Fake job listings, counterfeit tickets, and identity theft. The FBI says it’s all happening through spoofed FIFA websites ahead of the 2026 World Cup.
HOUSTON — The FBI is warning the public about a wave of fake websites impersonating the official FIFA website ahead of the 2026 World Cup, with cybercriminals allegedly using the spoofed sites to steal personal information and sell fraudulent tickets.
The agency issued a public service announcement saying threat actors have created deceptive versions of FIFA’s official website, www.fifa.com, to trick users into handing over sensitive data including names, home addresses, phone numbers, email addresses and banking information. The scam is timed to capitalize on growing interest in the 2026 tournament.
The FBI said it has already identified dozens of fraudulent domains and expects more to appear as the World Cup approaches.
The FBI has already identified dozens of fraudulent domains currently in operation, including:
- fifa-ticket.live
- fifaworldcup26.sale
- worldcup26ticket.com
- 2026fifaworldcuptickets.online
- jobs-fifa.com
- fifa-careerhub.com
Some mimic the real site through minor spelling changes or alternate domain extensions, a tactic known as typosquatting, which relies on users making small mistakes when typing a web address.
According to the FBI, the goal of the scammers goes beyond data theft. The agency said it has identified actors using the fake sites to collect personal information, sell counterfeit World Cup tickets and hospitality products, and potentially carry out other malicious activity. If a scammer obtains a victim’s personal information, they could open new accounts in that person’s name and commit fraud.
How to stay safe
The FBI’s guidance is simple but worth repeating for anyone planning to purchase tickets or engage with FIFA online:
- Type fifa.com directly into your browser’s address bar rather than relying on a search engine.
- Skip the sponsored results. Paid advertisements in search engines can be purchased by scammers specifically to divert traffic away from the real site.
- Bookmark the official site and navigate from there.
- Double-check every URL before entering any personal or financial information.
- Never share sensitive information on any site whose legitimacy you cannot confirm.
Anyone who believes they have been victimized is asked to file a complaint with the FBI’s Internet Crime Complaint Center at www.ic3.gov, including the fake domain name, a description of what information was shared, and any financial transaction details.