Suspicious withdrawals rose in every region of the world during the World Cup, indicating that fraud didn’t happen most often at sign-up but later in the betting process, AI-powered anti-money laundering compliance company SEON reported Monday. The company analyzed data from the big global event and compared it to a similar time period in 2025, as well as 28 days pre-tournament.
Per the company’s analysis, “suspicious withdrawal activity” rose 38% against a similar time frame in 2025 and the average withdrawal that was flagged rose from $202 to $436. That jump means “attackers shifted from many small attempts to fewer, higher-stake exits,” the analysis suggested.
The analysis encompasses anonymized, aggregated data from SEON gaming partners worldwide, including FanDuel owner Flutter and BetMGM co-owner Entain.
Dormant accounts that fraudsters were able to access were reactivated, and “identity mismatches” on these accounts rose 83% worldwide. The accounts were verified well before the World Cup kicked off June 11. SEON detected the previously dormant accounts on new or different devices than the ones they were registered on, and it reported that “high-value withdrawals” were immediately attempted.
Biggest rise in sign-up fraud: Latin America
The company did not share U.S.-specific data, but it reported that identity mismatches spiked to 118% in Latin America and “credential stuffing” campaigns were up by 115% in Europe. Credential stuffing is a form of cyberattack in which fraudsters use stolen usernames and passwords — often hacked from elsewhere — and use bots to attempt to log in to platforms.
“The World Cup showed that fraud does not have a fixed target, it goes wherever the operators’ friction is the lowest,” SEON CEO and co-founder Tamas Kadar said via press release.
The surge of registration and account creation issues in Latin America vs. the withdrawal-step issues in North America and Europe, according to the report, bear out that jurisdictions with more consistent know-your-customer requirements saw lower fraud rates at the account creation step.
“In most markets, operators eased registration to compete for players, so attackers moved downstream, reactivating dormant accounts and pushing hard at cash-out,” Kadar said. “In Latin America, the pressure landed at sign-up instead. … The operators that caught it in both places had visibility across the full player journey, not just one stage.”
