The other tournament started early.
Every match draws millions of new accounts at sportsbooks and prediction markets. Fraud rings follow the crowd. We are tracking where the attacks come from, country by country, every day of the tournament.
Where the attacks come from.
| Rank | Move | Country | Share |
|---|---|---|---|
| 1 | – |  Canada | 66.65% |
| 2 | 2 |  Mexico | 16.63% |
| 3 | NEW |  Colombia | 5.72% |
| 4 | NEW |  Spain | 2.17% |
| 5 | NEW |  Argentina | 1.83% |
| 6 | NEW |  Brazil | 1.30% |
| 7 | NEW |  Morocco | 1.30% |
| 8 | 6 |  Norway | 1.18% |
| 9 | NEW |  Paraguay | 1.04% |
| 10 | NEW |  France | 0.97% |
36 days in, the clearest signal isn't on the field — it's in the promotions. Fraud is following the money, concentrating on the platforms running the most aggressive World Cup acquisition campaigns.
Day 36 note: Independence Day belongs to Canada. Our northern neighbor commands 66.65% of international fraud share — the highest single-day concentration of the tournament, surpassing last week's 51.87% peak. Mexico takes a distant #2 at 16.63%, and Colombia jumps to #3 at 5.72%. Together, Canada and Mexico account for more than 83% of all non-US fraud attempts on the holiday — a two-country concentration we haven't seen at any point in the last three weeks.
Europe and South America fill the middle: Spain (#4), Argentina (#5), Brazil (#6), Morocco (#7), Norway (#8), Paraguay (#9), and France (#10) round out the top 10 — a distinctly Atlantic-facing board with the Central American and Caribbean cluster that dominated last week almost entirely absent. Honduras, El Salvador, Jamaica, Puerto Rico, and the Dominican Republic all drop out of the top 15. Norway holds its top-15 slot for a tenth straight day.
Two numbers from the last 72 hours frame the shift. At one of our target customers — a platform running an aggressive World Cup promotional program — the fraud rate is up 28% since Friday. At another, whose promotional offer has been less effective at pulling new traffic, fraud volume has dropped 44% over the same window. Same tournament, same calendar days, opposite direction. Fraud actors are following promotional economics, not customer demand.
Recent fraud trends suggest aggressive World Cup-related acquisition campaigns are shifting fraud activity toward prediction-market and event-trading platforms while easing pressure on traditional sportsbooks. Several event-driven trading platforms have launched high-frequency promotional campaigns tied to individual matches — deposit bonuses, signup credits, referral incentives, sweepstakes, and merchandise giveaways. These offers are often structured around low initial deposits with disproportionately large rewards, creating attractive opportunities for bonus abuse.
The fraud vectors we're observing across these campaigns:
- Multi-accounting — fraudsters create multiple accounts to repeatedly claim signup bonuses, referral rewards, and promotional credits.
- Synthetic identity abuse — promotions lower the economic barrier to entry, increasing the return on investment for synthetic and manipulated identities.
- Stolen payment instrument testing — fraudsters use promotional incentives to offset losses associated with testing compromised cards or payment methods.
- Account farming networks — coordinated groups establish and age accounts in anticipation of future promotional events, then monetize rewards at scale.
- Referral abuse — users exploit referral programs through linked or controlled accounts to generate rewards without introducing legitimate new customers.
- Promotion arbitrage — fraudsters exploit discrepancies between promotional value and required customer activity, extracting value while minimizing market risk.
The World Cup amplifies these dynamics. Operators are launching new promotions around individual matches and tournament milestones, creating a continuous stream of incentives that organized fraud rings can target on a daily cadence. By contrast, traditional sportsbooks appear to be leaning more heavily on established promotional frameworks and existing customer bases during the tournament — which can produce the appearance of declining fraud rates at incumbents while attack pressure migrates toward platforms running newer, higher-yield acquisition incentives.
The overall pattern: as promotional values rise and onboarding friction drops, fraud attempts concentrate on the platforms offering the highest expected return per account. The leaderboard below still tracks the geographic side of the story, but the operator-level economics are now doing as much to shape today's fraud picture as the match schedule is.
The chart below shows fraud attempts originating outside the US — by IP address, device location, and IP proxy / exit-node signals. The leading-in baseline is heavily concentrated in a handful of familiar geographies. Starting Day 1 and continuing across the first 36 tournament days, that concentration shatters: the long tail lights up across every region of the world, day by day, promotion by promotion.
The world shows up — and stays.
Daily share of international fraud attempts by originating country from May 25 through July 15, 2026, based on IP, device location, and proxy / exit-node signals.
Narrowing to the three remaining semi-finalists — Argentina, France, and Spain — the picture flips. Spain led fraud share across most of the group stage, holding the mid-40s to high-50s through late June. As the bracket tightened into July, Argentina climbed steadily and, by July 12, commands 78.56% of fraud share within the trio, with Spain collapsing to 15.11% and France to 6.33%. Attention — and attack pressure — is following the team most likely to win it.
How we see it.
Socure processes identity verifications for the largest sportsbooks and prediction markets in the US. Origin is determined through IP and proxy intelligence, confirmed with device signals where available. Rankings reflect each country's share of international account-opening attempts flagged by our network, not raw volume. Rates tell the story. Volume alone flatters everyone.
The tournament ends.
The attacks won't.
Fraud rings treat every major event as an acquisition campaign. Socure gives sportsbooks and prediction markets the identity certainty to approve more trustworthy players and stop the rest, in real time.