E-Paper
Sign In
Game on, scams up: Hospitality and MICE in the cyber crosshairs
As global sporting events draw millions of visitors and billions in revenue, cybercriminals are exploiting the surge in travel, accommodation and event-related transactions with increasingly sophisticated fraud tactics
- PUBLISHED: Fri 10 Jul 2026, 9:00 AM
As sports fans, corporate groups and tourists prepare for the world’s biggest sporting spectacles and business gatherings, cybercriminals are also stepping onto the field — armed with increasingly sophisticated tactics designed to exploit the surge in travel, bookings and event-related transactions. High-profile events such as the Fifa World Cup and major Meetings, Incentives, Conferences and Exhibitions (MICE) showpieces have become more than magnets for visitors, investment and networking opportunities; they are also prime targets for fraudsters eager to cash in on the excitement.
The days when phishing scams could be easily spotted through spelling mistakes and suspicious email addresses are long gone. Today’s cybercriminals are playing a far more sophisticated game, leveraging artificial intelligence, cloned websites, deepfake audio and video messages, and highly targeted Business Email Compromise (BEC) schemes to deceive hospitality operators, event organisers, exhibitors and corporate buyers. Their tactics are more convincing, more personalised and increasingly difficult to detect.
Recommended For You
Recent incidents highlight the scale of the threat. Fraudulent booking portals have masqueraded as official accommodation partners, fake ticketing platforms have targeted eager sports fans, and scammers have posed as exhibition organisers to sell counterfeit attendee databases or reroute exhibitor payments. In other cases, hotels, venues and event organisers have received seemingly authentic emails from senior executives, suppliers or trusted partners, only to discover later that funds had been transferred to criminal accounts.
With major events generating a whirlwind of transactions, last-minute changes and tight operational deadlines, the opportunities for fraud multiply. Industry experts warn that hospitality and MICE organisations cannot afford to take their eye off the ball. Robust verification procedures, employee awareness training and advanced cybersecurity controls are now essential components of event risk management.
“As MICE events become increasingly digital, cybersecurity must be treated with the same importance as physical security,” industry experts note. “The strongest defence combines technology, staff vigilance and rigorous verification processes.”
In an era where appearances can be remarkably deceptive, staying one step ahead of cybercriminals is no longer a competitive advantage, it is a business imperative.
Targeting hospitality, MICE
Satnam Narang, Senior Staff Research Engineer - Special Research Operations, Tenable opined that scammers now act smart and have been using more sophisticated techniques to target hospitality, and meetings, incentives, conferences, and exhibitions (Mice) sectors.
“Scams have grown significantly more powerful and sophisticated since the 2022 World Cup. Historically, the biggest indicators of fraud were poorly designed campaigns with obvious grammatical errors, showing that English was not the scammer’s native language. Today, generative artificial intelligence and Large Language Models (LLMs) completely erase these text barriers, allowing criminals to draft flawless, highly convincing lures with ease.
Visual scams have also matured rapidly. Back in 2022, deepfakes and fake imagery were limited in accessibility but now, advanced AI image models enable scammers to effortlessly generate realistic imagery to promote counterfeit tickets and merchandise,” Narang told BTR.
“To evade the public eye and security tools on mainstream social media platforms, threat actors have also adapted by shifting their operations into private spaces, taking consumers off these tracked platforms and instead using direct messages (DMs) or using messaging apps like WhatsApp, Telegram, and Discord.”
Lance Sptizner, Senior Instructor at SANS Institute, said cyber attackers have become incredibly sophisticated at how they target their victims. It does not matter what industry or event that is involved, they tend to use the same highly effective methods. The reasons these attacks are becoming so effective includes
Many of today’s attackers are highly organised groups who have been operating for years, building on a tremendous amount of experience. Some highly organised groups are state sponsored by countries, running massive compounds with thousands of people running the scams. China is a prime example with numerous massive compounds in SE Asia focused on scamming victims out of the west.
“Today’s attacks are far more customised as cyber attackers have access to a wealth of data online, not only from other cyber criminals but purchasing databases from legitimate online marketing firms or simply harvesting data on people based on what they post publicly,” Sptizner told BTR.
