The fraud operations targeting the 2026 FIFA World Cup have been running since August 2025. Cybersecurity researchers’ analysis of the structure and scope of this scam found that more than 4,300 fraudulent domains are impersonating FIFA’s official web presence. The sites were registered months in advance and kept dormant until demand peaked. At the center of these operations is a cyberattacker called Ghost Stadium, which built a pixel-perfect clone of FIFA’s website, including a working authentication flow, with more than 300 active phishing sites focused specifically on premium and hospitality tickets. The scale was significant enough that the FBI published a formal public service announcement in late May 2026, with the FTC issuing guidance around it the same week.
FIFA’s own ticket practices have also been called into question recently. In late May 2026, attorneys general of New York and New Jersey launched a formal investigation into FIFA’s ticket practices, subpoenaing the organization over allegations of “artificially inflating prices” and “misleading fans.” Thousands of tickets were suddenly available one week from kickoff, with FIFA itself accused of offloading unsold inventory on resellers such as SeatGeek.
Together, these circumstances create a perfect storm for both confusion and fraud. Consumers might find it increasingly difficult to determine the actual and reasonable cost of a ticket and aren’t sure which online platforms to trust for valid tickets and merchandise. Meanwhile, for over a year, fraudsters have been carefully setting the stage to take advantage of these conditions. Not all of the scammers’ strategies are new, but all are increasingly polished and more difficult to detect.
AI has become instrumental in making scams harder to identify. Cybersecurity researchers have identified scam campaigns using AI-generated product images and website clones that pull authentic branding directly from FIFA’s own servers. In other words, a fraudulent page “borrows” from and then uses the same branding and imagery as an authentic site. For example, researchers at Bitdefender noted that some scam ads for fake World Cup merchandise were polished enough to look like official marketing. Pressure tactics are one aspect of these scams that isn’t new. The site may use countdown timers that reset when you reload the page. They might also create a sense of urgency, using phrases such as “Only a few tickets left!” which appear across every scam category and yet, oddly, stock counters don’t decrease after tickets are purchased.
It’s critical to slow down and ensure a site is legitimate before purchasing tickets or merchandise. Based on the latest fraud intelligence compiled by SmartCustomer, below are six scams to watch out for.
Quick Facts: Who’s authorized to sell World Cup tickets?
Fake ticket scams usually reach fans through three primary channels.
Fake ticket sites. Some fake ticket sites use a tactic called “typosquatting,” which involves registering domains that are similar to fifa.com but with subtle differences in the URL (for example, fiffa-dot-com, fifa-dot-city, or an alternate extension such as .live or .sale). Other fraudulent websites bear no resemblance to an official source; they are simply a convincing-looking ticket marketplace created specifically to collect payment before disappearing.
In both cases, the checkout process and confirmation email may appear legitimate. Most victims receive either a convincing-looking fake ticket that fails to scan at the venue or nothing at all once payment clears. In more sophisticated cases, scammers have duplicated real ticket QR codes, which appear to work until match day, when the seat turns out to be already occupied. Most of these sites reach buyers through paid social media ads (versus the consumer actively searching the internet), which is how a site with no history and reputation can still manage to reach a significant number of victims.
Social media sellers. Research into social media scammers found that all (100%) of them had newly created social media profiles, versus legitimate resellers that had long-term accounts. One security researcher tested a seller in a Facebook group by requesting tickets to a match between two countries that aren’t competing in the 2026 World Cup. The seller agreed to provide them without hesitation, which of course signals brazen fraud.
Sellers on popular resale platforms. This third category involves fraudsters using legitimate businesses (such as StubHub or SeatGeek) to sell tickets. Because ticket resale is legal and largely unregulated in the United States and Canada, platforms can list World Cup tickets without violating laws and FIFA can’t prevent them from doing so. FIFA’s terms of sale do however reserve the right to invalidate tickets purchased outside authorized channels.
The big risk for consumers is that the tickets may be fraudulent or nonexistent. Some resellers list “speculative tickets,” or tickets that are posted before the seller actually holds the ticket, which compounds the uncertainty. While buying from a popular ticket site with a documented guarantee can be meaningfully safer than buying from an individual on social media, it carries risks that buying directly through FIFA would prevent.
