FBI Alerts Fans to FIFA Spoof Sites Harvesting Data Amid 2026 World Cup

The FBI’s Internet Crime Complaint Center (IC3) issued a Public Service Announcement on May 27, 2026, warning the public about cyber threat actors creating spoofed websites that mimic FIFA’s official domain to steal personal information and sell counterfeit World Cup tickets and hospitality packages.[1][2]

The PSA details how scammers use typo-squatting, altered spellings, or non-standard top-level domains (such as .blue or .city) to create deceptive sites that harvest names, addresses, phone numbers, emails, and banking details. Victims risk identity theft or financial fraud as attackers may open accounts in their names. The agency has already identified dozens of fraudulent domains tied to fake FIFA jobs, merchandise, and ticketing pages, with more expected throughout the tournament hosted across the U.S., Canada, and Mexico from June 11 to July 19.[3]

Subsequent reporting from outlets including The Hill and AARP has amplified the alert, noting that users should manually type fifa.com into their browsers rather than clicking search results or ads, and verify URLs carefully to avoid redirection via malicious advertisements.[2][3] Local stations such as KOMO News and PIX11 have echoed the guidance for fans seeking tickets or merchandise.[4][5]

The warning arrives as the 2026 World Cup draws massive online interest, highlighting a recurring pattern of event-timed phishing campaigns that exploit high demand for tickets and official content. The IC3 advises reporting suspected incidents at ic3.gov.