World Cup Scams

Picture of a soccer stadium

The FBI warns that cybercriminals are creating fake versions of FIFA’s website ahead of the 2026 World Cup to steal personal information, sell fake tickets and hospitality packages, and commit fraud.  These spoofed sites often use slight misspellings or different domain endings to look legitimate and capture information such as names, addresses, phone numbers, email addresses, and account or card numbers.

How the Scam Works

Fraudsters build lookalike versions of www.fifa.com to appear official.  These fake sites may use small spelling changes (for example, fiffa[.]com), different endings such as .org instead of .com, or misleading subdomains like jobs-fifa[.]com. This tactic, known as typo squatting, relies on users mistyping or overlooking URL differences.  These fake websites are deployed to run various scams:

  • Counterfeit Jerseys and Fake Tickets:  Fraudsters sell fake merchandise and nonexistent tickets, often using AI-generated images and convincing storefronts to appear legitimate.
    • Ticket fraud remains one of the biggest threats, especially through social media groups and unofficial resale channels.  Watch out if the price is unusually low, the seller always seems to have tickets available, or the offer relies on urgency.  Ticket prices are expected to be high with a projected average ranging from $1,000 - $2,400.
    • Legitimate tickets are normally delivered digitally through the FIFA app, so paper tickets or screenshots are major red flags.
  • Bogus Accommodations:  Beware of special fan packages that are too good to be true.  They might include low-cost hotel stay near the stadiums, special merchandise, parking deals, and meet and greets.  These bogus offers are designed to steal banking or card information.
  • Fake FIFA Coins and Cryptocurrency:  There have been World Cup-themed cryptocurrency promotions, using FIFA branding, to look legitimate.  Avoid any coin or token tied to the tournament.  Crypto payments are difficult to reverse and frequently used by fraudsters to stay anonymous.

Protecting Yourself

  • Type fifa.com directly into your browser instead of using search results.
  • Avoid sponsored links and ads that may lead to fake sites.
  • Confirm the address is exactly www.fifa.com and ends in .com.
  • Do not click suspicious links or share personal information unless you are sure the site is legitimate.
  • Compare ticket and special package costs with official sources to determine if they are too good to be true.

If You Become a Victim

  1. File a complaint with the IC3 at www.ic3.gov and include as much detail as possible, such as:
    • The fake website’s domain
    • What happened on the site, including any information you entered
    • Payment details, such as date, amount, method, and any involved accounts or cryptocurrency addresses
  2. Notify your bank or credit union of any fraudulent transactions.
  3. Change passwords on any accounts that may be compromised.
  4. File a police report.
  5. File a complaint with the FTC at https://reportfraud.ftc.gov/.

Watch the video below from KRPC 2 Houston for more information: