Top News

As UAE residents are gearing up for the Fifa World Cup 2026 which will kick off on June 11, cybersecurity experts are warning fans to watch out for fake ticket websites, fraudulent travel packages and phishing scams designed to steal money and personal data.

The warning comes as cybersecurity company Kaspersky said it has identified 336 domains impersonating official World Cup sources, while Dubai-based travel agency Travel Finder reported receiving dozens of inquiries from UAE football fans planning to attend matches.

"We have already detected 336 unique domains mimicking the official World Cup source," Olga Altukhova, Senior Web Content Analyst at Kaspersky, told Khaleej Times.

Stay up to date with the latest news. Follow KT on WhatsApp Channels.

According to the company, cybercriminals are exploiting growing excitement around the tournament by creating fake ticketing platforms, counterfeit hotel reservation websites and fraudulent airline booking pages that mimic legitimate services.

While the campaigns are not aimed at one specific country, Kaspersky said users across the GCC, including the UAE, fall within the scope of these large-scale operations.

"Threat actors usually cast a wide net, without targeting specific audiences, waiting for unsuspecting victims to fall prey to their traps," Altukhova said.

Mehak Khurana, Associate Professor of Cybersecurity at the Canadian University Dubai, described the figure as alarming.

"Three hundred and thirty-six fake domains is a very big number," she said. "If even one website traps 100 victims, you are potentially looking at tens of thousands of people being exposed to these scams."

She noted that many of the sites are not limited to selling fake match tickets but also advertise accommodation, flights, visas and complete travel packages.

Olga Altukhova (T), Mehak Khurana (B), Dr Claude Fachkha (R)

UAE demand already building

The warnings come as travel companies begin seeing interest from UAE-based football fans eager to attend matches in the United States, Canada and Mexico, which will jointly host the tournament.

Divya Jagga, founder of Travel Finder, said the company has already completed between 10 and 12 World Cup-related bookings and received around 50 to 60 inquiries from UAE residents.

"Most of the interest is for the USA," she said.

Package prices currently start from around Dh10,000 to Dh11,000 per person, depending on travel duration and ticket category.

However, Jagga said demand has been softer than initially expected due to visa-related concerns and wider global uncertainty.

"Some are hesitant to travel because of the situation and are still scared to take long journeys. Canada visa processing is taking more than two to three months, while many US visa appointments have been pushed back," she said.

Khurana recalled a case during the Qatar 2022 World Cup involving a friend who purchased a package for an entire family through a fraudulent website.

"The offer included tickets, accommodation and visas. It looked attractive because everything was bundled together and discounted," she said.

The victim later discovered the booking platform was fake after making payment, resulting in significant financial losses.

More convincing scams

Cybersecurity researchers say major sporting events have long attracted fraudsters, but advances in artificial intelligence are making scams increasingly difficult to spot.

Claude Fachkha, AI and Cybersecurity Consultant and Expert, Associate Professor University of Dubai, said fake websites can now be created quickly and made to look almost identical to legitimate platforms.

"The challenge today is not just the number of fake domains, but how easily attackers can create and replace them," he said.

Experts say AI-powered tools now allow criminals to generate professional-looking websites, marketing materials, emails and social media content that closely imitate official brands.

Kaspersky noted that while the tactics remain largely the same as those seen during previous events such as the Fifa World Cup Qatar 2022, UEFA Euro tournaments and the Paris Olympics, the execution has become far more sophisticated.

"With AI-enabled tools allowing more believable replicas of official branding to be created at a faster rate, this World Cup season will prove to be a breeding ground for more sophisticated attacks," Altukhova said.

Khurana said generative AI has dramatically lowered the barrier for cybercriminals.

"Previously, scam websites often contained spelling mistakes, poor design and obvious warning signs. Now, with AI, cybercriminals can create professional-looking websites, polished marketing content and convincing social media campaigns that closely resemble legitimate organisations," she told Khaleej Times.

She said many fraudulent websites now appear almost identical to official platforms, making them far harder for ordinary users to identify.

"It has become very difficult for a normal person to distinguish whether a communication is fraudulent or legitimate because the quality has improved so much," she said.

Social media, email and fake offers

Cybersecurity firm Proofpoint has also identified potential weaknesses within the broader World Cup commercial ecosystem.

The company analysed 25 domains belonging to Fifa World Cup sponsors, suppliers and partners and found that although 96 per cent had implemented basic email authentication protections, only 64 per cent had adopted the strongest anti-spoofing safeguards.

As a result, more than one-third of official partner domains could still be vulnerable to email impersonation attempts.

"Without stronger protections in place, it becomes easier for criminals to impersonate trusted brands and trick people into sharing personal details or making payments for fake offers," said Matt Cooke, EMEA Cybersecurity Strategist at Proofpoint.

Meanwhile, Meta has begun displaying pop-up warnings to users searching for World Cup ticket-related terms on Facebook or visiting football-related groups.

The notifications encourage users to purchase tickets only through trusted and verifiable sources, highlight common scam warning signs and provide links for reporting suspicious content and accounts.

The company said millions of fans are expected to use its platforms during the tournament, making social media a key battleground for fraud prevention.

According to experts, scammers frequently exploit fear of missing out, urgency and limited-availability messaging to pressure fans into making quick decisions.

Khurana said social media algorithms can unintentionally amplify the problem.

"People repeatedly see advertisements, posts and promotions related to tickets and travel packages. That creates a fear of missing out and a sense of urgency," she said.

Fraudsters often exploit those emotions through messages claiming only a few tickets remain, offering exclusive discounts or promising free visa processing and accommodation.

Common warning signs include heavily discounted ticket offers, claims that only a few tickets remain, unsolicited emails or messages, and websites that closely resemble official booking platforms.

More than just financial losses

Experts warn the consequences can extend well beyond the cost of a fake ticket.

Fraudulent booking sites frequently request passport copies, identification documents, payment card details and contact information.

Khurana said the stolen data can later be used for identity theft, account takeover attempts and highly personalised phishing attacks.

"Once attackers obtain passport details, Emirates ID information and dates of birth, they can use that information in future scams or even attempt to guess passwords that people have created using personal information," she said.

"Victims may not realise the real damage until months later."

Kaspersky said users who enter payment details on fake platforms risk both credential theft and financial losses.

The company expects scam activity to intensify as the tournament draws closer and more fans begin searching for tickets, flights and accommodation.

"Activity typically peaks closer to the event itself, when demand is highest and users are under time pressure to secure tickets, accommodation and travel arrangements," Altukhova said.

For travellers, experts recommend purchasing tickets only through official channels, verifying website addresses carefully, checking reviews before booking travel packages and enabling multi-factor authentication on important accounts.

Safety tips

Khurana said fans should carefully verify any website before making payments.

"Check whether the website uses HTTPS, verify that the domain name exactly matches the official source, review customer feedback and confirm that the site has existed for some time rather than being recently created," she said.

She also recommended checking suspicious links through online services such as VirusTotal or WHOIS to determine whether a website has previously been associated with malicious activity.

Fifa World Cup scams surge as fake ticket websites target football fans Fifa World Cup 2026: Groups, fixtures and key dates FIFA bans vuvuzelas, other loud noise-making devices from World Cup stadiums