Fake FIFA Websites: FBI Warning Before the World Cup

TL;DR: On May 27, 2026, the FBI’s IC3 warned that criminals were building fake copies of FIFA’s website ahead of the 2026 World Cup, using misspelled domains, swapped extensions and fake subdomains to steal personal data and money. The same tricks apply to any major event.

👉 Check my digital footprint — free 30-second check →

What happened

In alert I-052726-PSA, the FBI says criminals build fake copies of FIFA’s site, complete with branding and product listings. They register look-alike domains with slight misspellings, swapped top-level domains such as .org instead of .com, or fake subdomains like “jobs-fifa”. This “typo squatting” depends on people mistyping an address or clicking a look-alike result.

The FBI expected more fake domains to appear before and during the tournament. Victims can lose personal information such as names, addresses, phone numbers, email addresses and banking details, face identity theft, and lose money on fake tickets, hospitality packages and other payment scams.

Why it works

Big events create urgency and demand, and people search quickly for tickets, jobs or merchandise. Paid “sponsored” results and ads can place a look-alike site above the real one, and a convincing logo makes a fake page feel official.

The FBI’s red flags are slightly misspelled or unfamiliar web addresses, hyphenated or extra-word domains that imitate FIFA subdomains, sponsored results that lead to unexpected sites, low-quality graphics, and requests for sensitive information on a site you cannot verify.

Background: our explainers on concert and festival ticket scams and spear phishing. See also FBI: Hidden Redirect Systems Send Users to Fraud Sites and Fake Zoning Permit Invoices: FBI Warns Property Owners.

What the FBI advises

Type the official address directly into your browser instead of searching for it, and skip sponsored search results.
Confirm the address is exactly the official one and ends in .com for FIFA, and bookmark login pages rather than relying on search results or ads.
Reach subdomains by navigating from the official homepage, not by typing them in.
Check an ad’s URL before clicking, because ads can redirect you.
If you used a fake site, file at ic3.gov with the fake domain, what you did and shared, and any payment details or crypto addresses.

If you have already sent money

Contact your bank or card issuer immediately and ask to stop or recall the payment, then report it at ReportFraud.ftc.gov and, for internet-enabled crime, to the FBI’s Internet Crime Complaint Center. Our guides on how to report a scam to IC3, how to reverse a wire transfer scam and US bank impersonation scams walk through the steps, and what to do after a scam, wherever you live covers the first 24 hours. Scammers often start with details taken from past leaks, so run our free digital footprint check to see what of yours is already exposed.

Frequently Asked Questions

How do fake FIFA websites work?

Criminals register look-alike domains with misspellings, swapped extensions or fake subdomains, and copy FIFA’s branding and product listings so visitors think they are on the real site.

What can I lose on a fake site?

Personal details such as names, addresses, phone numbers, email addresses and banking details, plus money paid for fake tickets or hospitality packages, and the details can feed identity theft.

How do I reach the real site safely?

The FBI advises typing the official address directly into your browser, skipping sponsored results and bookmarking login pages.

Does this only apply to the World Cup?

No. The same typosquatting and fake-ad tricks are used for concerts, sports finals and holiday sales, so the same checks apply.

FBI Warns of Look-Alike FIFA Websites Ahead of the 2026 World Cup