Major sporting events concentrate consumer demand. Fans rush to buy tickets, merchandise, and travel in a short window, and purchase scams follow that demand wherever it spikes.
Recorded Future's Payment Fraud Intelligence team has been analyzing a purchase scam tactic built for exactly this kind of event-driven demand. The tactic amounts to SEO poisoning of legitimate websites. What’s most notable isn’t the scam itself but how it finds victims: through organic search results captured by compromising legitimate websites, without the scammers ever buying ads or acquiring their own domains to rank.
As explained in this report, the basic purchase scam model is simple. A site advertises real-looking goods at steep discounts, takes payment, and never ships the product. The usual draw is social media advertising that points to brand impersonation sites.
For many victims of purchase scams, the crime doesn’t stop there. The fraudsters operating the scams also steal the payment card data of their “customers,” resulting in a string of unauthorized charges if the theft isn’t quickly noticed.
Figures 1-2: Search results showing potential purchase scam pages injected into legitimate websites, and the purchase scam website that visitors are redirected to (Source: Recorded Future)
Getting a brand-new scam domain to rank highly in search results normally requires expensive search engine optimization work. By embedding redirects on legitimate, well-ranked sites, scammers can route organic traffic to purchase scam domains without needing to invest in SEO themselves. The Payment Fraud Intelligence team has observed that scammers are using a consistent four-step pattern:
The redirect is selective: The injected code only fires for visitors who arrive from a search result carrying a specific tracking parameter. Regular visitors and the site's own administrators see the real site, so the compromise often stays undetected. This conditional behavior is a form of cloaking, and it’s what makes the activity so hard to spot.
Additionally, there’s a second layer of concealment. The scam domains themselves aren’t indexed by search engines. Only the compromised pages are indexed, so the infrastructure that actually takes payment stays out of view of researchers and security monitoring.
The economics favor the attacker. The tactic captures organic search traffic without scammers having to pay for the ads or SEO that ranking normally demands, and it generally evades both ad-platform detection and standard search monitoring.
Resilience is built in. Operators rotate domains, branding, and content from shared templates, and they distribute payments across several merchant accounts, so the operation can survive the takedown of any single domain or account.
The approach monetizes traditionally lower-value targets. When fraudsters scan for vulnerable websites and compromised admin credentials, they seek e-commerce websites with checkout pages that can be infected with e-skimmers. With this purchase scam scheme, the fraudsters find a way to monetize unauthorized access to less valuable vulnerable websites: blogs, small-business pages, and informational sites with steady search traffic but without an opportunity for e-skimming.
The scale is real. In the months leading up to the World Cup, the Payment Fraud Intelligence team profiled a cluster of scam activity they refer to as AEGIR, identifying 41 AEGIR scam domains processing through three merchant accounts. These 41 scam domains have amassed roughly 26 million web visits since the domains were created and 17 million in 2026 alone. A shared image hash across those domains points to roughly 1,714 additional sites likely tied to the same operation.
The payment side is where the harm occurs. Payments are dispersed across multiple merchant accounts, and the mismatch between the scam domain and the payment-processing domain enables transaction laundering. The merchant accounts appear to be registered with misused or compromised business identities to pass know-your-business (KYB) checks.
The damage runs two ways: Consumers lose money on goods that never arrive, and the legitimate businesses whose identities or websites are impacted absorb the complaints and the reputational harm.
Event-driven demand is exactly the high-volume, time-sensitive search interest that purchase scams are designed to capture. People are on the lookout for opportunities to attend World Cup games and purchase merchandise or themed content for watch parties with friends. They’re also looking for discounts.
On the face of it, many of the World Cup-related purchase scams appear very similar: perfectly impersonated websites with eye-catching offers. But beneath the surface, fraudsters are taking different approaches to capturing victims. While the compromised-site, search-manipulation method pulls in “organic searchers,” the Payment Fraud Intelligence team is also observing tried-and-true exploitation of online ads on social media to pull in a separate segment of victims.
In one example of online ad-based targeting active in April and May 2026, the Payment Fraud Intelligence team identified 33 World Cup-themed scam domains linked to roughly 2,500 online ads, with several domains using multiple merchant accounts. This points to the same pattern of merchant account reuse and domain rotation, which lets operators replace or expand victim-facing domains while keeping payment flowing through the same infrastructure.
The exposure splits along familiar lines. Financial institutions face risk across fraud, compliance, and customer trust. Defending customers from fraudulent transactions they authorize is difficult. It's hard to detect the scam and navigate intervention.
Hidden downstream fraud costs make defense even harder for financial institutions. The operators of purchase scam campaigns regularly steal the payment card data of “customers” and resell them on dark web marketplaces. This leads to unauthorized fraud attempts with no clear linkage back to the root cause: the purchase scam websites.
The defensive signatures are knowable: referrer-based cloaking behavior, domain rotation patterns, and merchant descriptor anomalies. Recorded Future's Payment Fraud Intelligence monitors the underlying scam infrastructure and links merchant accounts back to a single campaign, making early detection and disruption possible before an event like the World Cup turns demand into losses.
This is a repeatable, resilient fraud model, and it’s likely to persist and spread across more event-driven fraud. The 2026 World Cup is a near-term, high-value target, and the tactic to watch is already in use.
See how Recorded Future Payment Fraud Intelligence surfaces this activity and links it back to the merchant infrastructure behind it. Request a demo.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。