World Cup fraud shifts to verified accounts & withdrawals

Fraud patterns shifted towards verified accounts and withdrawals during the World Cup across betting and gaming operators, according to SEON's data from large operators worldwide.

Its analysis found suspicious withdrawal activity rose 38% from the same period in 2025, while the average blocked fraudulent withdrawal value more than doubled to USD $436 from USD $202. Attackers moved away from large volumes of smaller attempts and focused instead on fewer, higher-value cash-out attempts.

That ran against the common assumption that major sporting tournaments mainly trigger fraud at registration, when criminals try to create fake accounts in large numbers. Sign-up block rates fell 16% during the tournament as operators reduced friction to avoid losing new customers to rivals, opening a different route for attackers.

SEON's data showed fraud rings reactivated dormant accounts that had passed verification months earlier and then targeted withdrawals. Across the network, daily identity mismatches on dormant and previously trusted accounts surged 83%.

In Latin America, that measure climbed 118%, though the regional picture differed from Europe and North America. Rather than seeing the strongest pressure at withdrawal, Latin America recorded a registration-stage increase in synthetic identities.

Registration block rates in Latin America rose 19%, while synthetic identity blocks increased 34% against SEON's baseline and 64% against the 2025 comparison period. The region's false-positive rate also rose sharply, suggesting existing rules came under strain as volumes increased.

Regional split

Elsewhere, inherited trust appeared to be a key weakness. In Europe, credential-stuffing campaigns rose 115% during the tournament window, timed to match spikes in match-day traffic, according to SEON's figures.

The findings point to a regional split in attack methods. European and North American markets saw pressure shift downstream towards trusted accounts and withdrawals, while Latin America absorbed a heavier burst of registration-stage identity fraud.

The analysis was based on anonymised, aggregated data from betting and gaming operator customers across all regions. It compared the 46-day tournament period with a 28-day pre-tournament baseline and a 36-day window covering the same calendar period in 2025, using rates per active user or per 1,000 relevant events to adjust for volume differences.

Industry strain

SEON linked the tournament findings to broader pressure on the betting and gaming sector. In separate 2026 fraud and anti-money laundering research, it found 57% of operators reported fraud losses growing faster than revenue.

Betting and gaming was the only industry in that research where operators placed more emphasis on adding staff than on investing in AI and machine learning, with 47% prioritising headcount versus 34% for those technologies. That left more of the response in the hands of manual teams during short bursts of concentrated fraud, particularly around major events.

The underlying issue for operators is that controls built around account creation may not catch attacks that begin after an account has already been verified. Dormant profiles with established histories can look less risky at first glance, especially when transaction monitoring and login monitoring are handled separately.

Accounts used in these attacks had often cleared verification well before the tournament began. When they later appeared on unfamiliar devices, fraudsters attempted larger withdrawals, making the attack harder to detect if firms focused on only one point in the user journey.

SEON, which works with betting and gaming operators and platform providers, argued tournament traffic created conditions in which commercial pressure and fraud risk moved in opposite directions. The push to make registration easier increased competition for players, but it also reduced resistance at the front end while encouraging attackers to exploit weak points further along the chain.

As a result, fraud exposure was not limited to newly created accounts. Previously trusted profiles became a source of risk once they were compromised, acquired or reused, according to SEON's analysis.

"The World Cup showed that fraud does not have a fixed target, and that it goes wherever operators' friction is lowest," said Tamas Kadar, Co-Founder and Chief Executive Officer, SEON. "In most markets, operators eased registration to compete for players so attackers moved downstream, reactivating dormant accounts and pushing hard at cash-out. In Latin America, the pressure landed at sign-up instead as a surge in synthetic identities. The operators that caught it in both places had visibility across the full player journey, not just one stage."