From phishing to porn star impersonators: how scamming athletes became a billion-dollar industry

Social media, long a tool enabling players to share their personal lives and better connect with fans, has warped into a security risk – for example, an athlete may share photos of their holiday, letting would-be burglars know when to break into their homes.

Media attention, readily-available biographical information and weak privacy protections in the US mean that anyone can quickly find a trove of personal details on almost any American collegiate or professional athlete: photographs, date and place of birth, size, weight, where they went to school and university, hobbies, income and family background. Even phone numbers, home and email addresses and social security numbers, which are often acquired from massive data breaches. In 2024 it was reported that ensitive records were leaked in a hack of a single US company.

It’s a virtual open goal for criminals using AI to make deepfakes – realistic fabricated audio, video and images – according to Dr Chris Pierson, the founder and CEO of BlackCloak, a cybersecurity company that provides protection for companies and individuals, including sports stars.

“What happens after everyone’s on the pitch? First thing they do is go down to the locker room, they give the interviews and all the rest, you have great high quality audio, you have great 4K video. You can go and do an impersonation attack, you can do a deepfake over the phone, you can call mom and dad,” he says.

College athletes have been allowed to monetise their NIL rights since 2021, creating a financial incentive to share their personal lives. “Their name, their likeness, all the rest is out there – and of course you want it to be … these people have to have social media profiles,” Pierson adds. “As a result of that you know what it is they’re thinking of. It increases that attack surface – as a result, you’re a better target.” Impersonations of beloved sports stars can be used to manipulate fans by tricking them into transferring money to scammers – or to victimise the players themselves.

A team may only have two-dozen senior players but that translates into perhaps 500 potential targets, Pierson says, because cybercriminals often take aim at friends, associates and family members – even their children. “We have quite a few stories of ‘compromise the kids, compromise the adult’. Once you get the kids you have a footprint on the inside of the house,” Pierson says.

BlackCloak cites a case study of an unnamed professional basketball player who was the object of a cyber-attack from criminals who targeted him through his children. “Cybercriminals, aware of the basketball player’s high-profile status and potential wealth, meticulously planned their attack. They embedded malware into popular online games, knowing that his children frequently played these games on devices connected to the home network,” the company wrote.

“The malware was designed to be undetectable and operated in the background. Once the children downloaded the infected game updates, the malware activated, creating a backdoor into the home network. This breach allowed the cybercriminals to access various devices connected to the network, including the basketball player’s personal laptop and smartphone.”

Sports is an especially tempting sector for cybercriminals according to research published by the UK National Cyber Security Centre in 2020. It found that at least 70% of surveyed British sports organisations had suffered at least one cyber-related breach or incident. That is more than twice the rate at which general UK businesses were targeted. Clubs often hold detailed personal data on players and fans. The NBA’s Houston Rockets were the targets of a ransomware attack in 2021, with the NFL’s San Francisco 49ers hit the following year.

Many players make at least as much as senior executives in conventional industries. However, big corporations are likely to have dedicated digital security teams and thorough cybersecurity protocols. That’s not the case for sportspeople, where the public nature of the job means the focus is on physical protection: bodyguards. But players are often young and inexperienced, bored or distracted during travel and down-time, and glued to mobile phones. The small screen can make it tougher to spot phishing scams compared with a laptop or an office environment.

Pierson cites another case of a client, an NFL player, who had home security cameras professionally installed but without adequate password and firewall protection, so the system was vulnerable to being hacked. That would have allowed criminals to access the cameras and recordings and watch footage from inside and outside the house. Sportspeople are frequent targets for tech-savvy burglary gangs who – like anyone with a computer – can learn game schedules in seconds and discover exactly when the player won’t be at home. The England forward Raheem Sterling returned from Qatar and missed a match at the 2022 World Cup after armed intruders broke in to his property near London.

The FBI Internet Crime Complaint Center (IC3) said in its latest annual report that Americans reported more than $20bn in cybercrime losses last year, a 26% increase from 2024. The EY report identified nearly $1bn of alleged losses suffered by professional athletes from 2004 to 2024, with the rate accelerating in recent years. That figure, drawn from public legal proceedings, is likely a considerable undercount of the true amount given the probability that many schemes are never made public.

The NFL Players Association provides players with access to third-party support to help them address cybercrime problems such as identity theft. In March it informed agents that unnamed NFL and NBA players had been targeted in an extraordinary phishing scheme allegedly perpetrated by an American man posing as a female adult film star.

The accused, Kwamaine Jerell Ford, was convicted of computer fraud and aggravated identity theft in Georgia in 2019 for hacking into more than 100 Apple accounts belonging to collegiate and professional athletes and rappers, according to federal prosecutors. Yet, beginning the next year – and while in federal custody – he allegedly ensnared several athletes in another phishing scam that evolved into a sex trafficking scheme.

Prosecutors allege that Ford posed as adult film star Teanna Trump and offered to send sexually explicit videos to the athletes, then masqueraded as an Apple customer support representative to trick his targets into sending him their login credentials in order to watch the videos. Once in control of the accounts, Ford allegedly embarked on a spending spree. Prosecutors further allege that in 2021, “Ford allegedly posed as the adult film star and recruited, tricked, and coerced a female victim into engaging in commercial sex acts with the professional athletes based on false promises that the film star would advance the victim’s modelling career.” Ford denied charges of fraud, identity theft and sex trafficking and was ordered in March to be held without bail pending trial.

In BlackCloak’s experience, Pierson says, “The targeting of high-profile, high net worth individuals is at a massive all-time high. The harm that is done there continues to increase, especially from a financial position. AI has only accelerated the pace of this and increased the sophistication of threat actors.”