AI Played for Both Sides at the World Cup

Spain lifted the trophy. AI called the offsides — and wrote the phishing emails.

Spain beat Argentina 1–0 after extra time at MetLife Stadium on Sunday, Ferran Torres scoring in the 106th minute for Spain's second world title. It was a landmark tournament for football — and, quietly, the biggest live test artificial intelligence has ever had at a sporting event.

AI was everywhere at this World Cup. It helped officials call the game in seconds. It also helped criminals defraud fans at a scale we've never seen around a sporting event. Same technology, two very different teams — and there's a lesson in that for every business now rolling out AI.

On the pitch: AI helped call the game

This tournament pushed semi-automated officiating further than ever before, and the engineering behind it is genuinely impressive.

•     A ball that reports 500 times a second — The official TRIONDA match ball carries a built-in motion sensor sampling its movement 500 times per second, feeding the VAR system the exact moment and manner of every touch.

•     AI-generated 3D player avatars — Semi-automated offside technology fused player-tracking cameras with the connected ball to produce lifelike 3D reconstructions — broadcast to stadium screens and viewers so complex offside calls became easy to understand.

•     Referee View, stabilized by AI — FIFA and Lenovo — one of our own technology partners — expanded Referee View, using AI to stabilize the referee's body-cam footage in real time, cutting blur and shake for a clear first-person angle.

•     Humans still made the call — Crucially, the technology never decided anything on its own. It surfaced evidence and recommendations; referees reviewed, confirmed, and communicated the decision. AI advised — people decided.

Off the pitch: AI also ran the scams

The same capabilities that made officiating sharper made fraud cheaper and more convincing. This tournament generated one of the largest event-driven scam waves on record.

•     A 22-fold surge in phishing — KnowBe4 ThreatLabs tracked a 22x increase in World Cup-themed phishing since it began monitoring in April 2026.

•     13,000+ tournament domains — Registered in just five months — roughly 9% assessed as suspicious or malicious.

•     270,000+ credentials compromised — Tied to ticketing platforms, spoofed sites, and fan services.

•     55+ active scam campaigns — Bitdefender identified more than 55 distinct football-themed fraud operations.

•     AI-generated listings and QR codes — Generative AI made fake ticket listings, reward pages, and QR codes look convincingly official — at scale, in any language, for almost nothing.

The FBI's Internet Crime Complaint Center issued a formal warning about threat actors spoofing FIFA websites, with typo squatted domains harvesting names, addresses, phone numbers and banking details.

The lesson: AI advises, humans decide

Look at how FIFA deployed AI and you'll find the blueprint every business should copy. The technology was given a narrow, well-defined job. Its output was treated as evidence, not verdict. A trained human stayed in the loop for every consequential decision. And the whole thing was designed to be explainable — those 3D avatars exist precisely so fans can see why a call was made.

Now compare that to how AI is typically being rolled out inside businesses right now: broad access, minimal oversight, no audit trail, and decisions quietly automated because it's faster. The scammers, meanwhile, are using AI exactly as intended — to scale their output. AI is a force multiplier for whoever is holding it. Governance is what decides which side gets the advantage.

The VAR model for enterprise AI

Give every AI system a narrow job. Treat its output as evidence, not a verdict. Keep a trained human on consequential decisions. Make it explainable and auditable. That's how you get the speed without the own goals.

Why the risk didn't end at full time

Post-tournament is its own scam season: fake highlight reels and streaming links, 'official' commemorative merchandise, and refund or chargeback lures aimed at anyone who bought tickets. Those 270,000+ stolen credentials don't expire when the whistle blows — and if any were reused on a work account, the exposure is now yours.

How to defend your team

•     Go direct, never via a link — Type the official address yourself. Don't click links from SMS, WhatsApp, or email.

•     Credit cards only — Requests for crypto, gift cards, wire transfers, or peer-to-peer apps are a red flag, full stop.

•     Phishing-resistant MFA — If a credential is stolen, MFA is what stops it becoming a breach.

•     Kill password reuse — The single most common way a consumer scam becomes a corporate incident.

•     Govern your own AI — Identities, scopes, and audit trails for every agent and AI tool your teams adopt.

The takeaway

Spain won the tournament. AI, in a sense, played for both sides — sharpening the officiating and supercharging the fraud. The difference wasn't the technology; it was the discipline around it. Businesses adopting AI this year should take the VAR approach: let it advise, keep humans deciding, and build the guardrails before you need them.

How CyberSainya can help

We help businesses adopt AI the way FIFA did — deliberately. Governance and identity for AI tools and agents, phishing-resistant MFA, layered email and endpoint defence, and awareness training tied to what your people actually care about.

Sources

1.    NPR — Spain is the 2026 World Cup champion, defeating Argentina for its 2nd title. https://www.npr.org/2026/07/19/nx-s1-5899071/2026-world-cup-fifa-argentina-spain-final-championship

2.    FIFA — Faster offside decisions, more stable referee body cams: innovation at the FIFA World Cup 2026. https://inside.fifa.com/news/offside-decisions-referee-body-cams-innovation-world-cup-2026

3.    FIFA / Lenovo — AI-powered innovations ahead of FIFA World Cup 2026. https://inside.fifa.com/media-releases/lenovo-tech-world-ai-powered-innovations-world-cup-2026

4.    TechTimes — World Cup 2026 Becomes Tech's Biggest Live Test: AI Offside, Smart Ball and Player Data. https://www.techtimes.com/articles/318259/20260611/world-cup-2026-becomes-techs-biggest-live-test-ai-offside-smart-ball-player-data.htm

5.    FBI / IC3 — Threat Actors Spoofing FIFA Websites in Advance of the 2026 World Cup (PSA260527). https://www.ic3.gov/PSA/2026/PSA260527

6.    KnowBe4 — Cybercriminals Are Targeting the FIFA World Cup 2026. https://blog.knowbe4.com/fifa-world-cup-2026-phishing-campaigns

Bitdefender — FBI Warns Fans About FIFA Scams Ahead of 2026 World Cup. https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-fifa-scams-2026-world-cup