How to protect yourself: Type fifa.com/tickets directly into your browser instead of clicking a link in an ad or email. When buying from a major secondary platform, ask the seller to confirm the tickets are in their FIFA account, and look into each platform’s consumer guarantees before committing. On social platforms, check the account creation date to see how long the account has been active. Newly created accounts are a red flag.
Quick Facts: Who’s authorized to sell hospitality packages?
The premium tier of World Cup fraud is particularly effective because high price points can still seem legitimate. But the FBI’s warning names hospitality packages explicitly as a target category. For example, Category 1 seats for the July 19 final at MetLife Stadium are listed at nearly $33,000, which is roughly three times the previous record for a World Cup ticket. This inflated pricing creates real demand for “competitive” premium alternatives.
Ghost Stadium, the threat actor behind the largest phishing network identified so far, focuses more than 300 of its active sites specifically on the premium and hospitality tier.
The delivery mechanism for this type of scam mirrors standard ticket fraud. The checkout process and confirmation email are convincing, Consumers don’t know they received a cloned or invalid QR code until they get to the venue. In some cases, buyers receive what appears to be a complete hospitality package confirmation with booking details and catering confirmations, only to find no reservation exists when they arrive.
How to protect yourself: The full list of authorized global sales agents is published at onlocationexp.com/fifaworldcup/sales-agents. If a seller isn’t on that list and can’t be verified through On Location directly, they have no legitimate connection to the official program. Packages can also be purchased at fifa.com/hospitality or by calling On Location at their customer service number.
Quick Facts: What do we know about travel for the World Cup?
In April 2026, Booking.com confirmed a data breach that exposed customer reservation details including names, email addresses, phone numbers, travel dates, and property specifics. Criminals are now using those real details to impersonate hotels and contact travelers requesting payment through external channels. Because the message includes accurate reservation information, it’s nearly indistinguishable from legitimate communication from the property.
Beyond that breach, the broader accommodation fraud patterns are consistent with what we see around any major international event. Scammers create short-term rental listings for properties they don’t control, using a real building as cover where no rental arrangement exists. Cloned hotel booking sites capture payment details and deposits before going dark. The Canadian Anti-Fraud Centre has flagged nonexistent short-term rentals as a specific category of active fraud around the tournament. Secondary host cities like Guadalajara and Monterrey, where inventory is tighter and international visitors are less familiar with local conditions, are expected to be particularly affected.
The FTC documented nearly 65,000 rental scam reports between January 2020 and June 2025, with a median loss per victim of $1,000 in ordinary conditions. A confirmed data breach combined with a global demand surge makes the current environment significantly harder to navigate.
In large host cities in the U.S., midrange hotels that normally run $150 to $250 per night are expected to reach $300 to $500 on match days, with budget options still running $120 to $200. This surge in pricing pushes fans toward unfamiliar listings and unverified sellers.
How to protect yourself: Book through accommodation sites with documented buyer protections and payment held in escrow until check-in (for example, Airbnb or Vrbo, or direct hotel bookings). Pay by credit card. If you receive a message requiring payment through an external channel (such as wire transfer or Zelle), do an independent search for the phone number instead of using the one provided in the message and call the property directly. The Booking.com breach means that a message containing accurate reservation details doesn’t necessarily prove it’s legitimate.
If accommodations in host cities are priced beyond your budget, consider staying in a nearby city and commuting to the game. For example, fans attending games in Santa Clara, California, can stay in neighboring cities such as San Jose or Campbell. If you’re following a team whose knockout stage location hasn’t been confirmed yet, search for bookings with flexible cancellation policies.
Quick Facts: Who is authorized to sell official merchandise?
U.S. Immigration and Customs Enforcement seized more than 276,000 counterfeit sports-related items valued at over $33 million last year. They have warned that similar activity will increase ahead of and throughout the World Cup event. But in addition to counterfeit jersey stores, SmartCustomer documented several more specific patterns outlined below.
