Fake BTS ticket sites are scamming fans across multiple countries, Kaspersky warns

Cybercriminals are exploiting BTS’s return to touring with fake ticket websites that imitate official pre-sale pages and steal money from fans. Kaspersky says it found at least 10 fraudulent domains tied to the scam, targeting fans in Argentina, Brazil, Chile, Colombia, France, Mexico, Peru, Portugal, and Spain.

The scam rides on real hype. BTS’s ARIRANG world tour is live, with official tour dates listed on the group’s site and broad news coverage confirming the comeback after the members completed military service. That makes the fake pages more believable and gives scammers a large, emotionally invested audience to target.

BEST SPRING 2026 DEALS

Editor's Choice

Private Internet Access

Access content across the globe at the highest speed rate.

70% of our readers choose Private Internet Access

70% of our readers choose ExpressVPN

ExpressVPN

Browse the web from multiple devices with industry-standard security protocols.

Nord VPN

Faster dedicated servers for specific actions (currently at summer discounts)

Kaspersky says the fake sites closely copy the layout and buying flow of legitimate ticket pages, which makes them hard to spot at a glance. The links spread mainly through Instagram and fan communities, where urgency and fear of missing out can push people to act before checking whether a page is real.

How the scam works

According to Kaspersky, the campaign does not rely on crude fake pages. The attackers built convincing copies of pre-sale sites and tailored them to specific markets, which suggests a coordinated fraud operation rather than a one-off phishing attempt.

Brazil appears to be a key example. Kaspersky says legitimate Brazilian ticket sales for the tour used a pre-booking model that required fans to reserve seats online and then pay in person at the box office. Scammers used that confusion to make fake pages look more plausible.

On those fake Brazilian pages, victims often get pushed toward PIX, the instant payment system run by Brazil’s central bank. Kaspersky says some sites first show a card option, then produce an error or a high-demand warning and redirect the user to PIX instead, sending money to mule accounts that make recovery far harder.

Why fans are falling for it

The scam works because it mirrors real ticket panic. BTS is one of the world’s biggest music acts, and Reuters and AP both reported huge demand for the group’s return to the stage after a years-long gap. In that environment, even careful fans may rush through a checkout flow that looks familiar.

Kaspersky says attackers designed the fake experience around manufactured urgency. Error prompts, scarcity messages, and checkout friction all pressure fans to finish the transaction quickly before they pause to verify the site.

That emotional timing matters as much as the technical trick. A fake page does not need to beat security software if it can persuade someone to pay voluntarily on a site that looks just close enough to the real thing.

Countries and tactics seen in the campaign

The table above reflects Kaspersky’s April 9 post on the campaign.

What fans should do before buying

• Type the official ticket site address directly into the browser instead of opening links from social media posts or DMs.
• Compare the domain carefully with the official BTS tour page before entering payment details.
• Treat extra dashes, odd country codes, or slight spelling changes as warning signs.
• In Brazil, be cautious if a site asks for online payment during a process that should end with in-person payment.
• Contact the bank right away if payment already went through on a suspicious page.
• Turn on real-time banking alerts so unauthorized or unexpected charges show up immediately.

What this scam says about online ticket fraud

This campaign shows how quickly scammers adapt when a major global event creates demand spikes and emotional pressure. Instead of building a generic fake shop, they study how the official sale works in each country and then copy the details that make the scam believable.

It also shows why ticket fraud now spreads like social content. Kaspersky says Instagram played a key role in circulation, which means the scam can move through trusted fan networks faster than a traditional phishing email campaign.

For fans, the safest approach stays simple. Start from the artist’s official tour page, verify the seller before clicking anything, and never let countdown timers or payment errors rush a purchase decision.

FAQ