World Cup 2026 in Mexico City: The Trap That Lies Beyond the Pitch

The meter stopped at 57 pesos when the taxi pulled up outside the Museo de Arte Moderno in Mexico City on an ordinary weekday afternoon. A few days later, the passenger's bank statement carried an extra line: 12,000 pesos, roughly 210 times the figure on the meter. Who was behind the wheel has never been verified. The person in the back seat has a name — Karyme Lozano, a familiar face on Mexican television through “Mujeres Asesinas”, “Niña amada mía” and “Amor sin tiempo”. She told the story on social media, along with a warning to her followers and a photograph of a vehicle similar to the taxi she had taken. The bank replied that the transaction had been authenticated, because she had inserted the card herself and keyed in her PIN. An earlier attempt with an American Express card had been declined and flagged as suspicious. Then her HSBC card went through. The money vanished within minutes, before the car had even left the city centre. To someone who writes about football, this looks at first like a consumer-affairs story. It does not stay there for long. Mexico City is one of the host cities of the 2026 World Cup — a 48-team tournament staged across three host nations from 11 June to 19 July 2026. The Estadio Azteca, which has already witnessed two World Cup finals in 2026 and 2026, will open its doors again. With it will come hundreds of thousands of supporters from around the world, carrying credit cards, cash and a very human assumption that strangers abroad will treat them decently. What makes this story worth a football writer's attention is not the fame of the person telling it. It is that within a few years, hundreds of thousands of fans will travel that exact route — from airport to hotel, from hotel to stadium — and most of them will have no platform at all to warn anyone if the same thing happens to them. The Lozano case is not a proven charge before a court. It is a one-sided account, supported by a photograph of a similar vehicle, and marked by one telling detail: the bank treated the transaction as valid. That last detail is what makes the story useful to anyone about to travel. It reveals the mechanics of a very specific kind of risk — the kind no security cordon at a stadium gate can stop. I was in Moscow during the 2026 World Cup, moving between stadiums, eating at roadside places, changing money at small counters, and watching the ecosystem that grows around a major tournament. It includes street vendors, drivers, money changers, and also those who simply wait for a card to be inserted into the right machine. The 2026 World Cup taught me that dreams need excavating too, because sometimes they break before they can sprout — and sometimes they break on the ride from the airport to the hotel. The trap in the Mexico City story belongs to the category of card-present fraud. Unlike data theft online, this happens when a real card is inserted into a real device at a real point of sale. The fraudster does not need to break into a bank's systems. They only need to control the terminal, or replace it with one modified to capture the magnetic strip and the PIN. The most common variant is a reader fitted with a secondary skimmer that records data while still showing the customer the correct amount. Another interferes with the software so the machine displays one figure but transmits another. There are also cases where the operator simply enters a different amount after the customer's eyes have left the screen. In all three situations, the customer has personally completed the transaction — and that is the crux that makes recovering the money so difficult. In Karyme Lozano's case, the gap between the two figures was 210 times. A meter reading 57 pesos, a transaction reading 12,000 pesos. If the account is accurate, that gap goes far beyond a rounding error. The fact that an earlier American Express attempt was declined and flagged as suspicious suggests a control mechanism did work — but only for one of the two cards. Why are taxis such a favoured ground? Because they satisfy four conditions at once. The passenger is tired after a long flight. The passenger does not know the roads. The passenger does not speak the local language well. And the passenger needs to pay immediately, with no time to cross-check. For a foreign supporter, all four conditions are doubly true: tired, unfamiliar, excited, and carrying a high-limit card to spend on tickets, hotels and souvenirs. A major tournament also creates a grey economy that expands with demand. Room prices rise, black-market ticket prices rise, taxi prices rise. When demand far outstrips supply over a few short weeks, informal channels flood in to fill the gap: unlicensed cars, ticket brokers, unregistered exchange counters. Most of these people operate normally. A small share do not. And supporters have no way to tell them apart on the spot. Geographically, Mexico City is one of the most sprawling metropolises in the Americas, with more than twenty million people in the metropolitan area. The Estadio Azteca sits in the south of the city, a considerable distance from the centre, and public transport is not always convenient for a visitor. That means hundreds of thousands of taxi and ride-hailing journeys will take place every day throughout the tournament. Every journey is a point of sale. Every point of sale is an opportunity. Looking back at recent World Cups, the pattern repeats fairly steadily. In South Africa in 2026, warnings about street crime and muggings dominated the pre-tournament conversation. In Brazil in 2026, stories of foreigners being charged many times the going rate surfaced in almost every host city. In Russia in 2026, I saw unmetered taxis on the edge of central Moscow with my own eyes. The common thread is not the country. The common thread is that wherever there is a stream of strangers — numerous, wealthy and in a hurry — someone will come to exploit it. Mexico is no exception on this measure. It is a market where card fraud has long been a concern watched closely by the banking