FBI Warns of Fake FIFA Websites

The FBI is warning of fraudulent websites impersonating FIFA to steal data and sell fake tickets for the 2026 World Cup.

The U.S. Federal Bureau of Investigation (FBI) has issued a public service announcement about fraudulent websites targeting the 2026 FIFA World Cup. Cybercriminals are creating sophisticated fake sites that impersonate the official FIFA platform and its legitimate partners. The primary goals of these campaigns are to steal sensitive personal and financial information from unsuspecting fans. Attackers use these sites to sell counterfeit tickets, non-existent hospitality packages, and fake merchandise, often creating a sense of urgency to pressure victims. This form of social engineering preys on the excitement and high demand surrounding the major global sporting event, tricking users into believing they are interacting with a legitimate vendor.

This advisory is critical for corporate security teams, as employees may use work devices or networks to search for tickets, inadvertently exposing company systems to significant risk. A successful phishing attack could lead to credential theft, malware installation, or the compromise of corporate financial accounts if company credit cards are used. The warning underscores the importance of continuous employee security training, particularly in identifying the subtle signs of phishing and verifying the authenticity of websites before entering any personal or payment details. It serves as timely threat intelligence for organizations to bolster their defenses and user awareness programs ahead of the event.

Major global events are prime targets for large-scale phishing and fraud campaigns. This FBI warning provides timely threat intelligence for security teams, highlighting social engineering tactics that could impact both employees' personal security and corporate network safety if work devices are used.

Employees falling for these scams on work devices can introduce malware to corporate networks, lead to credential theft, and compromise company financial data if corporate cards are used. The advisory highlights the need for proactive employee education on phishing and secure browsing habits.