Football fans are increasingly becoming targets of sophisticated scam operations that leverage the excitement surrounding major tournaments and club loyalties, according to recent findings from Bitdefender Labs. Investigations have uncovered over 55 distinct scam campaigns exploiting various aspects of football fandom, including merchandise, streaming services, collectibles, and giveaways. These fraudulent activities are primarily disseminated through social media advertisements and email.
The FIFA World Cup 2026 has emerged as a significant lure for cybercriminals, but scammers are also preying on supporters of specific national teams and club teams, as well as those interested in football collectibles and streaming content. Meta-owned platforms, including Facebook and Instagram, have been heavily utilized for malvertising campaigns promoting fake football merchandise and phishing pages. Users in countries such as the UK, Portugal, Spain, Algeria, the United States, Canada, Mexico, Belgium, Germany, Brazil, and Australia have been identified as primary targets.
Researchers observed a trend of aggressive malvertising on social media, with scam ads designed to blend seamlessly into users' feeds. These advertisements often feature realistic product images, football-related imagery, countdown timers, and urgency tactics like "limited stock" or "selling out fast." The ads typically redirect users to fake online stores or phishing pages intended to harvest payment details and personal information. Several suspicious domains, including faithoutfit[.]uk and defwear[.]uk, were repeatedly flagged during the investigation.
Specific club and national team supporters have been targeted. Campaigns have promoted fake merchandise and Panini sticker offers for England, Scotland, the Tartan Army, and Hearts FC. Early in 2026, researchers also noted football-themed scam ads promoting supposed FIFA World Cup 2026 Panini sticker albums and collectibles. These fraudulent promotions sometimes exhibited branding inconsistencies and typos, such as using "WordCup" instead of "World Cup," while attempting to mimic official football and Panini branding.
The investigation also revealed coordinated IPTV piracy operations and fake football applications targeting fans, particularly in regions like Portugal and Algeria. Some of these operations were linked to organized overseas entities employing structured advertising infrastructures. Evidence, such as Simplified Chinese UTM campaign parameters embedded within advertising tracking, has directly attributed certain counterfeit football merchandise campaigns to Chinese operators. These findings suggest a level of organization involving campaign testing and multi-storefront management.
One notable scam operation focused on parents purchasing children's football kits. This campaign, associated with the website malskitukpatch.com and operating under the name "PrimeFinds UK," advertised children's kits with false claims of fast dispatch from the UK and free shipping. Researchers found no evidence to support these claims, suggesting products were likely shipped from overseas, leading to potential delays, poor quality, and difficulties with returns. The operator also promoted unrelated products, a common tactic in low-trust dropshipping operations.
Bitdefender's Antispam Lab also identified multiple email scam campaigns impersonating FIFA World Cup 2026 organizations. These emails falsely claimed recipients had won significant cash prizes through lotteries or promotional draws, instructing them to contact fake "claims agents." The scams mimicked official entities like the FIFA Legal and Compliance Division and included elements such as reference numbers and legal terminology to appear legitimate. Some variations requested sensitive personal information, including passport details, raising concerns about identity theft.
These FIFA-themed lottery and giveaway scams are described as following the structure of classic advance-fee fraud but are made more convincing by leveraging the widespread anticipation of official promotions and tournament-related offers. The researchers noted that these email scams were observed operating in conjunction with other football-related fraud schemes, including fake merchandise stores, ticket scams, and social media malvertising.
