Before the First Whistle: How Cyber Criminals Are Targeting World Cup 2026 — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Jun 12, 2026

Severity: Medium | View Full Scam Details

Before the First Whistle 2026: How Phishing Scams Target Indian Fans Ahead of the FIFA World Cup

As India gears up to follow the FIFA World Cup 2026, cybercriminals are sending phishing messages designed to trick football fans into revealing sensitive details or losing money.

What Is the Before the First Whistle: How Cyber Criminals Are Targeting World Cup 2026?

With the FIFA World Cup 2026 generating massive excitement in India, fraudsters have started exploiting this huge fan base. The reported scam typically involves phishing tactics where scammers impersonate official ticket sellers, sponsorship partners, or broadcasters connected to the World Cup. Their goal is to steal personal information, login credentials, or money from unsuspecting victims eager to watch the matches.

In cases reported to Indian cybercrime cells and CERT-In, the victims are usually younger football fans who receive WhatsApp messages, emails, or SMS with fake links promising early access to tickets, exclusive merchandise, or paid streaming codes at a “discount.” These messages often appear as though they come from trusted sources related to the tournament. However, clicking these links leads to fraudulent websites that ask for sensitive information like UPI IDs, Aadhaar details, or bank account passwords.

This phishing pattern is becoming widespread across India, with increasing complaints coinciding with major football events. CERT-In and I4C (Indian Cyber Crime Coordination Centre) have issued general advisories warning people against clicking on suspicious links related to popular sports events, including the ongoing buildup to the FIFA World Cup 2026.

How This Scam Works — Step by Step

1. Initial Contact: A victim receives a WhatsApp message, SMS, or email claiming to offer early or discounted World Cup 2026 tickets, VIP passes, or official merchandise.
2. Fake Website Link: The message contains a URL that looks legitimate at a glance but actually leads to a phishing website designed to mimic official portals.
3. Request for Details: On the fake page, victims are asked to enter personal information such as mobile numbers, Aadhaar numbers, or UPI IDs for “verification” or “payment.”
4. UPI Payment Request: After inputting details, victims receive a UPI payment request or are asked to enter OTPs (One-Time Passwords) supposedly for confirmation but actually to authorize fraudulent transactions.
5. Account Compromise or Fund Theft: With the details collected and OTPs entered, fraudsters gain access to bank accounts or execute unauthorized transactions.
6. Loss Discovery: Victims realize money has been deducted or accounts compromised after the match has started or when they check bank statements.

This scam also involves fake customer support numbers where fraudsters impersonate officials, pushing victims to share more sensitive information and transfer funds.

Real Warning Signs to Watch For

• Messages promising “early access”, “exclusive discounts”, or “limited VIP tickets” before official announcements.
• URLs that look odd or do not match official sports portals (e.g., misspelled domains or strange characters).
• Requests to share Aadhaar numbers or UPI PINs on websites or chats.
• Urgent payment demands via UPI immediately after entering personal data.
• Unsolicited contact from “customer support” via WhatsApp or phone calling from unknown numbers.
• Poor grammar and spelling mistakes in messages claiming to be from reputed organizations.
• Requests to forward the message to friends or family for extra benefits.

What Happens to Victims

Victims often face financial loss ranging from a few hundred to several thousand Indian Rupees due to unauthorised UPI transactions. Unlike regular debit or credit cards, UPI payments are instant and generally non-reversible, making it difficult to retrieve stolen funds quickly. Some victims also fall prey to Aadhaar misuse; sharing Aadhaar numbers on fake sites can lead to identity theft or SIM swap fraud, further exposing bank accounts or digital wallets.

Emotionally, victims experience stress, anxiety, and embarrassment. Many hesitate to report due to fear of losing trust or public blame. The delay in recognising the scam adds to the distress, as funds may have been transferred days before discovery.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) has consistently warned users against sharing confidential banking credentials such as UPI PINs and OTPs with anyone. According to RBI guidelines, no official bank or government agency will ever ask for these details over phone or online messages.

CERT-In advises internet users to be wary of unsolicited links and messages, especially those linked to major events like sports tournaments. CERT-In recommends visiting only official websites for ticket purchases or streaming services and verifying URLs carefully.

The National Cybercrime Reporting Portal (cybercrime.gov.in) and the Indian Cyber Crime Coordination Centre (I4C) encourage victims to report phishing and fraud attempts immediately. For suspected cybercrime incidents, the government’s 1930 helpline is available to assist victims and provide guidance.

How to Protect Yourself

1. Purchase World Cup tickets or merchandise only from official, verified platforms.
2. Avoid clicking on any links or attachments received via WhatsApp, SMS, or email that claim early or discounted access.
3. Never share your UPI PIN, Aadhaar number, OTPs, or bank passwords with anyone, even if they claim to be officials.
4. Check website URLs carefully for authenticity—look for “https://” and official domain names.
5. Use multi-factor authentication on digital wallets and banking apps for additional security.
6. Regularly monitor bank and UPI transaction histories for unfamiliar transactions.
7. Report suspicious messages or calls to BharatSecure.app or India’s 1930 cybercrime helpline immediately.

What to Do If You've Been Targeted

• Immediately block and do not reply to suspicious WhatsApp numbers or callers.
• If you suspect unauthorised transactions, contact your bank or UPI app provider to freeze your account or block payments.
• Change all passwords and enable two-factor authentication on your bank and wallet apps.
• Report the incident on the National Cybercrime Reporting Portal at cybercrime.gov.in.
• Call the 1930 cybercrime helpline for official assistance and advice.
• Inform CERT-In through their reporting mechanism about the phishing attempt.
• Keep records of all communication, transaction IDs, and screenshots as evidence for police or bank investigations.

Frequently Asked Questions

Q: Can I get my money back if I paid through a fake World Cup ticket link?
A: UPI transactions are usually instantaneous and irreversible. However, you should immediately contact your bank or payment service to report fraud. The sooner you act, the higher the chance of freezing further transactions or recovering funds.

Q: How can I verify if a World Cup ticket website is official?
A: Official tickets are typically sold through the FIFA website, RBI-approved payment platforms, or verified authorized sellers. Avoid unknown or unsolicited links and check for https security and official sponsorship branding.

Q: What should I do if someone asks for my Aadhaar number or OTP for World Cup-related offers?
A: Never share Aadhaar details or OTPs with unknown contacts. Legitimate organizations do not require these for ticket purchases or streaming access. Sharing such information can lead to identity theft or financial fraud.

Feeling unsure about a message or call related to the World Cup 2026 scam? Verify suspicious messages at BharatSecure.app or report them to the 1930 cybercrime helpline for timely help.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.