Guillaume LapointeMillions of Canadians are refreshing "FIFA score" on their phones as the 2026 World Cup plays out across host cities including Toronto and Vancouver. Security researchers warn that the same search surge is a gift to fraudsters: fake live-score apps, spoofed FIFA pages and phishing links are spreading fast, and a single tap can hand criminals your banking logins. Here is how the scam works — and how an IT specialist would tell you to check a scoreline safely.
The numbers behind the World Cup scam wave
The scale is not small. FortiGuard Labs reported that more than 13,000 new domains themed around the FIFA World Cup 2026 were registered between January and May 2026, and roughly 8.8% of them were flagged as malicious or suspicious. Separate research counted more than 4,300 fake FIFA-branded sites already live and hunting for inboxes.
These pages impersonate ticketing portals, merchandise shops, betting platforms and — most relevant to anyone chasing a scoreline — free "live score" and streaming apps. In May 2026, the RCMP and the Canadian Anti-Fraud Centre issued a formal fraud warning ahead of the Canada-hosted matches, singling out fake ticket portals and merchandise fraud aimed at fans in this country.
Why fake "live score" apps are the dangerous part
When you search for a score, you want it in one tap. That impatience is exactly what attackers count on. Researchers at ThreatFabric and Kaspersky found malicious streaming and companion apps spreading Android malware families known as Massiv and Perseus.
These apps live outside the official Google Play and Apple App stores, so installing one means clicking past several warnings from your own phone. Once installed, the malware asks for "accessibility" permissions. Grant them, and the app can record everything you type, drop fake login screens on top of your real banking apps, and quietly intercept the one-time codes your bank texts you. In other words, a free score-tracker can drain an account while you watch the match.
Three red flags an IT expert checks first
You do not need to be a security professional to avoid the trap. Before you install anything or tap a link promising instant scores, run three quick checks.
First, look at where the app comes from. If a "live score" or streaming app asks you to download an APK file directly, or to change your phone's settings to allow installs from "unknown sources," stop. Legitimate score apps are in the official stores.
Second, read the permissions. A score app has no reason to request accessibility access, SMS reading, or the ability to display over other apps. Those are the exact permissions banking malware needs to do its work.
Third, check the address bar. FIFA's own guidance is to type fifa.com directly rather than clicking a search result, and to skip any "sponsored" link at the top of results, because paid imitators buy those slots to divert traffic. The same logic applies to your broadcaster: reach TSN or your streaming service by typing the address, not by following a link in a text message or a social post.
What to do if you already tapped
If you installed a suspicious app or entered your details on a copycat page, treat it as an active breach, not a maybe. Uninstall the app, then run a reputable mobile security scan. Change the passwords for any account you accessed on that device, starting with email and banking, and switch on multi-factor authentication that does not rely on SMS where possible.
Call your bank's fraud line directly using the number on the back of your card — not a number the app or a caller gives you. Then report the incident to the Canadian Anti-Fraud Centre, which tracks these campaigns and can advise on next steps. You can reach it through the federal portal at antifraudcentre-centreantifraude.ca.
It is also worth remembering that even the official channels collect data during a tournament this size. Before you hand over personal details anywhere, it helps to understand what your FIFA ID actually collects and why.
When to bring in a professional
For most fans, careful habits are enough. But if the compromised phone is also your work device, if you run a small business from it, or if money has already moved, the stakes change. A qualified IT security specialist can image the device, confirm whether the malware is fully removed, check whether your credentials are circulating on breach databases, and help you secure connected accounts before more damage is done.
That is especially true for owners who use the same handset for banking, invoicing and client data. Malware like Perseus is designed to persist and to harvest quietly, so a factory reset alone may not be the end of it. An expert can tell you what was actually exposed rather than leaving you to guess.
The World Cup only comes to Canada once in a generation, and the football is worth every minute. Just remember that the safest way to check the score is the boring one: the official app you already trust, opened from your home screen. If a link promises the result faster, that speed is usually the bait.
If you are worried a device has been compromised, connecting with a vetted IT security professional through Expert Zoom takes minutes — and it is far cheaper than a drained account.
