Céline Dion is scheduled for 16 Paris concert events in 2026, from September 12 to October 17. Together with the ten extra reveals introduced for Could 2027, the entire is 26 concert events. This makes it a profitable goal for scammers.
Followers looking out Fb for tickets to Céline Dion’s 2026 Paris concert events are being focused by scammers who can place a legitimate digital ticket in a purchaser’s Ticketmaster account and nonetheless depart them unable to enter the venue.
Demand for tickets has remained excessive since Dion introduced her return to reside performances. Her Paris engagement contains 16 concert events at Plénitude Enviornment, previously Paris La Défense Enviornment, between September 12 and October 17, 2026.
Scammers Promoting Faux Live performance Tickets on Fb
The official presale started in April, however fraudulent provides had already appeared earlier than ticket gross sales opened. Céline Dion’s official web site confirms the live performance schedule.
Nonetheless, cybersecurity researchers at Group-IB discovered scammers approaching consumers by way of Fb teams and Market listings whereas a separate set of fraudulent web sites impersonated Ticketmaster, AXS, Dion’s official web site, and the live performance venue. Each strategies use acquainted manufacturers and companies to make the acquisition seem authentic.
Inside Fb fan communities, sellers construct belief by way of personal messages and voice recordings earlier than introducing stress. One recurring script tells the client that quite a few different followers have an interest and that the ticket might promote inside minutes. Group-IB additionally discovered profiles with modified show names whereas the unique identification remained seen within the Fb URL.
As soon as a purchaser agrees to proceed, the vendor requests a direct financial institution switch exterior the official resale service. The recipient’s checking account title could differ from the identification proven on Fb, however victims are advised that Ticketmaster will deal with supply after cost.
Scammers Ship the Similar Ticket to A number of Consumers
Victims obtain a real Ticketmaster switch hyperlink containing a digital ticket and entry code, which can seem usually of their account. In line with Group-IB’s technical evaluation, scammers ship the identical ticket and entry code to a number of consumers. Solely the primary particular person whose code is scanned can enter the venue, whereas each later purchaser is refused entry.
For context, a single-use ticket works for the primary particular person whose code is scanned, leaving each later purchaser with an invalid entry code. The vendor can then deactivate the Fb profile and finish communication with the victims.
Different consumers are directed to convincing web sites constructed to resemble official ticket retailers. Group-IB documented greater than 20 area entries utilizing names related to Céline Dion, Ticketmaster, AXS and Paris La Défense Enviornment. A few of these domains noticed by researchers embrace:
Ticketmaster-celinedion.comAccount.ticketmaster-celinedion.fr
and several other others.
Moreover, scammers use Shopify to construct faux ticket shops with acquainted account, checkout and cost pages, making the websites seem authentic. Researchers discovered Shopify-specific paths corresponding to /cdn/store/recordsdata/ and /merchandise/, together with picture parameters, buyer account pages, OAuth shopper identifiers and devoted cost subdomains. Some pages additionally displayed bank card kinds, supply particulars and pretend Trustpilot rankings.
A number of technical similarities linked the domains to a reusable phishing package. OAuth state values on a number of account pages started with the identical hWNA prefix, whereas the websites reused comparable authentication flows and Shopify elements. Group-IB mentioned the repeated prefix appeared to return from the identical low-entropy string generator.
Purchase Tickets from Official Websites
Shopping for by way of hyperlinks posted by unknown sellers offers fraudsters management of each the cost technique and the knowledge proven to the client. Followers ought to start from Dion’s official live performance web page or a certified distributor corresponding to Ticketmaster, AXS or Fnac, reject requests for direct financial institution transfers and test that the vendor’s identification matches the cost account. Anybody who has already paid a suspected scammer ought to contact their financial institution instantly.
