Cybercriminals are exploiting excitement around the 2026 FIFA World Cup with fake websites designed to steal money, banking details, and personal information from fans searching for tickets and merchandise. The tournament, taking place from June 11 through July 19 across the United States, Canada, and Mexico, has already become a major target for phishing scams.
The FBI warns that scammers are creating fake domains that closely imitate the official FIFA website using small spelling changes and suspicious domain extensions. Many of these fraudulent sites collect names, addresses, phone numbers, emails, and payment information that can later be used for identity theft and financial fraud.
Researchers from Group-IB and Bitdefender say these campaigns are spreading through Google ads, Facebook, Telegram, WhatsApp, and other online platforms. One operation known as “Ghost Stadium” reportedly uses more than 300 fake FIFA-themed websites to target fans with ticket scams and counterfeit products.
The FBI advises users to manually type the official FIFA website into their browser, avoid suspicious links, verify URLs carefully, and never enter sensitive information on untrusted websites. Victims are encouraged to report scams to the FBI’s Internet Crime Complaint Center (IC3) with details about the fake domain and any payments made.