The competition to find the best national football team in Europe starts in just a few hours, and fans across the continent are eager to see their favorite players perform live. But for the unwary, the process of buying late tickets for UEFA Euro 2016 matches can be tricky, and risks ending in disappointment, lost money or even compromised data.

As demand exceeds supply, online scammers are trying to take advantage of fans desperately scouring the web for the last few tickets. Using newly created fake websites, they are offering overpriced tickets that they may not even possess.

With only hours left before the championship officially starts, ESET was still able to find multiple malicious websites offering tickets for up to €3,500. According to news outlets, some rogue sites were trying to earn even more, setting the price tag as high as €5,000 a piece.

However, tickets can be bought legally only via the official UEFA website, with prices ranging from €25 to €895.

Such fake-website campaigns are nothing new, so the Euro 2016 organizers were prepared. As well as warning users not to fall for schemes like this, they have prepared a tool that helps users to identify (one) authorized and (numerous) unauthorized sellers online. There are also several signs that can indicate a website is fake:

  1. It offers tickets in large quantities.
  2. The site operator is hard to reach, and often does not even provide contact information.
  3. Users are asked to pay via wire transfer, instead of by credit or debit card.
  4. The website was created only a short time before the event.

Also, multiple types of spam messages connected with the 2016 European Championship have been seen in the wild.

Using official graphics as a disguise, they notify recipients that new tickets have become available or that they have won them in the UEFA lottery. But this information is untrue, as the lottery has ended and the organizers are now offering admissions only on a first-come, first-served basis via their Last Minute Sales Platform.