He said AI has made customised attacks not only far more effective, but far more automated. In addition, AI enables attackers to easily customise their attacks for any culture, in any language, and for any event. “Combine these three factors (and many more) cyber attackers are not only growing in sophistication of their scams and attacks, but frequency.”
Rafe Pilling, Director of Threat Intelligence at Sophos X-Ops Counter Threat Unit, said scams in the hospitality and events sector have become highly organised and professional, often operating with the functional specialisation of a legitimate business. Sophos CTU tracks groups using infostealer malware to access hotel booking and payment systems, alongside web skimming attacks that quietly capture card details from compromised booking sites.
“While businesses are often the entry point, the real focus is individuals, with stolen data used to target travellers directly at scale. These operations are supported by a wider criminal marketplace offering spam services, stolen credentials and ready-made tools, making advanced scams widely accessible. As a result, individuals are now exposed throughout the entire journey, from booking tickets to follow-up communications, making everyday travel-related interactions a key target for well-organised criminal activity.”
Meriam ElOuazzani, Vice-President for Middle East, Turkey, and Africa at Censys, said scams in hospitality and major events have become much more professional. They are no longer limited to badly written emails or obvious fake websites. Today, criminals build convincing booking pages, copy official branding, use local languages, run paid ads, and time their campaigns around ticket releases, hotel shortages, visa questions and travel deadlines.
“That matters because fans and travellers often make decisions under pressure. When someone is trying to secure a match ticket, hotel room or hospitality package before prices rise, they are more likely to click quickly and check later. Scammers understand this. They use urgency, scarcity and familiar-looking brands to make a fake offer feel legitimate.”
“SOC teams face a problem here that a lot of these malicious activities happen outside of their network perimeter. So, a forged website that offers to buy a ticket or a hotel room may not interact with the network, but it may still damage the organisation's reputation and its customers. Therefore, SOC teams need the ability to see what is going on outside their network perimeter that includes current data about domains, certificates, web servers and any other related information. It means that Internet intelligence tools such as Censys will be useful for analysing suspicious links.”
Lessons from Fifa 2022
Sptizner said the lesson is straightforward, and it has been reinforced at every major event: cyber criminals are incredibly pushy, very aggressive, and very creative. They come at people in every language, in every part of the world, with every scam possible.
“Past World Cups have shown that no fan demographic is too niche to target and no communication channel is off limits. Criminals use email, text messages, social media, and fake websites. They impersonate tournament organizers, airlines, hotels, and streaming platforms. They manufacture urgency, warning that your ticket purchase has failed, that your booking will be cancelled, that you must act immediately or lose access. That pressure is not accidental. Scammers depend on speed. They need you to act before you think. The consistent takeaway from major sporting events is that if it sounds too good to be true and it feels incredibly urgent, it is probably a scam.”
Narang is of the view that major sporting events like Qatar 2022 highlight that massive security investments and proactive enforcement are vital to counter threat actors.
“Qatar spent an estimated $1.1 billion on cybersecurity, partnering with Interpol’s Project Stadia to secure Internet of Things (IoT) networks and industrial control systems. Yet, despite these defences, the scale of consumer-targeted piracy remains a monumental challenge.”
Prior to the 2022 competition, he said the Alliance for Creativity and Entertainment (ACE) shut down a major live sports piracy ring consisting of 42 illegal streaming websites. These platforms alone had amassed over 300 million user visits in just six months, proving the immense global demand for alternative viewing options.
“For security experts, it’s important to learn from previous competitions. One of the biggest lessons is that scarcity and/or lack of broadcast accessibility in certain regions will drive sports fans to ignore basic safety practices, making them highly vulnerable to copycat streaming scams.”
Pilling observed that high profile events are attractive topical themes for scammers. “Criminals prepare well in advance for major events, setting up convincing fake ticketing, travel and accommodation sites months before the tournament begins. These scams are pushed directly at fans through social media and messaging apps, making individuals the primary target.”
At the same time, he said the wider ecosystem, including hotels and transport providers, can be targeted to collect data that is later used to defraud travellers.
“The concentration of demand and urgency creates a short window where large numbers of individuals are making quick purchasing decisions, which attackers exploit effectively, often through enticing offers that are too good to be true. Clear messaging directing fans to official outlets and warning around scams is key to reducing the impact of cybercrime and fraud for major sporting events.”
