Proofpoint warned that FIFA World Cup 2026 fans could face heightened impersonation scams after finding that more than one-third of domains tied to official tournament sponsors, suppliers, partners and supporters are not using the strongest email protections.
In a report shared with TheCoinHeadlines, the cybersecurity company said its analysis of 25 domains linked to the World Cup 2026 partner ecosystem showed that most brands had adopted baseline authentication controls, but many were still not actively blocking fraudulent emails that could be sent in their name.
The tournament, scheduled to run from June 11 to July 19, 2026, is expected to drive a surge in ticketing, travel, hospitality, merchandise and promotional activity, creating a wider opening for cybercriminals to target fans with fake offers and brand impersonation attempts.
Sponsor domains show protection gap
Proofpoint said 24 of the 25 domains it reviewed, or 96 percent, had published a DMARC record, showing that nearly all of the organizations had taken at least an initial step to protect their domains from email abuse.
However, only 16 domains, or 64 percent, were using the strongest DMARC “reject” policy, which blocks unauthenticated messages from reaching inboxes. That leaves 36 percent of the analyzed domains without a proactive block against spoofed emails that impersonate trusted brands.
Another eight domains, or 32 percent, were either in monitoring mode or using partial enforcement, giving the companies visibility into suspicious activity but not fully preventing fraudulent emails from being delivered.
DMARC, short for Domain-based Message Authentication, Reporting and Conformance, helps verify whether an email claiming to come from a specific domain is legitimate. Organizations can choose whether failed messages are accepted, quarantined as spam or rejected outright, with rejection offering the highest level of protection.
Travel rush, ticket demand widen scam risks
Proofpoint said major global sporting events remain attractive targets for fraudsters, as they bring together high demand, emotional urgency and large volumes of online transactions, giving scammers an opportunity to pose as airlines, ticket providers, hospitality firms, delivery services or consumer brands to trick fans into sharing personal details or making payments for fake deals.
“Major events like the FIFA World Cup naturally generate huge excitement — from travel plans and ticket purchases to special offers and merchandise. Unfortunately, that also creates opportunities for scammers to take advantage of fans,” said Matt Cooke, EMEA cybersecurity strategist at Proofpoint.
What the warning means for fans
The findings do not indicate that FIFA sponsors or partner brands have been breached, but point to a wider impersonation risk where scammers could use trusted World Cup-linked names to send fraudulent emails targeting fans.
Proofpoint said fans should treat unsolicited messages with caution, especially those offering tickets, travel packages, merchandise discounts or urgent payment links.
Fans should also avoid sharing passwords or financial details by email or text, check website addresses carefully before entering personal information, and use official brand websites or apps rather than links inside unexpected messages.
The company also recommended using unique passwords for ticketing, travel and payment accounts, enabling multi-factor authentication where available, and slowing down before acting on messages that pressure users to pay quickly or claim a limited-time offer.
