World Cup and big-event tickets: spoofed official sites, fake hospitality, and how to buy safely
Around a huge event like the 2026 World Cup, scammers stand up look-alike "official" sites to sell tickets and hospitality packages that do not exist — and to harvest your identity. The fix is to buy only through the real official channel you reached yourself.
A tournament like the 2026 World Cup creates a perfect storm for fraud: enormous demand, limited official supply, fans buying from abroad, and a short window in which everyone is rushing. Scammers meet that moment with look-alike “official” websites that sell tickets and hospitality packages which do not exist — and quietly collect your identity along the way.
What the warning says
The FBI has warned that, ahead of the 2026 World Cup, “cyber threat actors are conducting spoofing attacks against the FIFA website.” The aim is to “collect personal information, sell fake World Cup tickets and hospitality products, and to possibly facilitate other malicious activity.”
The method is imitation. A spoofed site is “designed to pose as a legitimate website, with branding and product listings”, built “by slightly altering characteristics of legitimate website domains.” Often this is typosquatting — registering domains that exploit small mistakes, with the FBI citing examples like “fiffa.com” or swapping “.org” for “.com.” Enter your details into one of these and the operators harvest “name, home address, phone number, email address, and banking information” — enough that they “can create new accounts in a victim’s name.”
Why this one is more than a fake ticket
A normal fake-ticket scam costs you the ticket price. This one is built to also take your identity: the checkout asks for a full set of personal and banking details, because the data is part of the prize. That is why an event-ticket site asking for far more than a purchase requires is a red flag on its own.
How to buy safely
The whole scam depends on you arriving at the wrong site, so the defense is to control how you get there — Go Direct:
- Reach the official ticketing channel yourself, by typing the organizer’s address or using its verified link — never an ad, a search result, or a social post.
- Read the web address one character at a time. A doubled letter or a different ending is the whole trick.
- Treat anyone offering tickets to a sold-out event, or “guaranteed” hospitality, outside official channels as selling something they may not have. The FTC warns that speculative sellers advertise tickets they do not actually possess.
- Pay by credit card so you can dispute a charge; avoid wire, gift cards, crypto, or payment apps to an unverifiable seller.
This is the high-stakes, event-specific cousin of everyday concert and sports ticket scams and ordinary fake online stores. For more, see the defense library or test your eye on the 60-second quiz.
- A site sells tickets or "hospitality packages" for a sold-out or high-demand event at prices that seem available when official channels are not.
- The web address is almost right but slightly off — a misspelling, an extra letter, or a different ending like .org instead of .com.
- You found the site through an ad, a search result, or a social post rather than by going to the event's official page yourself.
- Checkout asks for far more than payment details — full name, home address, phone, email, and banking information.
- Payment is pushed toward wire, gift cards, crypto, or a payment app rather than a credit card.
- Buy only through the event's official ticketing channel, reached by typing the address yourself or using the organizer's verified link — not an ad, search result, or social post.
- Check the web address character by character. Scammers register look-alike domains (for example, a doubled letter, or .org in place of .com) to impersonate the real site.
- Be suspicious of anyone selling tickets to a sold-out event, or "guaranteed" hospitality packages, outside official channels — they may not have the tickets at all.
- Pay by credit card, which lets you dispute the charge if the tickets never arrive or are fake. Avoid wire, gift cards, crypto, or payment-app transfers to a seller you cannot verify.
- Do not hand over more personal information than a purchase needs. A fake site's real goal may be your identity, not just your money.
Big events compress months of demand into a few frantic days, and that urgency is exactly what these sites farm. The detail I keep coming back to is that a spoofed checkout often wants more than your card — it wants the full set of identity details — which tells you the fake ticket may not even be the main product. The boring move wins: go to the official source yourself, read the address one character at a time, and pay with a card.
Sources
Frequently asked
The site looked exactly like the official one, with the right logos and listings. How is it fake?
Look-alike sites copy branding and product listings on purpose. The FBI warns that around the 2026 World Cup, threat actors stand up spoofed sites "designed to pose as a legitimate website, with branding and product listings", created "by slightly altering characteristics of legitimate website domains." Matching design is not proof — the address is what matters, and even that can be a near-perfect imitation.
What is "typosquatting"?
It is registering a domain that relies on small mistakes — the FBI gives examples like "fiffa.com" or using ".org" instead of ".com". You think you typed or clicked the official site, but a single altered character sends you to the scammer's copy. That is why typing the address carefully, or using a saved official link, matters.
I only bought a ticket — why would they want my home address and banking details?
Because the tickets may be a cover for identity theft. The FBI notes these spoofed sites gather information such as "name, home address, phone number, email address, and banking information", and warns that with your details a scammer "can create new accounts in a victim's name". Treat an over-asking checkout as a red flag in itself.
How do I find the genuine official ticket source?
Go to the event or governing body's main site directly and follow its links to authorized sellers, rather than trusting an ad or search result. The FTC's general ticket advice is to set up an account with the official seller and watch for legitimate presales — and remember that the "https://" only means the connection is encrypted, not that the seller is honest.