Two European Clubs Targeted by Cyber Fraud in Player Transfers as FIFA and CAS Intervene

The case moved into legal proceedings.

Details: An unfortunate incident occurred between Croatian club Rijeka and Hungarian club Ferencváros during the 2021 transfer window. The Hungarian club mistakenly sent money for the transfer of defensive midfielder Stjepan Lončar to a fraudulent account after hackers accessed Rijeka’s email system.

Both Rijeka and Ferencváros lost the money, which was taken by cybercriminals.

Initially, FIFA supported Rijeka and ordered Ferencváros to pay the full transfer fee again, stating that the payer holds responsibility for the mistake. Ferencváros disagreed and appealed to the CAS.

Now, four years later, the CAS has reversed FIFA’s decision, noting that both clubs were negligent, contributing to the financial loss:

• Ferencváros ignored warning signs: a Spanish bank account linked to a Croatian club, inconsistencies in the FIFA TMS data, and a warning about a fake email.
• Rijeka was also careless: not responding to a direct warning about the false domain, failing to confirm the payment in FIFA TMS, and using unofficial communication methods against contractual terms.

As a result, the CAS ruled that the losses should be shared equally, requiring Ferencváros to pay only half the amount—€498,750.

Reminder: “Maybe one day the federation will apologize.” Guardiola reflects on his doping scandal.