The report from ACI Worldwide found that fraudulent orders averaged $405 during the pre\u2011tournament build, about 1.5 times the $270 legitimate average and average transaction values rose 1.2 per cent.<\/p>\r\n\r\n
The firm suggested that average fraudulent transaction values could again approach $400 during the 2026 World Cup.<\/p>\r\n\r\n
An analysis of 24.5 million transactions across 61 live\u2011event merchants serving global fan audiences, showed that warning signs that preceded fraud surges during Copa America 2024 and the 2022 World Cup have re\u2011emerged in this tournament.<\/p>\r\n\r\n
Fraudsters are majorly targeting higher\u2011value purchase, the report said, adding that fraud pressure is expected to remain high through the opening stages of the tournament across the United States, Canada and Mexico.<\/p>\r\n\r\n
Silent Push -- a US-based threat intelligence firm that tracks online fraud networks -- has identified more than 300 pixel\u2011perfect replica ticketing websites.<\/p>\r\n\r\n
Check Point Research -- the research arm of cybersecurity company Check Point Software -- recorded 9,741 fraudulent World Cup\u2011related domains registered in April 2026 alone, nearly four times the peak seen around the 2022 tournament.<\/p>\r\n\r\n
Cybersecurity firms and law enforcement have warned that fraudsters are using automation and artificial intelligence to scale World Cup\u2011related scams.<\/p>\r\n\r\n
Fortinet counted more than 13,000 tournament\u2011themed domains registered between January and May 2026.<\/p>\r\n\r\n
Alternative payment methods (APMs) are significantly safer and they only recorded a 0.57 per cent attempted fraud rate, compared with 3.97 per cent for traditional cards, a sevenfold difference.<\/p>\r\n\r\n
Fortinet counted more than 13,000 tournament\u2011themed domains registered between January and May 2026.<\/p>\r\n\r\n
During the pre\u2011tournament build, domestic cards recorded a 3.2 per cent attempted fraud rate, compared with 1.4 per cent for cross-border cards, reflecting fraudsters\u2019 preference for locally issued credentials.<\/p>\r\n\r\n