Fake FIFA Websites Target Fans Ahead of the 2026 World Cup

The FBI is warning that scammers are spoofing FIFA websites ahead of the 2026 FIFA World Cup to steal personal information and sell fake tickets, hospitality packages, and job opportunities. The campaign targets fans who are trying to buy tickets, apply for event-related jobs, or search for official tournament information.

The FBI public service announcement says threat actors are creating websites that imitate the official FIFA domain and brand. These fake sites may collect names, home addresses, phone numbers, email addresses, banking details, and other personally identifiable information.

The safest route for fans is to go directly to FIFA.com/tickets for ticket information and avoid sponsored search results, social media offers, and links sent through unsolicited messages. Scammers are expected to keep creating new domains as demand rises before and during the tournament.

How the FIFA Spoofing Scam Works

Attackers register domains that look close to FIFA’s real website. Some use small spelling changes, while others use unusual top-level domains or words such as ticket, jobs, hiring, career, or World Cup.

Once visitors land on the fake site, they may see copied branding, fake ticket portals, employment pages, or hospitality offers. The page then asks for personal details, payment information, or account credentials.

The FBI says some domains may also support monetary scams. In practical terms, a victim could pay for a fake ticket, submit identity details for a fake job, or hand over enough information for follow-up fraud.

Examples of Spoofed FIFA Domains

Scam Theme	Examples Listed by the FBI	Likely Goal
Lookalike FIFA domains	fifa[.]cab, fifa[.]pink, fifa[.]pub, fifa[.]ceo	Impersonate the official FIFA site
Typo-squatting	filfa[.]org, wvvw-fifa[.]com, fifa-com[.]com	Catch users who mistype or skim URLs
Fake job sites	jobs-fifa[.]com, fifa-careerhub[.]com, fifaworldcup-careers[.]com	Collect job seeker data
Fake ticket sites	fifa-ticket[.]live, worldcup26ticket[.]com, 2026fifaworldcuptickets[.]online	Sell fake tickets or steal payment data

Why Fans Are Being Targeted Now

The 2026 World Cup creates a large opportunity for scammers because fans are searching for tickets, travel packages, hotels, hospitality options, and jobs tied to the tournament. High demand and limited availability make urgency-based scams more convincing.

The FTC World Cup scam guidance warns that fraudsters use copycat websites, paid search results, and social media to push fans toward fake ticket offers. It also notes that most tickets will be delivered electronically through the FIFA app.

That matters because fake sellers may use paper tickets, screenshots, or urgent payment requests to look legitimate. Fans should treat those signals as warning signs, especially when the seller asks for cryptocurrency, wire transfers, or direct app payments.

What Information the Fake Sites Want

The FBI warning says spoofed FIFA sites may collect personally identifiable information that can support fraud long after the original scam. A fake ticket or job page may look harmless at first, but the information entered can help attackers build convincing follow-up scams.

• Full name
• Home address
• Phone number
• Email address
• Banking information
• Account login details
• Payment information
• Travel or identity-related details

Attackers can use this data to create accounts in a victim’s name, attempt account takeover, send targeted phishing emails, or pressure victims into more payments.

Fake Jobs and Fake Tickets Are the Main Lures

Fake job sites can be especially effective because major events create real demand for temporary workers, volunteers, vendors, logistics staff, and hospitality roles. Scammers exploit that expectation by creating career-themed domains that look connected to FIFA.

The same tactic applies to tickets. A fake website may claim to offer sold-out seats, VIP hospitality, resale tickets, or discounted packages. Some sites may even use HTTPS certificates, polished layouts, and copied FIFA branding to appear safe.

Fans should remember that a lock icon only means the connection is encrypted. It does not prove that the website is owned by FIFA or that the offer is real.

World Cup Scams Are Expanding Beyond Domains

Netcraft research found that threat actors are using the 2026 World Cup as a lure across phishing, fraudulent ticket sales, fake hotel domains, betting scams, social media offers, Telegram channels, and cybercriminal forum activity.

That wider ecosystem matters because victims may not start on a fake FIFA domain directly. They may first see a social media post, paid ad, chat message, forum listing, or search result that redirects them to a fake site.

Scammers also use the same tournament theme to promote fake hotels, fake streaming services, fake gambling platforms, and fake merchandise. The closer the tournament gets, the more likely these scams are to increase.

How to Check Whether a FIFA Website Is Real

Check	What to Do
Domain spelling	Confirm that the domain is fifa.com, not a lookalike with extra words or letters.
Ticket source	Use FIFA’s official ticket page or the FIFA app for official ticket information.
Search results	Avoid sponsored results when searching for FIFA tickets, jobs, or hospitality.
Payment request	Be cautious if a seller asks for crypto, wire transfer, gift cards, or direct payment apps.
Ticket format	Be suspicious of paper tickets, screenshots, or QR codes from unknown sellers.
Job offer	Verify any hiring page through FIFA’s official website before submitting personal information.

What the FBI Recommends

The FBI advisory recommends typing FIFA’s official domain directly into the browser address bar instead of relying on search engines. It also warns users to avoid sponsored results that may push traffic toward paid impersonation sites.

Fans should bookmark verified pages and use those bookmarks for future visits. They should also avoid links in unsolicited messages, social media comments, advertisements, or posts claiming limited-time ticket deals.

The FBI also advises users to check URLs carefully, avoid suspicious graphics or low-quality pages, and never share sensitive information if they are unsure that the website is legitimate.

What to Do If You Shared Information

If you entered information on a fake FIFA site, act quickly. Change any reused passwords, contact your bank if you submitted payment details, and watch for suspicious calls, emails, or account activity.

You should also file a report through the IC3 website. The FBI asks victims to include the fake domain, details about the interaction, the information provided, and any financial transaction details.

The FTC warning also recommends reporting suspected scams and checking buyer protections before purchasing from third-party resellers. A reseller’s refund policy, delivery method, and replacement guarantee matter if a ticket fails.

Why Sponsored Results Can Be Risky

Sponsored search results can appear above legitimate results. Scammers can exploit that placement to make a fake FIFA page look like the quickest and most relevant option.

This matters for fans searching under pressure. A person looking for last-minute tickets or jobs may click the first result without checking the domain. That is exactly the behavior typo-squatting and ad-based scams try to exploit.

The Netcraft report says much of the observed World Cup scam infrastructure is being staged before the event, with fake FIFA-branded websites and ticket promotion domains expected to become more active as the tournament approaches.

Practical Safety Steps for Fans

• Type fifa.com directly into your browser instead of clicking ads or search results.
• Use bookmarks for FIFA ticket, hospitality, and account pages.
• Check every domain for misspellings, extra words, and unusual endings.
• Avoid websites that promise guaranteed tickets outside official channels.
• Do not trust screenshots, paper tickets, or QR codes from unknown sellers.
• Never submit banking details on a site you reached through an unsolicited message.
• Report suspicious domains and payment requests to the FBI’s IC3 portal.

The World Cup will create heavy online traffic, and attackers know fans are eager to secure tickets and travel plans. That makes the event a strong lure for identity theft and financial fraud.

The safest habit is simple: start from official pages, verify every URL, and slow down before entering personal or payment information. Scammers rely on urgency. Fans can reduce the risk by refusing to rush.

FAQ