By Assaf Morag, Cybersecurity Researcher
The most expensive 2026 FIFA World Cup tickets cost almost $7,000 (for now), and the tickets are hundreds of dollars in the group stage seats. As prices surge and availability tightens, fans are increasingly pushed toward secondary markets, bundled travel packages (with flights and lodging included, the total cost can go into the five figures), and unofficial channels.
This creates the perfect conditions for threat actors to operate: blending legitimate resale platforms with deceptive infrastructure, scams, and fraudulent offers. This causes a well-positioned trap in the space between FIFA’s official ticket transfer method and third-party ticketing platforms’ processes.
Understanding where real opportunities end and malicious activity begins is critical for anyone looking to attend. The line between legitimate resale and outright fraud is dangerously thin, and fans searching for tickets are one click away from losing thousands of dollars.
About this World Cup Series
The United States, Canada, and Mexico have been selected to host the 2026 FIFA World Cup. As of early April, the lineup of all 48 teams set to compete in the final stage is now complete.
How are threat actors responding? What’s already emerging across deep and dark web communities?
This blog is part of Flare’s World Cup 2026 Cybercrime Series, a collection of focused research pieces examining the evolving threat landscape surrounding the tournament. The series explores key areas including phishing infrastructure, fraud and scams, illegal streaming services, illicit betting platforms, insider threats, and other cybercriminal activities targeting the 2026 World Cup.
Key Findings About World Cup Ticket Trading
- The financial incentive for cybercriminals is substantial: With FBI data suggesting average US scam losses of approximately $25,700 per victim and World Cup ticket purchases often involving multiple seats plus travel packages worth thousands of dollars, a single successful fraud can yield returns well above typical cybercrime operations.
- The vast majority of fans are pushed into high-price ticket purchasing channels with increased fraud risk: Group stage tickets are already trading between $750 and $3,500 on secondary markets, with bundled packages reaching $100,000+. FIFA’s only affordable option (the $60 “Supporter Entry Tier”) is restricted to fans with qualifying attendance history through national federations.
- The gap between FIFA’s intended transfer model and how secondary ticketing platforms operate creates gaps that threat actors exploit: FIFA’s official ticket transfer system is designed to keep all transactions within its own platform, but secondary marketplaces like StubHub deliver tickets directly to mobile phones outside FIFA’s controlled transfer process.
- Threat actors are responsive to investigative attention: they rapidly rotated the infrastructure of at least 15 IP addresses that hosted identical fake ticket resale templates.
- Telegram has emerged as a major secondary market for World Cup ticket trading: Activity ranges from sellers who reference FIFA’s official resale process to operators accepting cryptocurrency payments and offering bundled travel packages with no verifiable connection to official channels. The line between legitimate resale and fraud is difficult for buyers to distinguish.
Monitor Fraudulent Resale Infrastructure Targeting Your Brand
Flare detects coordinated fraud campaigns by monitoring newly registered domains, Telegram resale channels, and underground activity, giving security teams early visibility into fraudulent infrastructure before it reaches customers.
Starting the Ticket Search
Every four years, the World Cup returns and with it, the opportunity to experience soccer at one of its highest levels. So far, the most memorable match I’ve attended was the Copa Libertadores semifinal between Boca Juniors and América de Cali at La Bombonera. This time, I’m aiming to top that with a World Cup match.
Let’s start the journey the same way most fans do: by Googling it.
Google results for “buy world cup ticket”
We took this a step further and searched Flare to see what cybercrime communities could reveal.
Flare results for “How to get FIFA world cup tickets” (Flare link to post, sign up for the free trial to access if you aren’t already a customer)
Below are two platforms identified through a post on Malware News, SeatGeek and StubHub.
SeatGeek
We started with SeatGeek. The website is intuitive and allows users to choose specific matches.
SeatGeek’s FIFA World Cup ticket trading page
I chose the match between Spain and Uruguay.
Page to select seats for the Spain vs Uruguay match
The most interesting part is how the tickets are delivered. In this case, the transfer happens via the official WC26 application, meaning through FIFA’s official channel.
Checkout page shows different options for how the ticket will be delivered
StubHub
StubHub offers a similarly polished experience.
StubHub’s FIFA World Cup tickets page
Page to select tickets for the Uruguay vs Spain match
I reached the stage where the site asks for my credit card details. Payment happens directly on the StubHub website.
StubHub’s payment page
StubHub’s ticket delivery conditions
On StubHub, the tickets are delivered directly to the buyer’s mobile phone. Whether this aligns with FIFA’s intended transfer process is worth verifying, which I do next.
FIFA’s Stance on Ticket Transfers
I signed into my FIFA account and navigated to the official guidelines for ticket transfers.
In essence, the FIFA ticket transfer feature for the 2026 FIFA World Cup enables fans to securely transfer tickets to another person exclusively through FIFA’s official platform (as opposed to riskier methods via third-party sites). Once transferred, the recipient becomes the new ticket holder with full control, including the ability to use, retransfer, or resell the ticket on FIFA’s official marketplace. The process applies to most standard ticket types (with some restrictions), requires a FIFA account, and is designed to ensure transfers remain secure, traceable, and fully compliant with official ticketing policies.
