Proofpoint Finds FIFA World Cup 2026 Partners Vulnerable to Email Spoofing

Executive Summary

More than one-third of official commercial partners for the upcoming FIFA World Cup 2026 have not implemented the Domain-based Message Authentication, Reporting, and Conformance (DMARC) standard, leaving the global public vulnerable to email spoofing and brand impersonation attacks. According to research from Proofpoint Threat Insight, 14 of the 39 analyzed partners lack a DMARC record, while only 15 enforce a policy that blocks unauthenticated emails. With the tournament expected to draw massive global attention, this security gap creates a prime environment for phishing and fraud campaigns impersonating trusted brands.

Technical Analysis

Proofpoint's analysis, conducted in March 2026, evaluated the email domain security of FIFA's 39 global partners, national supporters, and regional sponsors. The core failure is the absence or misconfiguration of DMARC, a standard that uses Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) to verify an email's origin and instruct receiving mail servers on how to handle messages that fail authentication.

The research found that 36% (14 partners) have no DMARC record published in their Domain Name System (DNS). A further 26% (10 partners) have a DMARC record but with a policy set to p=none, which only monitors and reports on authentication failures without blocking fraudulent messages. Only 38% (15 partners) have implemented an enforced DMARC policy (p=quarantine or p=reject) that actively protects against spoofing. Proofpoint notes that organizations without an enforced DMARC policy are 4.5 times more likely to be impersonated in email-based phishing attacks.

Tactics, Techniques & Procedures

The primary technique enabled by this security gap is T1586.002 (Compromise Accounts: Email Accounts) and T1585.002 (Establish Accounts: Email Accounts) from the MITRE ATT&CK framework, specifically through domain spoofing. Threat actors can send emails that appear to originate from the legitimate domains of World Cup partners. These emails could be used in business email compromise (BEC), credential phishing campaigns, or scams offering fake tickets, merchandise, or promotions. The lack of enforcement allows these spoofed messages to land directly in recipients' inboxes, bypassing basic email security filters.

Threat Actor Context

The source material does not attribute this exposure to a specific active threat group. However, the context creates a broad, opportunistic threat landscape. Major global events like the World Cup are consistently targeted by both financially motivated cybercriminals and hacktivists. The partners involved span high-value sectors including banking, automotive, telecommunications, and consumer goods, making their brands attractive for impersonation to steal money, credentials, and personal data from a massive, emotionally invested global audience.

Mitigations & Recommendations

Proofpoint's primary recommendation is for all organizations, especially high-profile brands, to implement an enforced DMARC policy (p=quarantine or p=reject). The implementation process involves first deploying SPF and DKIM, then setting a DMARC policy to p=none to gather data and monitor for legitimate email sources that may fail authentication, and finally moving to an enforced policy. For the specific partners identified, immediate action is required to publish and enforce DMARC records before the tournament begins. Organizations should also consider broader email security strategies, including user awareness training about phishing, especially during high-profile events.