World Cup of Fraud: Criminals Exploit Bonuses and Dormant Accounts on a Massive Scale

The 2026 World Cup was not only a global highlight for soccer fans but also turned out to be a paradise for cybercriminals and fraudsters. A recent report from the fraud prevention platform SEON highlights that the tournament, which concluded with Spain's victory in July 2026, was overshadowed by massive manipulation attempts. Two areas in particular were targeted: the generous bonus offers from sportsbooks and user accounts that had been inactive for years and were taken over by hackers. Experts are openly speaking of a new dimension of crime in digital gambling.

The scale of activity was so immense that specialists have dubbed the period the World Cup of Fraud. Perpetrators were particularly insidious when dealing with so-called dormant accounts. These accounts had often been properly verified months or years earlier and were considered trustworthy by the operators. During the tournament, these accounts were reactivated to claim bonus funds or launder money, while operators sometimes relaxed their security mechanisms for fear of alienating casual players with overly strict controls.

Numbers and facts

The statistical analysis of the incidents provides alarming details. According to SEON, activity in dormant accounts that had passed verified checks before the tournament increased by 83 percent. In Latin America, this figure was as high as 118 percent. Another indicator of professionalization is the amount of blocked funds. Before the World Cup, the average blocked fraudulent withdrawal attempt was around 202 dollars. During the tournament, this figure rose to 436 dollars as attackers concentrated on fewer but more lucrative individual actions. In Europe, experts also recorded a 115 percent increase in logins using stolen credentials on match days.

George Pace, lead product marketing manager at SEON, clearly categorized the situation in an interview:

"The World Cup, obviously it's every four years, and this is the World Cup of soccer and football, but it's also the World Cup for fraud. You're going to see the biggest promotions. You're going to see the biggest incentives, and there's so many different games, and the fraudsters are looking at this, and they're getting hungry because they know this is going to be a big opportunity for them." - George Pace, Lead Product Marketing Manager at SEON

Background

The problem lies in the nature of major sporting events. Bookmakers try to attract new users or bring back old ones with extremely attractive welcome bonuses and retention campaigns. Fraudsters often use synthetic identities or entire farms of multi-accounts to systematically harvest these bonuses. If an operator promises a 150 dollar bonus for a 5 dollar deposit, for example, the attack surface increases massively. In addition, deepfakes and AI-controlled attacks make the work of security departments more difficult. Cybersecurity expert Matthew Wein also warns that AI will accelerate the pace of attacks without additional costs for the attackers.

Why it matters for German players

For German players, this global fraud wave is an important reminder to be cautious. In Germany, the market is strictly regulated by the State Treaty on Gambling 2021 (GlüStV 2021). Anyone who plays with a provider on the official whitelist of the Joint Gambling Authority of the States (GGL) enjoys a significantly higher level of protection than with illegal MGA or Curacao providers. German licenses require a strict connection to the LUGAS system, which monitors, among other things, the monthly deposit limit of 1,000 euros across all providers. In addition, the Oasis blocking file ensures player protection. However, the risk of identity theft also affects German users. Anyone who has old accounts with betting providers should ensure that no payment data is stored there or delete the account if it is no longer used. The use of secure, individual passwords and two-factor authentication (2FA) is essential given the 115 percent increase in logins with stolen data in Europe.

What it means for GGL-licensed casinos

German casinos with a GGL license must continuously adapt their security standards. The regulation already stipulates that identities must be clarified beyond doubt (KYC). However, the findings from the SEON report show that risks lurk particularly when reactivating existing customers (retention). If a player suddenly wagers large sums after months of inactivity or acts from a new device, the systems must sound the alarm. The 1 euro per spin stake limit for slots applicable in Germany reduces the attractiveness for professional money launderers compared to unregulated markets, but bonus abuse remains an issue. GGL operators must master the balancing act between user-friendly processes and hard security checks in order not to become victims of chargeback fraud or commission fraud by dubious partners themselves.