Football fans searching for World Cup deals are running into a different kind of contest this year, one designed by criminals rather than FIFA.
A phishing operation tied to the 2026 FIFA World Cup has been quietly harvesting personal details and payment card information from fans.
The scam hides behind tournament excitement, using the promise of free rewards to lure victims into giving up sensitive data.
The attack begins with something ordinary: an email that lands in the inbox looking legitimate. These messages are built to pass standard authentication checks, which means they slip past many spam filters without raising alarms.
Once opened, the email nudges the recipient toward a link that promises a World Cup related prize or giveaway. Clicking that link sets off a chain of redirects rather than taking the victim straight to a fake page.
Analysts and researchers from Unit42 identified this multi-step process as a deliberate attempt to dodge automated security scanners and delay detection. Each redirect adds a layer of separation between the original email and the final trap.
Unit42 said in a report shared with Cyber Security News (CSN) that the final stop in this chain is a geo-cloaked redirector, a tool that changes what a visitor sees based on their location.
Someone browsing from a country of interest to the attackers gets funneled toward the scam page, while others may see harmless or unrelated content.
This selective targeting helps the campaign stay under the radar of researchers scanning from unrelated regions.
Victims who reach the end of the chain land on a page dressed up like a reward or prize checkout tied to the World Cup. To claim the supposed prize, the page asks for a name, home address, and full payment card details.
Once submitted, that information goes straight into the hands of the attackers instead of any legitimate giveaway system.
Hackers Abuse 2026 FIFA World Cup Hype
The entire scheme relies on layering, with each stage designed to look convincing while filtering out anyone who might expose the operation.
An email that passes authentication checks feels trustworthy at first glance, which is exactly the point.
From there, the redirect sequence keeps shifting the destination so that security tools scanning the initial link never see the actual scam page.
Geo-cloaking adds another layer of caution on the attackers’ part. By showing different content depending on where a visitor is located, the operators reduce the odds that researchers or automated crawlers in the wrong region ever spot the final payload.
Fans in regions with high World Cup interest are most likely to see the fake reward page, suggesting the targeting is intentional.
This layered phishing chain reflects a broader pattern seen across World Cup themed scams this year, where legitimate sounding branding and urgency are used to bypass a user’s usual caution.
The final checkout page mimics an official promotion closely enough that many recipients would have little reason to suspect anything was wrong.
Protecting Fans And Their Data
Simple habits go a long way toward avoiding this trap. Fans should be wary of any email promising free tickets, merchandise, or cash prizes tied to the World Cup, especially when it asks for payment card details to unlock the reward. Legitimate giveaways rarely require a credit card number just to claim a prize.
Typing a known website address directly into the browser, rather than clicking links from an email, removes most of the risk tied to this scam.
It also helps to check the sender’s address closely and hover over links before clicking, since redirect chains often reveal mismatched or unusual domains.
Anyone who has already entered payment information on a suspicious page should contact their card issuer right away to watch for unauthorized charges.
Reporting the phishing email to an employer’s security team or a fraud reporting service can also help limit the damage and warn others before they fall for the same trick.
