With the 2026 FIFA World Cup in full swing, global soccer fans are eagerly following the matches, leading to a surge in ticket buying, travel arrangements, and online streaming demands. However, the Federal Bureau of Investigation (FBI) recently issued a Public Service Announcement (PSA) warning that cybercriminals are taking advantage of the World Cup frenzy by creating numerous fake websites and promoting various financial fraud activities in an attempt to steal personal information or deceive individuals into giving away their money, urging the public to stay vigilant.
The FBI has revealed that criminals are setting up fake websites that closely resemble the official website of the International Federation of Association Football (FIFA), tricking people into believing they are using the authentic platform. These websites often make only subtle changes in the URLs, such as misspelling the domain name, changing the domain name, or using official-looking subdomain names to confuse users.
For example, attackers may alter the legitimate URL “fifa.com” to “fiffa.com” or use alternative domain suffixes instead of the official domain, even registering websites like “jobs-fifa.com” to impersonate official services. This tactic falls under the category of “cybersquatting” and aims to attract users by leveraging brand recognition.
These counterfeit websites typically request users to input sensitive information such as names, addresses, phone numbers, email addresses, and bank account details, leading to identity theft, financial fraud, and other illegal activities. Some criminal groups even sell non-existent World Cup tickets and merchandise through these websites, deceiving consumers into making payments.
In addition to traditional phishing websites, cybersecurity and blockchain analysis institutions have recently discovered various new scams related to the World Cup.
One of the most common scams involves fake ticket sales websites. Scam groups mimic FIFA’s official ticketing platform or authorized channels, exploiting the pressure of popular matches being close to selling out to persuade fans to make quick payments. Some websites even require payments in cryptocurrency, and due to the irreversible nature of blockchain transactions, victims often struggle to recover their losses once the transfer is completed.
Another type of fraud involves selling match result information under the guise of having “inside information.” Operators claim to have insider knowledge of teams or match events and offer guaranteed profitable betting advice, asking users to pay fees to access the so-called intelligence. However, law enforcement agencies point out that such information often lacks credible sources and is usually a form of deception.
Researchers have observed that some criminals are introducing unauthorized cryptocurrencies or digital tokens related to the World Cup, capitalizing on fans’ and investors’ attention to the matches to attract funds.
Cybersecurity experts point out that some of these tokens have issues such as high coin concentration and inadequate liquidity, potentially carrying market manipulation risks like “Pump-and-Dump.” While the current financial scale of these activities is not yet substantial, research institutions believe that these activities could be preliminary moves for larger-scale fraud schemes.
The FBI has noted a significant number of fake websites related to the World Cup even before the tournament began and anticipates that the volume of related fraudulent activities may continue to rise as the matches progress.
To minimize the risk of falling victim to such scams, the FBI advises the public to directly type the official FIFA website in the browser address bar instead of solely relying on search engine results. If using a search engine, individuals should avoid clicking on search results labeled as “sponsored” to prevent landing on counterfeit websites. Moreover, when purchasing tickets, merchandise, or engaging in related activities, it is recommended to opt for official or authorized platforms and refrain from entering personal or bank account information on websites whose authenticity cannot be confirmed.
Link to the report: https://tinyurl.com/y7jdkkph