One thing that the Qatar 2022 tournament has shown clearly is that the cyber risk associated with a major sports event cannot be left to the organizing body alone. Cyber risks cut across the entire economic chain of an event, from spectators to media platforms, according to ElOuazzani.
She said the most important lesson was that fraud follows attention. Before Qatar 2022, there were over 16,000 scam domains created with themes related to the World Cup, along with fake applications, fake social media accounts, scam ads, ticketing scams, fake merchandise and fake job scams. That scale shows how early criminals prepare and how quickly they move when public demand rises.
“Official channels are essential, but they do not solve the problem by themselves. Fans need clear guidance, while security teams need to watch for the infrastructure behind the scams: new domains, reused templates, suspicious certificates, fake registration pages and connected hosting patterns. During a major event, weak signals can become real incidents quickly. Good data helps a SOC decide what deserves attention and what is just background noise.”
For the META region, this is especially relevant. Scams often move through messaging apps, unofficial travel agents, social media sellers and multilingual communities, she said. “A fraud campaign may be launched in one country, hosted in another and aimed at fans travelling through a third. That cross-border nature makes early visibility and coordination more important.”
Most prevalent scams in 2026
Pilling said the biggest risks in 2026 will come from traditional fraudulent sources like fake ticketing ecosystems, compromised booking platforms, phishing campaigns and impersonation of official partners. “These scams are increasingly designed to target individuals directly, often appearing as genuine offers, confirmations or updates linked to travel plans. Even when legitimate platforms are compromised, the impact is felt by the end user, whose payment data or credentials are stolen and reused. This means that even cautious fans can be affected, as the trust they place in familiar brands is being exploited. Reducing risk therefore depends on awareness and robust security across the platforms individuals rely on throughout their travel journey.”
ElOuazzani said the most prevalent types of scams in 2026 will probably revolve around ticketing, hospitality, travel, and payments. The fans can expect to find Fifa-lookalike websites, ticket resale websites, hospitality frauds, fake hotels and apartment accommodation offers, merchandise sites, streaming links, betting scams, visa and other document frauds, and social media profiles offering late access.
“The risk is not theoretical. Warnings for the 2026 tournament have already mentioned fake FIFA sites created to obtain private data, offer counterfeit tickets and hospitality packages. Such schemes function well since they have a familiar appearance and emerge when fans need to make a decision quickly.”
She said the most effective traps create pressure. Messages such as “only two seats left,” “pay now to confirm,” “your booking will be cancelled,” or “verify your account before matchday” are designed to move the victim from interest to payment before they check the source.
“A professional-looking website is no longer proof of legitimacy. Many scam pages now look clean, localised and secure. The padlock on the browser indicates that the connection is secure, but doesn’t tell anything about whether the seller is legitimate or not. The fans need to pay attention while clicking on the links provided by sponsored search results, messaging apps, QR codes from unexpected sources and payment methods such as bank transfers and cryptocurrencies.”
For the defenders, she said the task is to identify suspicious infrastructure. “Scam campaigns often leave patterns behind: newly created domains, similar web templates, reused certificates, related hosting providers and repeated naming conventions. High-quality data helps SOC teams connect those signals before the campaign becomes a larger customer-impact issue.”
Narang said financially motivated cybercrime is the primary concern for 2026, as fraud remains the most lucrative endeavour for cybercriminals.
One major threat is the "ClickFix" social engineering technique, which tricks users on fake streaming sites into running malicious commands on Windows or macOS machines. It exploits learned behaviors, disguised as human verification, CAPTCHAs, or missing video codecs, to deploy info-stealers and remote access trojans.
“You can be guaranteed that fake streaming websites will also pop up, aiming to harvest personal information or deliver malware. And fans could face sophisticated ticket scams utilising AI-generated imagery to promote counterfeit sales on unregulated marketplaces or social media.”
Finally, he said the multi-billion-dollar boom in prediction markets has paved the way for unregulated, crypto-specific prediction sites. “These traps lure users into betting on hyper-specific match outcomes (like Golden Boot winners) before siphoning away their funds.”
