science, adjusted for inflation, between 1994 and 2022, a premium Category 1 seat for the final averaged at around USD 1,300. The equivalent seat in 2026 costs USD 32,970, almost 25 times higher. The cheapest final tickets went from USD 540 to USD 4,185.  

Many fans priced out of official channels went looking for cheaper tickets elsewhere, and unofficial channels are where scams live. As per recent research from emerchantpay, younger consumers took the brunt of the fraud risk. 19% of Gen Z World Cup fans stated that they are willing to buy tickets from unofficial sites regardless of the associated risks. Gen Zers were also more exposed to risky travel content, with 43% saying that they had seen more potentially fraudulent travel content on their social media pages over the past year, a significant increase from the 34% UK average.

The cross-border strain and the resulting lessons

Cross-border payments always carry a lag between when a buyer pays and when the settlement happens, and the 2026 World Cup, with money arriving from around the world and settling in three currencies, made that gap impossible to ignore.

Yael Klein, SVP - Business Development, Travel at Nium, explains:

The strain surfaced in the gap between payment and settlement – a structural feature of cross-border payments generally, not unique to this tournament, but sharply exposed by it. With 2.6 million international visitors moving across three countries and three currencies in six weeks, a traveller paying in USD often meant a merchant expecting settlement in CAD or MXN. Traditional correspondent banking batches those conversions on fixed cycles rather than settling them instantly, so when booking demand spiked around team progression, exchange rates moved while transactions sat in the queue. Merchants had no visibility into settlement timing and no way to lock in a rate until hours later.

The practical lesson: this gap is measurable and increasingly avoidable. Real-time settlement, native multi-currency holding, and transparent rate visibility already exist as infrastructure choices. Merchants operating across borders should treat access to them as a baseline requirement, not a premium feature.

Why real fans look like fraudsters

The core problem the industry has been trying to solve throughout the tournament is the fact that, on paper, legitimate World Cup ticket buyers look a lot like fraudsters. This happens as regular fans’ behaviours – from buying at odd hours to doing so from websites they have never used, etc – ended up tripping fraud alarms as these behaviours end up looking similar to those of, for instance, a fraudster testing stolen credentials.

The clearest example of this is Freddy – one of the tournament’s breakout stars. Freddy, a German fan, turned his trip across the ocean into a viral saga as he documented his flights, hotel stays, the World Cup matches he attended, MLB games, the concerts, meals, etc. To the fans following along, Freddy was just a fan. However, for a fraud system, it looked like a problem. As Riskified noted in its analysis of the 2026 tournament, for a rules-based fraud-detection system, Freddy’s profile reads like account takeover, stolen-card testing, or synthetic identity fraud.

While Freddy is just one person, during the 2026 World Cup, millions of fans generated similar patterns at scale. If we look at these patterns against those from Qatar 2022, Riskified found that the risk rises as competition goes on. Fraud didn’t track sales volumes; it rose as the tournament progressed, ending 336% above the pre-tournament baseline. The sharpest increase happened in the final weeks, when the matchups mattered most, the inventory ran short, and merchants prioritised speed and customer experience over manual review, thus opening the window for fraud. To this point, same-day ticket purchases in Qatar were nearly six times riskier than advance ones, and risk peaked in the final 72 hours before a match.

Fraudsters did the groundwork before the tournament

The fraud infrastructure that made the 2026 World Cup stand out in terms of innovative fraud threats was developed well before the opening whistle sounded in Mexico City Stadium.

Check Point recorded 9,741 fraudulent World Cup-related domains registered in April 2026 alone, more than five times the peak volume seen during the Qatar 2022 World Cup. Between January and May, Fortinet logged over 13,000 tournament-themed domains. The pattern points to fraudsters using AI tools and automation to build at scale, months ahead of the tournament.

