The Purchase Scam Tactic Headed for the World Cup

Recorded Future's Payment Fraud Intelligence team continues to monitor a purchase scam tactic that pulls victims from organic search rather than paid ads by compromising legitimate websites. The scam domains never appear in search results themselves, which means the operations are likely hidden from standard search monitoring and could survive the takedown of any single domain or merchant account. The same tactic is already surfacing in World Cup-themed fraud, and it’s positioned to scale across event-driven scams through 2026.

Why this matters now

Major sporting events concentrate consumer demand. Fans rush to buy tickets, merchandise, and travel in a short window, and purchase scams follow that demand wherever it spikes.

Recorded Future's Payment Fraud Intelligence team has been analyzing a purchase scam tactic built for exactly this kind of event-driven demand. The tactic amounts to SEO poisoning of legitimate websites. What’s most notable isn’t the scam itself but how it finds victims: through organic search results captured by compromising legitimate websites, without the scammers ever buying ads or acquiring their own domains to rank.

Purchase scams, briefly

As explained in this report, the basic purchase scam model is simple. A site advertises real-looking goods at steep discounts, takes payment, and never ships the product. The usual draw is social media advertising that points to brand impersonation sites.

For many victims of purchase scams, the crime doesn’t stop there. The fraudsters operating the scams also steal the payment card data of their “customers,” resulting in a string of unauthorized charges if the theft isn’t quickly noticed.

Screenshot of 3 fraudulent search results for World Cup Adidas X18 Boots Screenshot of fraud website with images of Adidas cleats

Figures 1-2: Search results showing potential purchase scam pages injected into legitimate websites, and the purchase scam website that visitors are redirected to (Source: Recorded Future)

How the tactic works

Getting a brand-new scam domain to rank highly in search results normally requires expensive search engine optimization work. By embedding redirects on legitimate, well-ranked sites, scammers can route organic traffic to purchase scam domains without needing to invest in SEO themselves. The Payment Fraud Intelligence team has observed that scammers are using a consistent four-step pattern:

Gain unauthorized access to a legitimate website.
Plant fake product listings and metadata for search crawlers on that site.
Co-opt the site's existing search ranking to attract shoppers.
Redirect visitors who arrive from a search result to the scam domains.

The redirect is selective: The injected code only fires for visitors who arrive from a search result carrying a specific tracking parameter. Regular visitors and the site's own administrators see the real site, so the compromise often stays undetected. This conditional behavior is a form of cloaking, and it’s what makes the activity so hard to spot.

Additionally, there’s a second layer of concealment. The scam domains themselves aren’t indexed by search engines. Only the compromised pages are indexed, so the infrastructure that actually takes payment stays out of view of researchers and security monitoring.

Why it’s effective and hard to defend against

The economics favor the attacker. The tactic captures organic search traffic without scammers having to pay for the ads or SEO that ranking normally demands, and it generally evades both ad-platform detection and standard search monitoring.

Resilience is built in. Operators rotate domains, branding, and content from shared templates, and they distribute payments across several merchant accounts, so the operation can survive the takedown of any single domain or account.

The approach monetizes traditionally lower-value targets. When fraudsters scan for vulnerable websites and compromised admin credentials, they seek e-commerce websites with checkout pages that can be infected with e-skimmers. With this purchase scam scheme, the fraudsters find a way to monetize unauthorized access to less valuable vulnerable websites: blogs, small-business pages, and informational sites with steady search traffic but without an opportunity for e-skimming.

The scale is real. In the months leading up to the World Cup, the Payment Fraud Intelligence team profiled a cluster of scam activity they refer to as AEGIR, identifying 41 AEGIR scam domains processing through three merchant accounts. These 41 scam domains have amassed roughly 26 million web visits since the domains were created and 17 million in 2026 alone. A shared image hash across those domains points to roughly 1,714 additional sites likely tied to the same operation.

The payment fraud and laundering angle

The payment side is where the harm occurs. Payments are dispersed across multiple merchant accounts, and the mismatch between the scam domain and the payment-processing domain enables transaction laundering. The merchant accounts appear to be registered with misused or compromised business identities to pass know-your-business (KYB) checks.

The damage runs two ways: Consumers lose money on goods that never arrive, and the legitimate businesses whose identities or websites are impacted absorb the complaints and the reputational harm.

Event-driven demand is exactly the high-volume, time-sensitive search interest that purchase scams are designed to capture. People are on the lookout for opportunities to attend World Cup games and purchase merchandise or themed content for watch parties with friends. They’re also looking for discounts.

On the face of it, many of the World Cup-related purchase scams appear very similar: perfectly impersonated websites with eye-catching offers. But beneath the surface, fraudsters are taking different approaches to capturing victims. While the compromised-site, search-manipulation method pulls in “organic searchers,” the Payment Fraud Intelligence team is also observing tried-and-true exploitation of online ads on social media to pull in a separate segment of victims.

In one example of online ad-based targeting active in April and May 2026, the Payment Fraud Intelligence team identified 33 World Cup-themed scam domains linked to roughly 2,500 online ads, with several domains using multiple merchant accounts. This points to the same pattern of merchant account reuse and domain rotation, which lets operators replace or expand victim-facing domains while keeping payment flowing through the same infrastructure.

What this means for financial institutions

The exposure splits along familiar lines. Financial institutions face risk across fraud, compliance, and customer trust. Defending customers from fraudulent transactions they authorize is difficult. It's hard to detect the scam and navigate intervention.

Hidden downstream fraud costs make defense even harder for financial institutions. The operators of purchase scam campaigns regularly steal the payment card data of “customers” and resell them on dark web marketplaces. This leads to unauthorized fraud attempts with no clear linkage back to the root cause: the purchase scam websites.

The defensive signatures are knowable: referrer-based cloaking behavior, domain rotation patterns, and merchant descriptor anomalies. Recorded Future's Payment Fraud Intelligence monitors the underlying scam infrastructure and links merchant accounts back to a single campaign, making early detection and disruption possible before an event like the World Cup turns demand into losses.

Outlook

This is a repeatable, resilient fraud model, and it’s likely to persist and spread across more event-driven fraud. The 2026 World Cup is a near-term, high-value target, and the tactic to watch is already in use.

See how Recorded Future Payment Fraud Intelligence surfaces this activity and links it back to the merchant infrastructure behind it. Request a demo.

Explore expert insights, reports, and tools to strengthen your cybersecurity strategy.