SINGAPORE – Beware of purchasing World Cup tickets or official merchandise from ticketing sites that require payment in cryptocurrencies, the police said in an advisory to the public on July 1.
Scammers have been creating World Cup-themed ticketing sites that offer “exclusive” tickets and directing victims to pay using cryptocurrencies such as Bitcoin or USDT, they added.
After victims make payment, the tickets or merchandise is never delivered. The fraudulent websites are then taken down, making it difficult for victims to recover their funds.
The police added that they have also observed scam variants involving fake “official World Cup tokens” or fan coins fraudulently marketed as official or team-affiliated digital assets.
Victims may be misled into investing in these tokens. The value of such tokens is artificially inflated before scammers sell off their holdings, causing prices to collapse, the police said.
In addition, those searching for free World Cup streaming services may be redirected to phishing websites that prompt them to connect their cryptocurrency wallets, make cryptocurrency payments, or install malware.
These sites may compromise victims’ credentials, financial information, or cryptocurrency assets, the police added.
In some cases, deepfake content featuring athletes or celebrities has been used to promote such fraudulent platforms, making them appear more convincing.
Separately, the police also urged the public to be wary of downloading malware that enables scammers to monitor victims’ cryptocurrency activity and intercept wallet credentials.
In such scams, victims are approached by scammers posing as clients or business associates, often through messaging platforms such as Telegram.
The scammer would propose a video call with the victim and share a link to join via a web browser, the police added.
After clicking the link, victims encounter a pop-up message falsely stating that a software component on their device has expired and requires updating.
They are then instructed to download a file and execute commands on their computer, unknowingly installing malware that compromises their device.
Scammers also exploit this access by deceiving the victim into approving a “permit signature” – a feature that allows users to pre-authorise a future cryptocurrency transaction by signing a message off-chain.
By approving such requests, victims may unknowingly allow scammers to carry out future cryptocurrency transactions from their wallets without further approval, even if a hardware wallet is used, the police said.
As no funds are transferred immediately, victims may not realise that they have given scammers access to their assets. The stolen cryptocurrency may then be moved through various platforms to make it harder to trace and recover.
In the statement, the police remind the public to store cryptocurrencies in hardware wallets where possible, as these are less vulnerable to online attacks.
The public is also reminded to use cryptocurrency service providers that are licensed or regulated by the Monetary Authority of Singapore.
Those who suspect that they are a victim of cryptocurrency-related crime can contact their cryptocurrency exchange to halt further transactions or freeze their account, where possible.
They can also report the incident to the police and to the Cyber Security Agency of Singapore’s Cyber Emergency Response Team at csa.gov.sg/singcert/reporting
