Football fans are increasingly targeted by scams exploiting club loyalty, national teams, football collectibles, streaming demand, and the growing excitement around the FIFA World Cup 2026, according to Bitdefender Labs.
Our most recent investigation uncovered more than 55 football-related malvertising campaigns targeting users through fake online stores, social media ads, IPTV piracy operations, fraudulent football apps, and FIFA-themed giveaway and lottery scams distributed through email.
As excitement builds for the FIFA World Cup 2026, cybercriminals have been capitalizing on global football enthusiasm for months through a growing ecosystem of scams, fake shops, phishing campaigns, and fraudulent social media operations.
One of the clearest trends observed by researchers Alexandra Dinulica and Vlad Mihai Sireanu during their investigation was the aggressive use of malicious advertising campaigns targeting football supporters on social media platforms, particularly Facebook and Meta services.
Researchers identified scam ads promoting:
Many of the ads were designed to blend naturally into users’ feeds using realistic product photos, football imagery, countdown timers, and pressure tactics such as: “Limited stock”, “Today only” or “Selling out fast” .
The ads redirected users to fake online stores and phishing pages designed to collect payment details or personal information.
Several suspicious domains repeatedly appeared throughout the investigation, including:
The identified scam campaigns targeted England supporters using “Three Lions” branding, Scotland national team supporters, Tartan Army fans and Hearts FC supporters.
Researcher Ionut Baltariu also observed football-themed scam ads promoting supposed FIFA World Cup 2026 Panini sticker albums and collectibles as early as February 2026. Several fake pages promoting these ads also contained noticeable branding inconsistencies and typos. In one example, a page used the name “WordCup” instead of “World Cup,” while still trying to imitate official football branding and Panini-related promotions. Other campaigns used names such as “Loja Panini,” “Ofcpanini,” and “Brasil Hexa 2026” to appear connected to legitimate football collectibles and World Cup merchandise.
The ads heavily targeted Portuguese-speaking audiences, particularly users in Brazil, and promoted alleged pre-orders for “official” FIFA World Cup 2026 sticker albums, bundles, and collector kits. Multiple versions of the same ads were seen running simultaneously across Facebook and Instagram, a common malvertising tactic to maximize reach and test engagement. We also noticed signs that some football-themed scam ads may have relied on AI-generated or heavily AI-enhanced promotional imagery. Several campaigns used unusually polished visuals, synthetic-looking product renders, and inconsistent branding elements to create advertisements for fake FIFA World Cup 2026 sticker albums and collectibles.
Researchers also identified multiple counterfeit football merchandise scam operations linked to organized overseas operators.
Two fake merchandise campaigns targeting UK football supporters were definitively attributed to Chinese operators after investigators discovered Simplified Chinese UTM campaign parameters embedded directly inside advertising tracking infrastructure.
Because these labels appeared directly inside advertising tracking parameters, they provide unusually strong attribution evidence linking the operations to Chinese-speaking operators running structured malvertising campaigns.
The wording also suggests organized advertising workflows involving campaign testing, bid optimization, and multi-storefront management rather than isolated scam activity.
Researchers also observed identical ad copy and similar storefront structures across multiple domains, indicating operators were running several fake shops simultaneously so they could continue operating if one website was removed or blocked.
Among the findings, one operation stood out due to its clear focus on parents shopping for children’s football kits.
The scam campaign, tied to the website malskitukpatch.com and operating under the name “PrimeFinds UK,” advertised football kits for children between 3 and 13 years old.
The website tried to look trustworthy by claiming:
Researchers found no evidence to support these claims. The products were likely shipped from overseas suppliers, meaning buyers may face long delivery times, poor-quality products, or difficulty obtaining refunds.
The branding itself appears designed to create a sense of legitimacy. The name “PrimeFinds UK” suggests a local UK retailer and resembles naming conventions commonly associated with trusted e-commerce platforms.
Researchers also found that the same operator promoted unrelated products through other websites, including dog car seat covers. This pattern is commonly associated with low-trust scam or dropshipping operations that quickly pivot between trending products and seasonal events.
Bitdefender Antispam Lab researcher Viorel Zavoiu identified multiple email scam campaigns impersonating FIFA World Cup 2026 organizations and promotional programs.
The emails falsely claimed recipients had won cash prizes through FIFA lotteries, online giveaways, or promotional draws connected to upcoming football events.
Some messages promised winnings of up to $2 million and instructed victims to contact so-called “claims agents” or verification offices to process their reward.
The scams impersonated entities such as:
To appear legitimate, the emails included reference numbers, Ticket IDs, Office addresses, legal terminology and even “confidential” PIN codes.
One version instructed recipients to contact a purported claims agent in South Africa using a free Gmail address, and to request personal information such as nationality, occupation, address, and phone number.
Another variation requested passport or national identification details early in the process, suggesting potential risks of identity theft in addition to financial fraud.
These campaigns follow the structure of classic advance-fee and lottery scams, but their use of FIFA branding and World Cup references makes them more believable to football fans who are expecting promotions, giveaways, ticket draws, and tournament-related offers.
Researchers observed these scams operating alongside broader football-themed fraud, including fake merchandise stores, ticket scams, IPTV piracy services, counterfeit collectibles, and malvertising campaigns spread through social media.
The investigation also uncovered football-themed piracy and fake app scam campaigns targeting fans seeking match streams and football content.
In Portugal, researchers linked UniTV and Xtream IPTV through shared entities and overlapping infrastructure, suggesting a single operator managing multiple IPTV brands simultaneously.
This type of setup allows operators to continue functioning even if one service is disrupted or removed.
Researchers also identified coordinated fake football app scam campaigns connected to “Goal Rush” and “BEST APP,” which deployed dozens of fake entities across multiple operations.
Some used Cyrillic character spoofing to evade moderation systems and automated detection tools, suggesting a more advanced and coordinated operation.
A few basic habits can significantly reduce the risk of falling victim to football/ FIFA World Cup scams:
Bitdefender Scam Radar, available in both our standalone and all-in-one security suites, provides early warnings about active scam campaigns before you become a target. It uses AI and advanced threat intelligence to identify emerging scam trends, including fake shopping ads, phishing attempts, and social engineering campaigns, while explaining how they work and how to avoid them.
If you believe you may have already interacted with a scam:
Most importantly, verify offers through official channels whenever possible. That means using FIFA.com for tournament information and tickets, recognized retailers for football merchandise and collectibles, and official streaming providers for live matches.
Disclaimer: This report is published for informational and educational purposes only. The findings presented are based on independent research conducted by Bitdefender Labs using publicly available information and proprietary threat intelligence. The mention of specific domains, entities, brands, or trademarks does not imply any endorsement, affiliation, or official relationship. All trademarks referenced herein are the property of their respective owners. Bitdefender makes no representations or warranties regarding the accuracy or completeness of third-party information. Readers are encouraged to verify any information independently before taking action.
tags
As a Team Lead at Bitdefender, I specialize in malware analysis and detection of scams, uncovering emerging threats and translating them into actionable insights that strengthen digital resilience.
View all postsAs a Security Researcher at Bitdefender, I focus on finding new ways to identify and prevent online scams and cybersecurity threats.
View all postsI'm a software engineer with a passion for cybersecurity & digital privacy.
View all posts