Role of AI tools
ElOuazzani of Censys said AI makes scams more efficient, sophisticated, and scalable. It can be used by criminals to develop better messages, translate their campaigns into various languages, produce false customer service scripts, fake images or profiles, and apply the same scam in different markets. This becomes especially important where there are multiple languages, much traveling, and trans-border communities.
The basic crime is not new. Fake tickets, fake bookings and fake payment pages have existed for years. What has changed is the quality and speed of production. The old warning signs, such as poor grammar or awkward translation, are less reliable. A fake booking page, message or support email can now sound polished, local and credible.
For defenders, AI can help with triage, pattern detection and response speed, but it is not a substitute for sound data. Poor data simply produces faster wrong answers. “The value of a SOC lies in combining automation and validated context information about which part of the infrastructure is online, how it is set up, to which part it is connected, has it been seen before, and does it look like any known malicious actions.”
Narang said generative AI tools have completely altered the cybersecurity landscape, functioning as a major boon for cybercriminals while forcing defenders to implement stricter technical boundaries.
“For scammers, both frontier models (like ChatGPT) and open-source models (like DeepSeek) lower the barrier to entry. They allow attackers to instantly eliminate language barriers, build convincing streaming sites, and design highly realistic fake tickets. This makes scams tougher for the average consumer to detect.
“For defenders, the threat demands robust, network-level intervention. Organizations must prioritise endpoint detection and response (EDR/XDR) tools alongside secure web gateways to block malicious behavior when employees watch matches while officially ‘on the clock’. While tech companies are fighting back with defensive AI tools, such as Google's SynthID watermark detection to flag AI-generated content, these solutions are not yet universally adopted.”
Sptizner agreed that AI tools are changing the threat landscape for both scammers and defenders and identified three keys areas.
Automation: AI enables cyber attackers to automate and accelerate their processes. Before AI cyber attackers would have to spend hours if not days collecting data on victims, researching and analysing that data, then customizing their scams and attacks. AI can reduce that into just seconds, and often better than a human.
Customisation: AI can translate an attack into any language, modified for any culture, and adapted to any industry or event. This enables cyber criminals to have a far greater global reach.
Deepfakes: AI not only automates and accelerates traditional scams and attacks, but AI adds new methods such as voice cloning or video cloning. That phone call you received from a loved one or your boss is not really them but AI cloning their voices so cyber attackers sound like them.
“While AI is not a core driver in cybercrime yet, AI is making it easier for cybercriminals to target individuals at scale with far more convincing scams. Attackers can now generate high-quality, personalised messages in multiple languages, making phishing attempts harder to spot and more relevant to the target,” according to Pilling of Sophos.
AI is also speeding up the testing and refinement of tools used to steal credentials and payment data, while enabling more realistic impersonation techniques. “On the defensive side, organisations are using AI to detect unusual behaviour and respond more quickly. The challenge is that individuals can be on the receiving end of increasingly believable attacks that can be manufactured rapidly, with generative AI used to create the text and digital assets used in a scam.”
Go for safety measures
About some precautionary steps before travelling and attending the events, ElOuazzani said general rule should be to always use only the legitimate channels for obtaining tickets, hospitality and tournament information.
“Never click on any link that is not an official website address entered in the browser. When selling tickets, only use the official Fifa resale/exchange website. Hospitality packages should be checked against official providers and appointed sales agents, not just a professional-looking website.”
Before traveling, fans should confirm that their tickets are available through the official mobile-ticketing process, check visa and entry requirements through official government sources, book accommodation through reputable platforms, and use payment methods that offer some protection if something goes wrong.
“They should avoid bank transfers, cryptocurrency payments and sellers who push for quick payment outside recognised platforms. Multi-factor authentication should be enabled on email, banking, travel and ticketing accounts, because those accounts become more valuable during a major trip.”
While at the event, she said fans must look out for any QR codes other than the ones provided by the official organisation, any suspicious individuals offering assistance and anyone stating that there is some sort of problem with their ticketing/hotel arrangements/payment. “Do not log into personal accounts via email, SMS or any social media application. Moreover, public Wi-Fi must not be used for anything related to their bank account, tickets, or anything else sensitive.”
