With the FIFA World Cup 2026 in full swing, a new ExpressVPN survey has found that 44% of those who have shared a password allowing someone else to watch sports also used that password on another account.

A new ExpressVPN survey of 6,000 football fans across the U.S., UK, France, Germany, Spain, and Australia found that around one in five had shared a password so someone else could watch a match or other sports content. Among those who had, 44% said the same password was also used on another account, such as email, online shopping, or banking.

The research showed that 17% of Australian fans shared passwords – lower than their global peers – with 36.9% reusing those passwords elsewhere, also low compared to other nations.

That crossover was highest in the U.S., where 65% of fans who had shared a password used it elsewhere. Spain had the highest sharing rate of any market, yet American sharers were nearly twice as likely as Spanish ones to put that password to work on another account.

Across all six countries, around seven in 10 fans reused the same password, or a close variation, on at least one other account, and nearly one in four have folded football into a password somewhere, drawing on a club, a player, a shirt number, a memorable year, or a stadium.

Spain shared most, but U.S. fans reused what they share

Spain led where sharing was concerned, with 23.7% of fans saying they had passed a password to someone so they could watch football or other sports. Germany came next at 22.2%, the UK and France both sat close to 21%, the U.S. was lower at 18.6%. What matters more, though, is what those passwords also protect. Among U.S. fans who had shared one, 65% said it was used on another account too, against 47.4% in France, 43.7% in the UK, 38.1% in Germany, 36.9% in Australia, and 34.8% in Spain.

“While Spain shares the most it contains it the best, since a shared Spanish password is the least likely to reach anything else. The U.S. has fewer sharers, but the ones it has are recycling that password far more widely,” said the firm.

ExpressVPN noted that handing over a password didn’t automatically entail handing over the account. The other service might use a different username, or multi-factor authentication, or passkeys, or some other safeguard. “What the survey does show is that the same secret is now in someone else’s hands while still in use across the owner’s wider digital life,” it said.

The firm said the sharing data formed part of a much wider reuse problem. “Across the six countries, about seven in 10 fans said at least one other account used the same password, or a close variation. The consistency between markets is striking, said the company.

France came out highest at 73.7%, though it, the UK, Spain, the U.S., and Germany were all bunched closely together.

“That broad figure counts everyone with any reuse at all, down to fans who only do it on a ‘very few’ accounts. Look only at those who reuse across some, most, or all of their accounts, and the number settles at just over half,” said the company.

“Password reuse is what allows one exposed credential to become a wider account-security problem,” warned Aaron Engel, Chief Information Security Officer at ExpressVPN. “Attackers can automatically test credentials leaked from one service against others, and email is especially valuable because it’s often used to reset access elsewhere.

“Sharing passwords increases the number of people and devices that may hold that password; in doing so, users are putting their security into the hands of others. Multi-factor authentication doesn’t undo reuse, but it can prevent a stolen password from being enough on its own.”

The survey found that sharing was overwhelmingly a younger habit, and in several markets, the gap between the youngest and oldest fans was enormous.

In the U.S., 34.9% of fans aged 18 to 29 had shared a password so someone else could watch sports, against 2.2% of those aged 62 to 80, making younger Americans around 16 times as likely to do it.

The UK gap was found to be just as steep, at 35.6% of 18-to-29-year-olds against 2.1% of the oldest group, a roughly 17-fold difference.

Germany posted one of the highest young-adult rates of all, at 42.2% among 18-to-29s, with France close behind at 39.9% against 8.5% for the oldest group. Australia followed the trend, with about 26.9% of younger fans sharing against 3.4% of the oldest.

The U.S. data also hinted that sharing and reusing stacked up in the same young fans. Of the 30 American respondents aged 18 to 29 who had shared a password for sports, 22 said it was also used on another account. The firm said that while this worked out to 73%, the group was small, so it was preferable to read it as a sign of where the behaviour clusters than as a firm measure of all younger American fans. “The steadier national number is still the all-sharer figure of 65%,” it said.

Nearly one in four fans has put football into a password

Sharing and reuse decide how far a password travels. The password itself can also carry clues, pulled from the most public corners of a fan’s identity. Nearly one in four respondents had built football-related information into a password.

