Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise
As the 2026 FIFA World Cup approaches, scammers are exploiting fans’ desire for tickets and merchandise by creating convincing fake websites mimicking FIFA’s official channels. These sites use tactics like typosquatting and mimicking the official website’s design to trick users into providing personal information and payment details. FIFA advises fans to only purchase tickets through its official channels and to be vigilant about suspicious links and offers. Ignoring these warnings can lead to financial loss and identity theft.
As the FIFA World Cup 2026 in the United States, Canada, and Mexico draws closer, a wave of fake websites targeting soccer fans seeking tickets and merchandise is emerging. These sites, such as https://***fifa26[.]shop and https://****26-fifa[.]com, are designed to look identical to FIFA’s official channels, including the FIFA website and ticketing portal. The goal is to trick users into providing personal information and payment details, despite the fact that FIFA only offers ticket sales through three official channels: fifa.com/tickets, fifa.com/hospitality, and special Qatar Airways travel packages.
Researchers at ESET in Latin America have identified several of these sites, which employ tactics like typosquatting – using domain names that closely resemble legitimate ones but contain slight alterations – to capitalize on the high demand for World Cup tickets and merchandise. The sites replicate the visual design and user flow of FIFA’s official website, including registration steps, ticket selection, and a shopping cart, to create a sense of legitimacy and encourage users to proceed with the purchase.
However, the reality is that once users enter their card details, the information is immediately handed over to the cybercriminals behind the fake site, resulting in financial loss and potential identity theft. A full name, email address, phone number, and reused password can be exploited by attackers beyond the initial fraudulent website. If a fake registration page steals a password that is also used for email or social media accounts, the problem can extend far beyond the initial scam.
FIFA has explicitly stated that fans should only purchase tickets through its official channels. To help protect themselves, FIFA recommends the following:
- Go to FIFA’s official website directly, typing the address yourself (starting from FIFA.com).
- Carefully examine the domain name before entering any information – look for typos, extra characters, or odd endings.
- Be wary of offers built around pressure, such as “limited tickets” or “last chance” deals.
- Avoid reusing passwords.
- Protect all accounts with strong, unique passwords and two-factor authentication.
The rise of these fake sites highlights how criminals are exploiting the intense excitement surrounding the World Cup to deceive fans and steal their information. The countdown to the tournament provides a ready-made audience for these phishing attacks, one familiar click at a time.