Event Cancellation Refund Phishing Scam

An event cancellation refund phishing scam works in the opposite direction from ordinary refund phishing: rather than exploiting a genuine cancellation, the scammer fabricates one, telling a real ticket holder that the event they're booked for has been cancelled or that their specific order has been flagged as invalid, when in fact the event is still going ahead exactly as planned. The goal is to persuade the victim to voluntarily surrender something that is still fully valid and valuable — their real ticket, their account login, or a mobile transfer — under the belief they are simply processing a refund they're owed.

This differs from phishing that follows an actual cancellation because there is no public news event lending the message plausibility; the scammer has to manufacture the entire premise, usually by targeting known or guessed ticket holders directly rather than a broad public audience. It also differs from other ticket resale frauds because the victim already owns a genuine ticket — the harm comes from being persuaded to give it up, not from paying for something fake.

Once the scammer has the transferred ticket, login credentials, or a completed in-app transfer, they can resell the genuine, still-valid ticket to someone else at full or premium price, while the original buyer is left with neither a ticket nor any refund, since the event was never actually cancelled and no real refund process exists to correct the mistake.

The scammer identifies likely ticket holders for an upcoming event — through data leaks, public 'I'm going to' posts on social media, or guessed contact details tied to a known on-sale — and sends an email, text, or direct message falsely stating that the event has been cancelled, downgraded, or that their specific order was flagged for a payment issue requiring the ticket to be 'returned' before a refund can be issued. The message often closely mimics the branding of the genuine ticketing platform or venue to appear authoritative.

The victim is instructed to complete a 'return transfer' of their digital ticket to a specified account, or to log in through a link to 'confirm the refund', which is actually a phishing page harvesting the platform account credentials needed to transfer the real ticket out of the victim's control. In some versions, the scammer simply asks the victim to forward their QR code or transfer confirmation directly as part of the supposed refund process.

Once the scammer has control of the ticket — either through a completed app transfer or stolen login credentials used to transfer it themselves — they resell it to a genuine buyer. The original ticket holder is left believing a refund is being processed, often for weeks, until they either try to attend the event and discover it was never cancelled, or a promised refund simply never arrives, by which point the ticket has already changed hands to someone else who has no idea it was obtained fraudulently.

A direct message claiming a personal booking problem feels more credible and less publicly checkable than a mass-broadcast scam, since the victim has no independent news source to quickly confirm or deny the claim the way they could with a genuine, widely reported cancellation. Ticket holders are also primed to trust communication that appears to come from the platform they actually purchased through, since it references real details like their event, seat, or order in ways that feel personalized and specific.

The framing around a refund process, rather than a request to simply 'give away' a valid ticket, reframes the surrender of something valuable as a routine administrative step, which lowers the guard a victim would otherwise apply to handing over login credentials or completing an irreversible ticket transfer to an unfamiliar account.

A few weeks before a popular show, a ticket holder receives an email closely matching the ticketing platform's branding, stating that a licensing issue has cancelled their specific seating section and that they must transfer their ticket back through the app within 48 hours to receive a refund, with a link to complete the process. Believing the message, the ticket holder logs in through the link and completes what they think is a return transfer. The event goes ahead as scheduled; the ticket holder's seat is later occupied by someone else who bought it through an unofficial resale listing, and no refund is ever issued because the platform has no record of any cancellation or return.

Your section has been cancelled due to a licensing issue. Transfer your ticket back within 48 hours to receive your refund.

We've flagged a payment issue with your order. Log in here to confirm your details and process your refund.

Please forward your QR code so we can complete your refund processing.

This event is no longer proceeding as originally booked. Complete the return transfer below to be refunded.

Before taking any action, check the event's status directly through the venue's or artist's official website and official social media accounts, since a genuine cancellation of any significant event is virtually always publicly announced well beyond a single private message to individual ticket holders. If no public confirmation exists anywhere else, treat the claim as false regardless of how official the message looks.

Never log in or transfer a ticket through a link provided in an unsolicited message; instead, navigate directly to the ticketing platform's own app or website and check the order and event status from there, contacting the platform's official customer support independently if anything seems inconsistent.