The UK led at 31.2%, just ahead of Spain at 30.8%, followed by the U.S. at 25.5%, Germany at 25.4%, and France at 25%. Australia, meanwhile, was the clear outlier at 11.2%.

The survey ran through the usual ingredients:

A favourite team’s name
A club abbreviation or acronym
A player’s name or nickname
A player’s shirt number
A memorable football-related year
A tournament name
A stadium name

Team names, player names, and shirt numbers kept surfacing at the top. In Spain, shirt numbers led at 11.6%, with favourite team names at 9.9% and player names or nicknames at 8.6%. In the U.S., 11.3% had used a favourite team’s name, 9.9% a player’s name or nickname, and 8.6% a shirt number. UK fans reached most often for a favourite team’s name, at 13.2%, with almost 10% using a player’s name or nickname.

The firm said the age divide showed up here as well: in Germany, 40.5% of 18-to-29-year-olds had used at least one piece of football-related information, against 11.8% of the oldest group.

Most football-password users think another fan could guess one

Fans who had used football-related information were then asked how easily someone who knew their football interests could guess one of their passwords. Across the six countries, 56.8% of that group said very or somewhat easy.

That was not 57% of all fans but rather 57% of the fans who had already said they used football in a password, conceding that anyone who knew their team had a useful head start.

It ran highest in the U.S., where 73.1% of football-password users thought someone who knew their interests could guess one, followed by Australia at 63%, the UK at 56.1%, France at 54.4%, Germany at 53.4%, and Spain at 46.6%.

The three ways one password can travel

The survey traced three separate routes a password can take out of the account it was made for.

It can be guessed: Football interests hand someone a shortlist of likely words, names, numbers, and dates to try.

It can be exposed and reused: Any service can be breached, no matter how careful its users are. If the exposed password is unique, the damage mostly stays put. Reuse widens it, because the same password, or a near-match, may open other doors. Attackers test leaked credentials at scale, and they lean hardest on services where multi-factor authentication is switched off.

It can be shared voluntarily: A password does not have to be stolen or guessed if its owner simply sends it on. The recipient may be completely trustworthy, yet the password can still come to rest on a device, or inside an account, the owner has no control over. A friend types it into a shared television, lets a browser save it, or hands it to another relative, none of them aware that the same password matters somewhere far more important.

Why the World Cup raises the stakes

A major tournament changes the threat model. The FIFA World Cup 2026 gives fans more reasons to open accounts, log in on the move, share streaming access, chase ticket news, and reply to messages in a hurry.

“The passwords they share already sit on more than one device, the ones they reuse already work in more than one place, and the football-themed ones are already half-guessable from what they post in public,” said ExpressVPN.

“All an attacker still needs is a believable reason to get in touch, and the World Cup supplies an endless run of them: ticket and travel updates, streaming glitches, subscription notices, match alerts, account-verification messages.”

How the six countries compare

No single market leads on risky behaviour. Spain shares the most, yet its sharers are the least likely to use that password anywhere else. The U.S. shares less, but what it shares travels furthest. The UK and Spain lead on putting football into passwords in the first place, while France edges the field on overall reuse, if only just.

ExpressVPN identified four distinct ways to protect accounts during the FIFA World Cup 2026.

Give important accounts their own passwords: The best defence against credential stuffing is a different password for every service.

Use a password manager, multi-factor authentication, and passkeys: Unique passwords are impossible to keep up with if you are trying to remember them all. A password manager generates and stores long, random ones for you, with no team names, players, shirt numbers, or birthdays involved.

Never share a password that’s used anywhere else: Treat any password you send to another person as no longer private. It should open only the account you are sharing, and never match the one on your email, your shopping, your bank, or anything else that matters.

Be cautious with tournament messages: Messages about tickets, streaming, travel, match alerts, and account verification will all feel routine during the World Cup, and that is exactly what makes them such useful phishing cover.

Methodology

ExpressVPN commissioned this survey in May 2026 with online market research provider Pollfish. It surveyed 6,000 people who follow football or soccer closely or casually, 1,000 in each of the United States, United Kingdom, France, Germany, Spain, and Australia. Some questions allowed more than one answer, and percentages may not total 100% because of rounding.