The key takeaway: FIFA intends all transfers to flow through its own platform, not through third-party delivery mechanisms.
Reselling: Official Channels vs Cybercrime Markets
FIFA offers its own marketplace platform, including a dedicated “RESELL” feature for purchased tickets. Unfortunately, without a ticket in hand, we could not complete the full resale workflow on the platform.
Resell tickets option on the official FIFA website
Telegram Resale Activity
The Telegram ecosystem tells a different story, where ticket trading activity is significant. Some sellers are aware of and reference FIFA’s official resale process.
Message to sell 4 World Cup tickets through the official FIFA website
Message to sell FIFA tickets, asking for payment with crypto, and transfer through the FIFA process
Others operate outside any official framework entirely.
Fraudulent Infrastructure: A Coordinated Campaign
Our analysis uncovered a large-scale infrastructure designed to facilitate 2026 FIFA World Cup ticket transfer resale. At the time of discovery, this infrastructure consisted of at least 15 distinct IP addresses, all hosting identical templates intended to facilitate fraudulent ticket resale transactions.
The uniformity of these deployments strongly suggests a coordinated operation rather than isolated activity, pointing to a scalable, pre-positioned campaign ready to exploit the surge in demand.
A dedicated platform to resell FIFA tickets
Two weeks later, the entire infrastructure had either gone offline or been concealed. Some of the hosts changed ports (from 3100 to 8081, 8080, or 3010) and requested credentials to proceed. This rapid adaptation is consistent with operators monitoring for investigative attention and adjusting their infrastructure accordingly.
Financial Incentive: Why Threat Actors Target World Cup Tickets
Financial cybercrime thrives where there is money. This raises a simple question: what’s in it for the cybercriminal?
Despite extensive research, we could not identify a single, definitive official price list for 2026 FIFA World Cup tickets. The only consistent reference from FIFA is the “Supporter Entry Tier,” priced at $60 per ticket and available across all 104 matches. However, these tickets are not part of general public sales. Instead, they are allocated through national federations to loyal fans with a qualifying attendance history.
In practice, availability is extremely limited, representing only a small fraction of total tickets. As a result, the vast majority of fans are pushed into FIFA’s dynamic pricing system, where ticket costs are significantly higher, thus creating an attractive financial opportunity for cybercriminals to exploit demand.
We didn’t find an official price list or standard for those tickets, but we did find various reliable sources. For instance, this blog post provided the following reasonable price list:
| Stage | Category 1 (USD) | Category 2 (USD) | Category 3 (USD) |
|---|---|---|---|
| Group Stage (neutral) | $700 – $1,200 | $500 – $900 | $120 – $200 |
| Group Stage (host nation) | $1,500 – $2,735 | $1,100 – $1,800 | $400 – $700 |
| Round of 32 | $540 | $440 | $225 |
| Round of 16 | $640 | $515 | $240 |
| Quarterfinal | $1,775 | $1,200 | $450 |
| Semifinal | $3,295 | $2,350 | $930 |
| Third Place Match | $800 | $600 | $250 |
| Final | $6,730 – $7,875 | $4,500 – $5,500 | $1,490 – $2,200 |
Based on the platforms we reviewed, most group stage tickets are currently priced between $750 and $3,500 USD. Many will not purchase a single ticket, but at least two or more.
Bundle offers on Telegram, which are not necessarily fraudulent (Flare link to post, sign up for the free trial to access if you aren’t already a customer)
Beyond individual tickets, bundled offerings that include flights, accommodation, transportation, and match access are widely available. “Follow my team” packages covering all three-group stage matches along with travel and lodging can range from a few thousand dollars to upwards of $100,000 USD for premium, all-inclusive experiences.
Scam Loss Context
Recent UK reporting indicates that the average scam loss per victim is around $950 USD. While equivalent figures for the United States are less clearly defined, FBI data suggests a significantly higher average loss of approximately $25,700 USD per victim.
Given that typical cybercrime losses often fall within the thousands of dollars per victim, it is unsurprising that a high-value global event like the 2026 FIFA World Cup has become a prime target for cybercriminal activity.
How Fans and Security Teams Can Best Navigate 2026 World Cup Ticket Sales
The 2026 FIFA World Cup ticket market is a study in how legitimate demand creates criminal opportunity. FIFA’s official transfer and resale mechanisms exist, but they are not intuitive enough to prevent fans from turning to secondary platforms and Telegram channels where the boundary between genuine resale and fraud is unclear. The coordinated infrastructure we uncovered (15 identical fraudulent resale sites that appeared and adapted within weeks) demonstrates that criminal actors are already pre-positioning for the tournament.
For fans, the safest path remains FIFA’s official platform. For security teams and fraud investigators, monitoring the secondary market ecosystem, including Telegram groups, newly registered domains, and emerging resale infrastructure, is essential to protecting customers and brands as the tournament approaches.
Monitor Fraudulent Resale Infrastructure Targeting Your Brand
Flare detects coordinated fraud campaigns by monitoring newly registered domains, Telegram resale channels, and underground activity, giving security teams early visibility into fraudulent infrastructure before it reaches customers.
