Cybersecurity firms and national cybersecurity and consumer protection agencies warn of fake sites and deals after the tour’s announcement.
As regional excitement builds for BTS’ highly anticipated 2026 Arirang World Tour, cybercriminals are exploiting fans’ enthusiasm with sophisticated phishing schemes.
Multiple cybersecurity firms and Singapore authorities have issued urgent advisories, highlighting fake websites mimicking the official Weverse platform to steal payments and credentials.
Shortly after the tour announcement on February 19, 2026, researchers from Kaspersky had uncovered fraudulent sites selling non-existent fan club memberships. These pages, bearing no affiliation with HYBE, BTS, or Weverse, lure users with urgent offers, prompting entry of financial details on bogus payment forms.
Similarly, cybersecurity firms such as ESET routinely flag similar concert-related phishing in K-pop circles, urging verification of URLs and avoidance of unsolicited links to counter social engineering tactics. Trend Micro, in its 2026 predictions, had forecast AI-scaled scams amplifying emotional manipulation during events such as pop group tours.
In Singapore, where BTS gigs are slated for December, the national Cyber Security Agency (CSA) has echoed police advisories on rampant ticket scams targeted at Carousell and Telegram users. Separately, in a Straits Times report, the president of a consumer protection watchdog, Consumers Association of Singapore, Melvin Yong, had commented: “Consumers are encouraged to purchase tickets only through official and authorized ticketing channels, and to avoid making advance payments to unverified sellers, especially when tickets have not yet been officially released.”
According to Adrian Hia, Managing Direct, Kaspersky: “Excitement overrides caution. Fans should stick to official channels like Weverse and Ticketmaster, use secure payments, and (should) report suspicious sites.”
Other than aforementioned safety precautions, consumers can stay protected by observing best online safety hygiene practices such as:
- observing anti-phishing measures and implementing strong password/passphrase protection
- enabling multi-factor authentication
- activating bank account security measures
- ensuring constant vigilance against deepfakes and unsolicited social media messages/ads
- avoiding financial transactions when using unsecured public Wi-Fi
- Keeping updated on the latest cyberattack and scam strategies in the wild, through subscriptions to free threat intelligence and cybersecurity newsletters