sector, partly because electronic transactions have grown fast while payment-acceptance infrastructure at many small points still falls short of the standard. The smaller and more mobile the point of sale, the less scrutiny it receives — and a taxi is the smallest and most mobile point of sale of all. Security budgets for a World Cup almost always flow in one direction: stadiums, fanzones, main transport corridors, opening and closing ceremonies. Those are the places with television cameras. They are also the places where symbolic threats — terrorism, hooliganism, crushes — are clearly defined. Payment fraud has no camera. It produces no images to broadcast. It leaves only a line on a statement, long afterwards, when the supporter has gone home and there is no one left to complain to. Supporters are vulnerable not because they lack knowledge. They are vulnerable because they are in the opposite state to vigilance. They have just experienced the greatest collective joy football can produce, they are intoxicated by the atmosphere of a strange city, and they tend to read every small interaction as part of the shared celebration. In that frame of mind, a friendly driver holding out a card reader does not look like a threat. It looks like a gesture of goodwill. Karyme Lozano did exactly what a person with a voice should do: she told the story, warned people, and posted a photograph. The power of that warning comes from two things — the specificity of the figures and the timing, and the speaker's existing credibility with her audience. There is nothing wrong with sharing. But readers should remember this is a single source, and a single-source incident is not a verified pattern. It is a signal, not a verdict. Since those trips, I have kept a few habits when working abroad. I book cars through apps rather than hailing them. I keep a separate low-limit card for transport and meals. I never let a card leave my sight when paying. And I always read the amount shown on the machine aloud before confirming, if only so the seller hears it. None of this stops a professional, but it raises the cost for an opportunist. The trust of supporters is football's greatest asset, and also the easiest thing to exploit. At a major tournament that trust is multiplied many times over, both by collective emotion and by the false sense of safety a well-organised event creates. The exploiter does not need to break that trust. They only need to borrow it for a few minutes — long enough for a transaction to be confirmed. This is where the contrarian reading sits. When we discuss risk at a major tournament, we usually give our attention to dramatic scenarios: hooliganism, terrorism, stadium disasters. Those scenarios have budgets, drills and press conferences. The real risk to an ordinary supporter is something so mundane it is dismissed as trivia: a driver, a card reader, a line on a statement. What gets overlooked is not its size, but the fact that it is not compelling enough to become news. A second contrarian point sits on the payment system's side. When a bank says a transaction was authenticated because the cardholder entered the PIN, that is a technically correct argument by design. But it is also a design choice that places risk on the most vulnerable party. In many card-present fraud cases, proving you were deceived is harder than proving your card was stolen remotely. Fraudsters understand this. And they choose precisely that gap. It should also be said plainly: the photograph Karyme Lozano shared is of a similar vehicle, by her own account, and not necessarily the car that carried her. That small detail matters. It means any later investigation will struggle to reconstruct concrete data. A good warning can still stand on its communicative value while the evidentiary chain for prosecution is weak. That is the recurring paradox of stories like this. There is another layer that is rarely mentioned: supporters from Asia. Asian football is producing a generation of fans making their first overseas World Cup trip. They come from places where cashless payment has become second nature, and so they place enormous trust in the card reader. At home, a failed transaction is usually refunded within days. They carry that expectation to Mexico City, where the complaint process is longer, the language different, and the issuing bank in another time zone. That distance is exactly where risk breeds. As someone born in Vietnam and working in China, I see this mismatch clearly. Vietnamese or Chinese supporters travelling to a tournament in Latin America face the Spanish-language barrier, and also a banking system that runs on different logic. They are unused to a domestic transaction having to be disputed across borders. They are unused to a complaint deadline that may be shorter than their stay. And they often do not know that local consumer-protection bodies exist to help — because nobody tells them. On behaviour, a few things can be done immediately. Booking through apps ensures the transaction is recorded and traceable. Using a low-limit secondary card caps the damage. Enabling instant transaction alerts means spotting anomalies in minutes rather than days. Photograph the receipt and the vehicle number. And if something happens, dispute it with the issuing bank before leaving the country, keeping every exchange in writing. What is worth carrying to Mexico City in the summer of 2026 is not fear, but a measure of methodical scepticism. Book cars through apps, keep a small card for small expenses, read the amount before confirming, check the statement every evening. And if something goes wrong, tell the story — as someone told the story of 57 pesos and 12,000 pesos. The true story of a supporter rarely sits in the stands. It sits beneath forgotten lines on a bank statement. If the 2026 World Cup is remembered as a tournament where supporters went home safe both inside and outside the stadium, that may be the most modest yet most durable legacy football can leave a city. If not, then at least a warning was raised in time — by someone who should never have needed to speak.