The FBI is warning that fake websites posing as FIFA are being used to steal personal and financial data, sell fake tickets and hospitality packages, and push other World Cup fraud schemes ahead of the 2026 tournament in the United States, Canada and Mexico. The agency said threat actors have prepared hundreds of phishing sites.
KEY FACTS
- Fake domains Typos such as fiffa[.]com and lookalike sites using .org, .xyz, .live and .sale were identified.
- Data at risk The sites collect names, addresses, phone numbers and payment details.
- Fraud methods Scams include fake tickets, hospitality offers, merchandise, streaming services and job portals.
- Scale Researchers observed more than 300 phishing sites in one ticket fraud operation.
In a public service announcement, the FBI said many of the fraudulent sites mimic the official fifa.com address with minor spelling changes that are easy to miss. Some also use fake employment portals such as jobs-fifa[.]com and fifa-hiring[.]com.
The disclosure said the sites can collect information including email and physical addresses, phone numbers and banking details. That data could be used to open fraudulent accounts, commit identity theft or support financial scams.
Cybersecurity firms Group-IB and Bitdefender also reported World Cup-related campaigns promoted through Google Search, Facebook ads, Telegram and WhatsApp. Group-IB linked a large premium ticket fraud operation to a Chinese threat actor it tracks as Ghost Stadium, while Bitdefender said it saw fake merchandise, kits, collectibles, streaming offers and Panini sticker scams starting in February.
Fans are advised to type fifa.com manually, avoid sponsored search results, check that the address ends in .com, use bookmarks for official sites, avoid links sent in direct messages and never enter sensitive data unless a site is verified.
WHY IT MATTERS
World Cup interest gives scammers a large pool of potential victims and many chances to disguise fake offers as legitimate ones. The warning highlights how sports events can be used to drive both ticket fraud and identity theft.