Fake World Cup websites are built to survive a quick glance.

A copied logo and secure connection do not make a ticket seller official.

The FBI warned ahead of the 2026 FIFA World Cup that threat actors were creating websites designed to resemble FIFA properties. The sites may advertise nonexistent tickets, hospitality packages or jobs while collecting payment and personally identifying information.

The domain is often the strongest clue. Criminals use extra words, altered spelling or a different top-level domain to create an address that looks plausible when seen in an advertisement, message or search result.

What the copy is designed to do

A fraudulent site can reproduce branding, navigation and product descriptions from a legitimate organization. It may also use HTTPS, which protects the connection but does not verify that the business behind the site is authentic.

Search advertisements and social posts can place the imitation in front of people already looking for tickets. Some addresses exploit typing mistakes; others add terms such as “jobs,” “tickets” or “hospitality” around a protected brand.

Verify before paying

• Navigate independently to FIFA’s official website and follow its ticket links.
• Read the entire domain from right to left, checking the actual registered name—not only words near the beginning.
• Treat extreme discounts, countdowns and immediate-payment demands as warning signs.
• Do not send identity documents or banking information to an unverified seller.

If information was entered

Contact the card issuer or payment provider promptly, change any reused password and monitor affected financial accounts. Preserve the fake domain, advertisement, receipt, messages and transaction details. The FBI asks victims to include those records in an IC3 complaint.