Kaspersky names top 5 World Cup cyber scams

Woburn, MA – November 17, 2022 – Kaspersky researchers have released a list of the top five scams capitalizing on the upcoming FIFA World Cup Qatar 2022™.

To get an overview of the ways scammers are trying to monetize soccer fans’ interest, Kaspersky experts analyzed World Cup-related phishing websites from around the globe designed to steal users’ identifying and banking data. The researchers found fake pages offering everything from tickets and event merch to match streaming services, plus numerous giveaways and NFT scams exploiting the World Cup.

Ticketing scams

As with all major global sports events, fake tickets are the bait most used to lure victims. Qatar 2022 is only offering digital tickets, increasing the risk of running into malicious resources. Kaspersky experts discovered numerous phishing pages purporting to sell tickets for FIFA matches. Needless to say, users of these sites will lose personal data, banking details, and money. Additionally, scammers may start also using the stolen data for other purposes or sell it on the dark web.   

A phishing page offers fake tickets

Gifts

Fraudsters often imitate extremely generous giveaways. Kaspersky researchers found phishing pages offering a chance to win two tickets to the World Cup. Often, each user becomes a “lucky” winner, only needing to pay a delivery fee.

A phishing page offers a chance to win 2 FIFA tickets

Merchandise

Another way to steal user data is via fake FIFA-related merchandise stores. Offers for team T-shirts, phone cases with popular players and signed soccer balls prompt users to enter their data and transfer money to make a purchase, while fans lose their cash to fraudsters instead.

Crypto and NFT frauds

A distinctive feature of the threat landscape on the eve of the 2022 World Cup has been the active spread of various crypto scams, mostly exploiting the popularity of NFTs. Some offer to make a bet on a match and win cryptocurrency, others to win related NFT art. All the user needs to do is to enter crypto wallet credentials, so the prize transfers directly. In such scenarios, scammers gain access to all savings and related wallet data.

An example of a World Cup-related crypto scam

Another scheme is crypto investment fraud. Fraudsters actively create real coins and convince a user to invest in it while promising the victim potential currency growth. In reality, these are almost never a success and users have spent money on something that will never develop.

An example of a World Cup-related NFT scam

Flights and accommodations

Kaspersky experts have observed numerous phishing pages imitating airline services offering tickets to Doha. One analyzed webpage shows all the classic signs of scam: nice appearance, bad spelling, freshly registered domain, and limited functionality of the site. Although the site mimics a global airfare aggregator, the user can only choose Qatar in the list of destination countries. Once flight details are entered, the victim is prompted to enter personal data along with ID and credit information.

An example of phishing page listing plane tickets

“Major sport events always attract the attention of cybercriminals,” said Olga Svistunova, security expert at Kaspersky. “With this World Cup, scammers got very creative, as we have observed a variety of fraudulent schemes employed. We see how they are trying to benefit most from the situation and exploit as many trendy topics as possible, including a growing number of NFT scams related to the World Cup. At the same time, there are many so-called traditional scams out there from giveaways and fake tickets to merch stores. These schemes are simple yet effective, which is why such fraudulent pages are eternal companions of big events. We encourage users to be attentive when they receive offers that seem too good to be true and carefully check the validity of the messages they receive.”

To avoid falling victim to a scam, Kaspersky advises users to: 

-        Check a link before clicking. Hover over it to preview the URL, and look for misspellings or other irregularities.

-        It’s better not to follow links from e-mails at all. Instead, you can open a new tab or window and enter the URL of your bank or other destination manually.

-        Consider what kind of information is being requested. Legitimate companies don’t contact you out of the blue via unsolicited emails to ask you for personal information such as banking or credit card details, social security number etc. In general, unsolicited messages telling you to “verify account details” or “update your account information” should be treated with caution.  

-        Use a reliable security solution, such as Kaspersky, that identifies malicious attachments and blocks phishing sites.

-        Grammar and spelling check is the effective way to identify a scammer. Typos and bad grammar are red flags. So too are odd phrasing or unusual syntax, which might result from the email being translated back and forth through a translator several times.  

About Kaspersky

Kaspersky is a global cybersecurity and digital privacy company founded in 1997. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky technologies and we help 240,000 corporate clients protect what matters most to them. Learn more at usa.kaspersky.com.

Media Contact

Sawyer Van Horn

sawyer.vanhorn@Kaspersky.com

(781) 503-1866