Some of the most repeatable tactics used by fraudsters included:

• Pixel-perfect clones and fake single sign-on (SSO) pages: Group-IB tracked GHOST STADIUM, a threat actor operating over 300 fraudulent FIFA domains registered since August 2025. The scam leveraged pixel-perfect clones and fake single sign-on (SSO) pages to harvest credentials and steal tickets.
• Typosquatting: look-alike domains such as fiffa[.]com, ww-fifa[.]com, fifa-ticket[.]live
• Paid ads and search: several fake ticket and hospitality websites bought sponsored placements to ensure the scam sites sat at the top of the search results that fans saw.

These tactics were not solely used for ticketing scams; the same playbook was applied to fake hospitality packages, fake merchandise stores, and even fake job offers.

Three governments, three warnings

All three host countries launched official anti-fraud campaigns:

• On March 30, 2026, the RCMP and the Canadian Anti-Fraud Centre warned against fraudulent ticketing sites and merchandise scams.
• On May 27, 2026, the FBI issued a public service announcement, urging the public to purchase tickets directly from the FIFA website rather than clicking search results or ads.
• On May 30, Profeco, Mexico's consumer protection agency, launched "¡Que no te metan gol!" (roughly, "Don't let them score on you"), an educational campaign created in partnership with Amazon, Meta, and CONCANACO SERVYTUR to prevent online scams. Profeco also took legal action against Viagogo and Tophob for selling tickets before the official channels opened.

In Mexico, the civic organisation Consejo Ciudadano para la Seguridad y Justicia estimates ticket scam losses of roughly 1,000 to 100,000 pesos (about USD 55 to USD 5,500) per victim. As per a 2025 Mastercard research, around 80% of global consumers were targeted by scammers the year prior.  

Not all host countries were hit equally by fraud. Mexico was the most targeted out of the three. To this point, in April 2026, Check Point Research recorded an average of 3,548 attacks each week per organisation, ahead of both Canada (1,649 attacks) and the US (1,497 cyber-attacks).

So why was Mexico hit harder? Some of this is bigger than the tournament. For Sebastian Fantini, Director of Product at EBANX, exposure fits a wider pattern across emerging markets which face more fraud pressure. In this situation, the challenge becomes telling local behaviour apart from actual risk:

Emerging markets generally face greater fraud pressure. In 2025, Latin America lost 4.1% of its ecommerce revenue to fraud in 2025, compared with 3.6% in North America, according to a report from MRC and Visa. But for merchants, the practical challenge is telling local norms apart from real risk.

Rigid global fraud rules can misread legitimate behaviour as suspicious. A first-time buyer with a newly issued card and little credit history, for example, may look risky to a standardised filter. In Mexico, 44% of consumers say they would never return after a legitimate payment is unfairly declined.

This is why fraud prevention needs local behavioural data and signals across payment methods. At EBANX, we cross-reference more than 100 behavioural variables to validate a single purchase. The goal is not to block more transactions, but to give fraud models enough local context to distinguish genuine customers from sophisticated threats more accurately.

The airline industry’s response

Governments weren’t the only ones sounding the alarm. Airlines – some of the most exposed businesses during a sporting tournament that moves millions of fans across borders – also ran similar campaigns. According to IATA:

Major events, such as the FIFA World Cup, present a significant fraud risk for both airlines and consumers. The shift in business patterns associated with these events requires a higher level of risk management and oversight across airlines’ direct and indirect sales channels. To mitigate these risks, IATA provides a foundation for risk management through the accreditation of travel agents and other sales channels.

Given the wide range of new payment options and sales channels available, the point of sale can be particularly vulnerable to fraudulent behavior. Therefore, there has been significant focus on securing payments against fraud and protecting consumers.

During the 2022 FIFA World Cup in Qatar, Kaspersky blocked more than 500 million attempts to access fraudulent websites, double the figure recorded in 2021.

For the 2026 FIFA World Cup, IATA and the Latin American and Caribbean Air Transport Association (ALTA),  and their campaign partners – including seven member airlines from the Americas and Europe, fraud prevention providers, and global payment processors, alongside major travel and tourism agency associations from Argentina, Chile, Colombia, Venezuela, Costa Rica, Ecuador, El Salvador, Guatemala, Honduras, Mexico, Panama, Paraguay and Dominican Republic, are running a digital campaign to encourage travelers to purchase their airline tickets exclusively through authorized channels, such as official airline websites, verified apps, or accredited travel agencies.

