FIFA World Cup 2026 Ticket Scams Hit the Workplace

On 27 May 2026, the FBI's Internet Crime Complaint Center (IC3) issued a public service announcement warning that threat actors are spoofing FIFA websites ahead of the 2026 World Cup. With the tournament running from 11 June through mid-July across the United States, Canada, and Mexico, criminals are racing to cash in on the largest sporting event of the year. The problem for security teams is simple: the same lures that target fans land in employee inboxes on corporate devices.

Event-themed phishing thrives on excitement and time pressure. A message promising last-minute tickets, a merchandise discount, or a free stream of the opening match bypasses the careful scrutiny people apply to a generic bank alert. When that click happens on a work laptop, your organization inherits the risk.

How Big Is the FIFA Scam Problem?

The numbers are striking. In its advisory, the FBI said it had identified at least 36 fraudulent domains impersonating legitimate FIFA websites, and it expects far more to appear as matches begin. Independent researchers paint an even larger picture.

• Singapore-based Group-IB reported more than 4,300 fraudulent domains posing as FIFA-affiliated sites registered since August 2025, including a cluster operated by a single Chinese-speaking actor. Group-IB found one operation had built a pixel-perfect replica of the official FIFA site, complete with a fake single sign-on flow and support for 11 languages.
• Bitdefender Labs uncovered more than 55 football-themed scam campaigns spreading through fake online stores, social media ads, IPTV piracy operations, fraudulent apps, and FIFA-themed giveaway and lottery emails. Targeted fans spanned the UK, Portugal, Spain, the US, Canada, Mexico, Germany, Brazil, and Australia.

You can read the FBI's full advisory at ic3.gov and Bitdefender's analysis on its security blog.

The Techniques: Lookalike Domains and Fake Payment Flows

The FBI attributes most of this activity to two well-worn techniques: domain impersonation and typosquatting. Attackers register web addresses that closely resemble the genuine fifa.com, then drive traffic to them through search ads, social posts, and email. Because the cloned page looks identical, victims hand over login credentials, payment card details, and personal data without hesitation.

The scam ecosystem covers more than tickets. Researchers have documented:

• Fake ticket marketplaces selling seats that do not exist
• Counterfeit merchandise and collectibles stores that harvest card data
• Illegal streaming offers bundled with banking malware
• Giveaways, lotteries, and crypto promotions dangling prizes in exchange for a deposit or wallet connection

One of the clearest tells, according to Bitdefender, is the payment method. Some fraudulent sites convert card payments into cryptocurrency, and several push wire transfers or money-transfer apps. FIFA's official ticketing never accepts crypto, so any site that demands payment by cryptocurrency, wire, or gift card is a fraud.

When navigating to FIFA's official site, the FBI recommends typing fifa.com directly into the address bar and verifying the URL is correctly entered as www.fifa.com rather than clicking a link from an email, ad, or search result.

Where the Lures Show Up: Search, Social, and Inboxes

Fraudulent domains are only useful if victims reach them, so the bulk of the effort goes into distribution. Understanding the channels helps employees recognize a lure regardless of which one they encounter.

• Search and sponsored results. Scammers buy ads against high-intent terms like "World Cup 2026 tickets" so a fraudulent site appears above the official one. A top result is not a trust signal.
• Social media ads and posts. Bitdefender found dozens of campaigns running on Meta-owned platforms, pushing fake stores, giveaways, and streaming offers that look professionally produced.
• Email giveaways and lotteries. Messages announcing that the recipient "won" tickets or a hospitality package, then asking for a fee or personal details to claim the prize.
• Messaging apps and group chats. Forwarded "deals" that gain false credibility because a friend or colleague shared them.

The lesson for staff is that the channel does not confer legitimacy. A polished ad, a high search ranking, or a forward from a coworker says nothing about whether the destination is real. The only reliable check is the destination itself: the exact domain, the payment method, and whether the offer arrived unsolicited.

Why This Is a Workplace Problem, Not Just a Consumer One

It is tempting to file World Cup scams under personal cybersecurity. That would be a mistake. The line between personal and corporate browsing has all but disappeared. Employees check personal email on company laptops, click ads during breaks, and forward "great deals" to colleagues over chat. A single credential-harvesting page can capture a password an employee reuses for work systems, and a malicious stream can drop malware onto an endpoint that sits on your network.

Seasonal and event-driven lures are a recurring pattern. Tax season, Black Friday, major elections, natural disasters, and global sporting events all generate predictable waves of themed phishing. The World Cup is simply the lure of the moment. Teams that learn to recognize the underlying pattern, not just the specific scam, stay resilient long after the final whistle.

Consider how an attacker chains these elements together. A finance employee searches for tickets during lunch, lands on a typosquatted domain through a sponsored search result, and enters the password they also use for a SaaS expense tool. Weeks later that reused credential surfaces in a credential-stuffing attack. The World Cup scam was never really about football; it was about harvesting reusable secrets at scale.

How to Prepare Your Team Before Kickoff

The defense against event phishing is the same discipline that defeats everyday phishing, reinforced with timely, relevant context. A few practical steps:

1. Send a short, timely awareness nudge. A two-paragraph internal note naming the current lure, World Cup ticket and streaming scams, primes employees to be skeptical right when the threat peaks.
2. Run a seasonal phishing simulation. An event-themed simulated email tests whether staff apply their training under real-world temptation, then turns each click into a coaching opportunity. empowsec's phishing simulation platform lets you launch a World Cup-themed campaign and follow it with a teachable-moment debrief that explains exactly what the recipient missed.
3. Make reporting effortless. If employees can flag a suspicious message in one click, your security team gets early warning of a campaign hitting the organization. empowsec's report-phishing add-ons for Gmail and Google Workspace and for Outlook put that button right in the inbox.
4. Reinforce the universal red flags. Lookalike domains, payment by crypto, wire, or gift card, and unsolicited prize offers are the constants behind almost every seasonal scam.

Timing matters as much as content. Awareness messaging lands best in the days just before and during the tournament, when interest peaks and impulse is highest. A single well-timed simulation that mirrors the current threat does more than a generic module delivered months earlier, because it meets employees in the exact moment they are most likely to be tempted. After the World Cup, the same framework rolls forward to the next predictable spike, whether that is the holiday shopping season or the next major event.

Key Takeaways

• The FBI's IC3 has formally warned that criminals are spoofing FIFA sites ahead of the June 2026 World Cup, with researchers tracking thousands of fraudulent domains.
• Lookalike domains and typosquatting drive most of the fraud, alongside fake stores, streaming offers, and giveaways.
• Any request to pay by cryptocurrency, wire transfer, or gift card is a reliable sign of a scam, FIFA never sells tickets that way.
• Event phishing is a workplace risk because personal browsing and corporate devices overlap, and reused passwords cross the boundary.
• A timely awareness nudge, a seasonal phishing simulation with a teachable-moment debrief, and one-click reporting prepare your team for this tournament and the next seasonal scam wave.