Unofficial websites illegally selling Euro 2016 tickets could leave fans being refused entry, Which? has warned.
Rules by the European football body Uefa mean ticket-holders are likely to need photo ID to get into grounds, which won't match the name on the ticket if it is an unofficial one.
The investigation by the consumer group found tickets on unofficial secondary sites selling for up to £5,000.
Tickets can only be bought legally through Uefa itself.
Which? has also warned of scam sites being set up to trick fans out of their cash.
"If you haven't bought your ticket directly from an official source there is no guarantee that you'll be able to get into the game and you could be left thousands of pounds out of pocket," said Alex Neill, Which? director of policy and campaigns.
Fraud and fakes
Under the rules of tournament organisers Uefa tickets cannot be sold on except through its official resale site. Buyers have also been told to bring photo ID to gain entry to stadiums.
In a statement Uefa said: "No tickets for individual football fans are being distributed via agencies or brokers, and Uefa encourages fans not to be lured into deals with touts, who not only demand exorbitant prices but are often not even in possession of the tickets they purport to have for sale."
The final batch of match tickets went on sale on Friday through its official ticket sales website.
Which? said it had contacted several websites to ask why they were selling tickets in breach of Uefa's rules and why they were not warning consumers of the risks involved in buying tickets. It said it had received no reply from any of the sites.
Which? also pointed out that tickets are being sold on the sites and others in breach of the Consumer Rights Act 2015, by not communicating the seat location, original face value of the ticket and any restrictions on the ticket.
The tell-tale signs that a website might be selling tickets unofficially
- The site may be offering tickets outside of official channels, often in large quantities
- The site may be unresponsive or difficult to contact
- There may be a high number of online complaints about the site from previous users
- You may be asked to pay by wire transfer, rather than by credit or debit card
- The site may have been set up not long before the sporting event.
Last month the Local Government Association called on social media sites to do more to crack down on online ticket fraud.
Simon Blackburn, chair of the LGA's Safer and Stronger Communities Board, said: "Social media sites now account for nearly half of all ticket scams and they need to do more to help prevent people being conned paying for tickets on their sites.
"People should be very wary of ticket offers for 'sold out' events as these situations are exploited by criminals," said Mr Blackburn.
If you have bought a ticket that hasn't turned up, or you suspect to be fake, contact your credit card provider immediately, as you may be able to get your money back, Which? advises.
If you discover a fraudulent ticket sales site you can report it to the Citizens Advice consumer helpline by calling 03454 04 05 06.
Almost 3,000 cases of ticket fraud were reported to Action Fraud between May and October last year. On average, customers who bought fake tickets lost £444 per transaction.
Football fans are constantly target by illegal ticket sellers. The LGA reported that last month a Liverpool fan was conned out of £700 by scammers selling fake Europa League final tickets on Instagram.
He met the seller to buy the tickets, which he thought were genuine, but later noticed the hologram on the tickets had peeled off - revealing them to be counterfeit and him out of pocket and out of the match.