Fifa’s role is to reduce risk by directing fans to official ticketing, authorized hospitality, mobile ticket delivery, resale and exchange options, and published safety guidance. However, while these actions have made the route of becoming a fan somewhat safe, they cannot prevent all scams from occurring on the Internet. The best way to protect yourself is through a combination of all three factors mentioned above, according to ElOuazzani.
Pilling of Sophos said fans can reduce their risk by sticking to official ticketing channels, enabling multi-factor authentication, avoiding public Wi-Fi for sensitive activity and being cautious with any unsolicited offers.
“Fifa has strengthened protections within its own platforms, including secure digital ticketing and official apps, which help protect transactions made through those channels. However, most scams target individuals outside of these controlled environments, particularly through fake websites, social media and messaging apps. This means the biggest risk comes down to personal decisions during booking and travel, where simple steps like verifying sources and avoiding rushed purchases can help prevent fraud.”
Narang said soccer fans or sports enthusiasts should take safety measures before travelling to attend major events such as Fifa World Cup.
“To stay safe, fans must strictly rely on official, verified channels. When purchasing World Cup tickets, consumers should only use reputable platforms that guarantee ticket authenticity, avoiding private-party sales on social media, other unregulated marketplaces or via direct messages where possible.”
For viewing matches, he said fans should exclusively use trusted streaming services (such as FOX Sports, BBC iPlayer, Peacock, and Hulu + Live TV) because illegal streams heavily risk malware infections. Any prediction betting should be restricted to legally regulated platforms within the consumer’s geographical location.
And fans should also ignore unsolicited emails promising "too good to be true" deals or requesting password resets. FIFA supports fan protection by offering direct ticket purchases and official media content safely through its website.
“Government agencies are actively coordinating defences; for example, the US CISA has issued specific tournament preparation guidelines to manage response efforts.”
Sptizner echoed similar views and advised sports lovers to adopt some practical steps before travelling and attending the events. He suggests:
Go directly to trusted sources. Type the URL yourself. Do not click on links in social media posts, emails, or text messages, those can easily be spoofed. By going directly to well-known, trusted sites you may end up paying more, but you will not be scammed.
Treat urgency as a red flag. Any message that pressures you to act immediately should make you stop, not speed up. Scammers depend on speed. If you receive a warning about a cancelled booking or a failed payment, do not click the link. Contact the company independently using verified contact details.
Watch how you are being asked to pay. Requests for cryptocurrency, wire transfers, or gift cards should immediately raise concern. Legitimate vendors rarely require these forms of payment. Use a major credit card or a well-known electronic payment platform like PayPal, both offer additional purchase protection if something goes wrong.
Apply healthy scepticism to everything. If an offer sounds too good to be true, it almost certainly is. If a deal feels too urgent to pause on, that urgency is almost certainly manufactured. Cyber criminals thrive on rushing people into making mistakes.
“The bottom line: be cautious in your purchases and your actions. The excitement of the World Cup is real. So is the risk. Take a breath before you click,” he said.
Most common traps
Sptizner of SANS Institutute described several categories of scams, which are likely to be active throughout the tournament and other major events.
Fake ticket sales: Criminals create professional-looking websites or social media posts that appear legitimate. Some copy official branding and logos, while others purchase online advertisements, so their fake sites appear at the top of search results. Victims pay for tickets that are never delivered or they receive digital tickets that fail at the stadium entrance. Often, payment is requested through wire transfers, cryptocurrency, or peer-to-peer apps, which are difficult to reverse.
Urgent messages: You receive emails or text messages claiming to be from tournament organisers, airlines, hotels, or streaming services. These messages often warn that your ticket purchase failed or that your booking will be canceled unless you confirm payment immediately. These messages are crafted to look urgent and legitimate to entice the buyer to act quickly without thinking logically. The link ultimately leads to a fake login page designed to steal your credentials. Just as with other scam campaigns, attackers rely heavily on urgency and the fear of losing access.
Streaming scams: Criminals create fake platforms offering “free live coverage” of matches. To watch, you are asked to create an account and enter payment details. Instead of viewing the match, you may unknowingly install malware or have your financial information stolen.
Bad merchandise: Even merchandise and giveaways become tools for exploitation. For example, fake contests can promise official jerseys or exclusive prizes in exchange for personal information. Counterfeit online stores can sell discounted gear but either ship low-quality fakes or nothing at all.
