Kaspersky Lab experts have identified phishing emails from fraudsters offering users the chance to snap up much sought after ‘guest’ tickets to the 2018 FIFA World Cup – but at a higher price than fans bargained for.
Some tickets are on offer at 10 times their original price and while the tickets are likely to be unusable – due to a strict registration and transfer procedure – fraudsters are taking the money and collecting users’ private data, including payment information, to steal more funds in a two-fold monetisation scam.
Major events attract fraudsters’ attention, with the noise and excitement around them making it easier for attackers to prey on their potential victims’ lack of vigilance. Recipients are drawn to the seemingly legitimate emails which focus on global sporting championships watched by big audiences across the world. The upcoming World Cup is no exception.
This event is particularly interesting because there are a number of obstacles complicating the process of buying tickets. For instance, tickets can only be purchased on the official FIFA website and the procedure is multilayered and sophisticated for security reasons.
Ordering a ticket takes place in three stages and only one ticket per person is allowed. The exception to this is guest tickets, which allows the purchaser to buy up to three additional tickets. However, these are registered to specific names and can only be changed if the holder applies to transfer the intended recipient to another. Despite this complicated process, fraudsters have used this to their advantage.
When the window to purchase tickets opened, the official website experienced a massive surge in users attempting to order their tickets, which led to connection problems. During the process, fraudsters bought up as many tickets as they could with the aim of selling them on to a desperate fan base. With tickets now sold out, many people have been left with no alternative but to go to touts or third parties in order to be at a game.
Fraudsters have set up hundreds of domains with wording related to the World Cup, to sell their guest tickets. Many have increased the price to more than double face value, with some tickets available at up to 10 times the original cost, according to Kaspersky Lab experts.
With full advance payment required, there is no guarantee that fraudsters will forward the tickets, that guest tickets reserved for other people will work at a stadium, or that they will be genuine. What is guaranteed, however is that the payment information used to buy the tickets will give scammers all they need to collect additional funds from the user in the future.
“According to our research, there is a real risk that users will pay a lot of money and get nothing in return. This type of cyberfraud can also lead to further money stealing. We urge sport fans to be extra vigilant and savvy when buying tickets. No matter how attractive the offer is, the only way to ensure you won’t get duped is to use authorised sellers,” said Andrey Kostin, Senior Web-Content Analyst at Kaspersky Lab.
To make sure users don’t become victims of this type of scam, Kaspersky Lab’s anti-phishing system detects and blocks fraudulent emails and websites.
There are also a number of simple steps that football fans can follow to keep themselves and their money safe, both during the World Cup and beyond:
– Be vigilant. Only buy tickets from the official sources and always double check the site address and the links you want to follow
– Do not click on links in emails, texts, instant messaging or social media posts if they come from people or organisations you don’t know or have suspicious or unusual addresses
– Have a separate bank card and account with a limited amount of money, specifically for online purchases. This will help to avoid serious financial losses if your bank details are stolen
– De-risk the data. It is better to install a reliable security solution with up-to-date databases of malicious and phishing sites
