The FIFA World Cup 2026 created a surge of activity across ticketing, travel, hospitality, merchandise and digital commerce, making it one of the most complex purchasing environments of the year.
Major sporting tournaments provide a useful lens through which to examine a broader challenge facing merchants, payment providers and financial institutions. Similar patterns emerge during concert tours, holiday shopping periods, major product launches and other events that drive sudden spikes in consumer demand.
In each case, legitimate customers begin behaving differently. They buy at speed, transact across borders, use unfamiliar devices and payment methods, and make higher-value purchases under time pressure. At the same time, attackers attempt to exploit those same conditions.
Go deeper with GlobalData
Access deeper industry intelligence
Experience unmatched clarity with a single platform that combines unique data, AI, and human expertise.
As a result, modern fraud prevention is becoming less about identifying behaviour that looks unusual and more about accurately distinguishing legitimate customers from fraudulent activity in context.
Legitimate complexity creates cover for abuse
The commercial opportunity around demand spikes is significant. Merchants want to capture revenue, issuers and payment providers want to support seamless approval, and customers expect fast, reliable checkout journeys.
Yet the same conditions also create ambiguity. Cross-border activity, location mismatches, unfamiliar devices, rapid repeat purchases and high-value baskets are all signals that risk systems have historically scrutinised. During moments of concentrated demand, however, they can be normal features of legitimate customer behaviour.
This is where attackers find opportunity. The greater the volume of genuine complexity, the easier it becomes for malicious activity to blend into the background. Fraud prevention therefore cannot rely on single indicators or broad assumptions about what a “normal” customer looks like.
Account takeover and synthetic identity are becoming more prominent
Recent fraud patterns show that abuse is no longer concentrated in a single attack type. Merchants and payment providers increasingly have to manage multiple vectors at once, including account takeover, synthetic identity fraud and new-account fraud.
Account takeover remains particularly difficult because the attacker inherits the credibility of an established customer profile. The account may have a long transaction history, familiar credentials and previous successful purchases. On the surface, activity can appear low risk, while inconsistencies emerge only when payment, identity, behavioural and device signals are assessed together.
Synthetic identity fraud is an equally important challenge. Rather than misusing a single existing account, bad actors can combine fabricated and real identity attributes to create profiles that appear plausible over time. These identities may not trigger obvious red flags at the point of transaction, particularly when digital onboarding, alternative payment methods and frictionless checkout flows reduce the visibility of traditional signals.
New-account fraud adds another layer of risk, as attackers attempt to exploit merchants before sufficient behavioural history has developed. In each case, the common thread is adaptability: organised abuse shifts towards whichever route offers the best chance of resembling genuine customer activity.
Urgency changes the risk equation
High-demand periods also intensify the commercial tension between risk management and customer experience. Whether a customer is buying match tickets, booking a hotel, purchasing limited inventory or accessing digital goods, speed matters. Delays can quickly translate into abandoned baskets, lost revenue and weaker customer relationships.
Those attempting abuse understand this pressure. They know that during peaks, merchants may be focused on maximising approvals, payment providers may be processing unusually high volumes, and customers may be less predictable than usual. This leaves organisations walking a fine line. Excessive controls can create false declines and unnecessary friction for good customers. Insufficient controls can increase exposure to chargebacks, abuse and operational cost.
The answer is not simply to add more checks. It is to apply friction intelligently, based on genuine risk and the broader context of the transaction.
Context is becoming more important than individual signals
For years, fraud prevention depended heavily on known risk indicators. But global digital commerce has made many of those indicators less reliable when viewed in isolation.
A shopper buying from another country, using a foreign-issued card or switching devices may once have appeared unusual. Today, these behaviours are common across travel, hospitality, retail, marketplaces and subscription services, especially when demand moves quickly.
At the same time, those attempting abuse deliberately exploit this ambiguity. They hide within legitimate patterns of cross-border commerce, knowing that unusual behaviour is no longer a clear proxy for fraudulent intent.
More effective fraud decisioning depends on evaluating multiple signals together, including identity data, account history, device intelligence, behavioural patterns, payment information and transaction context. Looking at any one signal alone rarely provides a complete picture.
Trust is becoming a competitive differentiator
Fraud prevention is often treated as a security function, but in digital commerce it is also a trust function. Customers expect to be protected, but they also expect to complete legitimate purchases without unnecessary disruption.
For merchants, payment providers and fintechs, that balance has direct commercial implications. Accurate decisioning can support higher approval rates, reduce avoidable false declines and help preserve customer confidence at the moments when demand is highest.
The lesson from the World Cup and UEFA competitions is therefore not limited to sport. The same dynamics apply during holiday shopping periods, travel peaks, product launches, limited drops, hospitality surges and any ecommerce environment where legitimate behaviour becomes harder to interpret.
As commerce becomes faster, more global and more digital, the organisations that perform best will not be those that simply add more controls or create more friction. They will be those that can distinguish legitimate customers from fraudulent activity with greater accuracy, even in periods of volatility.
That ability is increasingly becoming a competitive advantage, underpinning payment performance, digital trust and long-term customer relationships.
Aviram Ganor, General Manager EMEA & APAC, Riskified
