The FIFA World Cup 2026 opened on June 11. By that date, according to Check Point Research, the fraud infrastructure targeting it had already been built, staged, and partially deployed. Threat actor activity was pre-planned, months out, across three sectors and at least ten languages.
Check Point Exposure Management published the FIFA World Cup 2026 Cyber Threat Report this month, covering financial services, transportation, hospitality, and gambling. Here are three findings worth reading carefully.
1 in 3 FIFA Partners Can't Block Email Impersonation
Pre-tournament research by Proofpoint found that more than one-third of official FIFA World Cup 2026 partners lack sufficient DMARC enforcement to prevent domain spoofing. That means attackers can send an email that appears to come from a sponsor, a vendor, or a logistics partner, with no technical barrier stopping it.
The World Cup supply chain is enormous. Airlines, hotels, broadcast partners, merchandise contractors, and catering companies. Every procurement email traveling that chain is a potential interception point. High transaction volumes, tight deadlines, and the operational chaos of a global event create exactly the conditions that suppress payment verification rigor.
Check Point's attack surface management and digital brand protection capabilities are built for this kind of external exposure, continuously monitoring partner ecosystems for authentication gaps and impersonation infrastructure before attackers can use them.
Fake Sportsbook Apps Surged 60x Above Baseline
A controlled comparison across eight major sportsbook brands, covering 60-day windows in 2025 and 2026 using identical methodology, found zero impersonator app detections in the non-tournament baseline. The pre-tournament window found 64. That is roughly 60 times the baseline rate, concentrated in April and May 2026, and concentrated on Google Play.