What does the data say?

Looking back at fraud patterns from past tournaments, many of these repeated in 2026. In the build-up to Copa America 2024, CNP fraud attempts reached 4% of the transaction value, according to ACI. The window for fraud opened weeks before the first match and it stayed open long after the football tournament ended.

Based on 24.5 million transactions across 61 live-event merchants serving global fan audiences, data from ACI points to three takeaways for merchants.

First, alternative payment methods are safer, with APMs recording a 0.57% attempted fraud rate against 3.97% for cards, a sevenfold gap. APM adoption climbed from 7% in 2022 to 24.8% so far in 2026.

Second, fraudsters chase value, with pre-tournament orders averaging USD 405 against a USD 270 legitimate average. As a consequence, this raises the risk of false declines on genuine high-value tickets.

Third, domestic cards carry more risk than cross-border ones (3.2% versus 1.4%). Fraudsters, it seems, prefer locally issued cars.

What lessons should merchants take away from the 2026 World Cup?

All of this leaves merchants with a difficult choice: either block too little and let fraud get through, or block too much and you decline real fans and lose the sale.

The cost of a decline is not insignificant. As per a 2025 research by Nuvei and Edgar, Dunn & Company on travel payments, travellers do not forget payment friction. While 82% of are open to trying a different payment method when payment fails, if the second attempt fails, 13% go to a competitor, while 5% abandon the purchase altogether.

For Justin Benson, CEO of Spreedly, the lesson is operational:

One of the biggest lessons from this year's tournament is that fraud isn't just a security problem, it's an operational one. The biggest challenge wasn't preparing for the World Cup, but keeping up with how quickly fraud evolved once it began. The merchants that performed best adapted quickly as fraud patterns shifted throughout the tournament. Businesses that treat payments as a strategic capability, rather than a back-office function, will be much better prepared for the next major event.

What happens after the final whistle?

The fraud tracked as the tournament is underway is not the whole cost merchants should consider. In fact, a significant share is still to land once disputes hit them long after the 2026 trophy is lifted. Amber McGirr, CPFPP, Founder & Principal Consultant at Chargeback Nerd, sees a predictable pattern:

Big sporting events like the World Cup tend to trigger a lagging spike in disputes, especially for travel, app subscriptions, gaming/online betting, and event-focused merchants. The pattern is predictable: after the event, claims start rolling in for unauthorised charges, missed cancellations, services/merchandise not as described, and buyers who regret their digital purchases once the adrenaline wears off.

If you handle disputes, now is the time to watch your queues closely. If you run support, make sure your team can keep pace. Quick responses, clear descriptors, simple policies, and proactive outreach prevent more headaches and VAMP trouble than any tool on the market.

The real risk isn’t the event. It’s the fallout: more refunds, fraud claims and disputes. Card networks watch those numbers. Merchants who spot issues early, refund when it’s the right call, and keep their evidence sharp are the ones who avoid bigger losses later.

Final thoughts

If the 2026 World Cup proved anything, it’s that fraud infrastructure now gets assembled months in advance, all while AI has collapsed the cost of doing it at scale.

For an industry that treated the 2026 World Cup as a stress test, the results won’t be fully readable until the summer is over. While we can expect the final scoreline to be settled on the New York New Jersey Stadium on July 19, 2026, on the payments side, the final count will come weeks later.

About the author

Diana Vorniceanu (Lupuleac) is a Senior Writer at The Paypers. She has an extensive background in content creation and is a graduate of Foreign Languages and Literature studies, currently specialising in payments and ecommerce. She strives to bring forward the latest trends for our readers, while investigating the ever-evolving landscape of cross-border payments, global ecommerce, payments for marketplaces and online platforms, and emerging technologies across the globe. You can reach Diana via email at diana@thepaypers.com or on LinkedIn.