Fake Panini sticker stores. Panini is the licensed producer of World Cup collectibles, including the official sticker album. Scammers have built lookalike Panini storefronts selling “official” pre-orders with countdowns and scarcity messaging. Some of these fakes contain obvious errors, such as “WordCup” instead of “World Cup,” while still replicating Panini’s branding convincingly enough to collect payment.
Quiz funnels using LEGO branding. Fake sites run quiz-style contests promising “exclusive edition World Cup rewards.” The quiz harvests contact information, then routes the consumer toward a subscription billing flow disguised as a shipping fee for the “prize.” LEGO doesn’t run quiz funnels; its World Cup activity runs through LEGO.com and physical retail stores.
Merchandise stores advertising discounts of 80% or more. Check Point identified a malicious domain (fifaofficialstore-dot-shop) that used professional design and FIFA’s official branding and advertising World Cup jerseys and souvenirs at “up to 80% off” with free shipping. This example serves as a reminder that suspiciously large discounts on “official” merchandise are likely a red flag.
How to protect yourself: Buy from the FIFA Store, Fanatics, or Adidas directly. Because official jerseys and merchandise have holographic licensing tags, look for those tags before purchasing anything. If you find a site you believe is fraudulent, report it at ic3.gov and reportfraud.ftc.gov.
Quick Facts: Do I need a World Cup visa?
Fans don’t need a special visa to attend the World Cup. However, at least one site has been actively running an offer for a “Visa to the World Cup 2026 U.S.” priced at nearly $300 per person that claims a “98% success rate” and uses trust signals such as “secure process” and “fast processing.” The site targets fans who may be unfamiliar with immigration requirements.
A match ticket or FIFA confirmation email doesn’t ensure permission to cross any border. Admissibility is always decided by border officers at the point of entry.
How to protect yourself: Apply for ESTA at esta.cbp.dhs.gov. Apply for Canadian eTA at canada.ca. Check U.S. entry requirements at travel.state.gov. Any third-party site selling a “World Cup Visa” or “Event Access Permit” is fraudulent. (Note: Legitimate visa assistance services exist, but they charge a service fee for help with compiling documents; they don’t promise help for securing non-existent visas or permits.) Don’t submit payment or personal data to any site presenting itself as issuing a special World Cup entry credential.
Quick Facts: What does FIFA actually have in crypto?
Crypto is currently the highest-volume scam category by number of active sites and involves two patterns.
The first pattern is explicit impersonation. Multiple sites are marketing tokens as “the official community token of the FIFA World Cup 2026” or using FIFA’s mascot and official branding to suggest a licensed connection. FIFA’s digital product ecosystem does include collectibles through the FIFA Collect NFT marketplace and Right-to-Buy ticket NFTs; however, they are within FIFA-controlled infrastructure.
The second pattern, though more openly speculative, can still be costly for consumers. Some projects don’t claim to be official products at all. They’re designed to capitalize on the excitement and momentum surrounding the tournament. In crypto, a “rug pull” refers to when early buyers sell and the price collapses, leaving later entrants with losses. Tournament excitement generates late-stage buyers and early holders profit at their expense. Regardless of whether the projects are pretending to be something they aren’t, they are deliberately designed so that most participants lose money.
Regardless of the pattern, all crypto transactions offer no chargeback mechanism once completed.
How to protect yourself: Treat any crypto project invoking World Cup branding as unverified until confirmed through FIFA’s official digital product pages at fifa.com. If it isn’t documented on that site, it’s not officially affiliated. Regardless of how they’re presented, highly speculative tokens are set up so that you are likely to lose money.
If you suspect you’ve been scammed, acting quickly matters. If you wait, the options available to you narrow significantly.
Contact your bank or card issuer immediately. If you paid by credit card, request a chargeback. Provide documentation, such as the confirmation you received or a payment record. Credit card chargebacks are your strongest recovery option. Wire transfers, cryptocurrency, Zelle, Venmo, and gift cards have extremely limited recovery windows or no recovery options at all.
File a complaint with the FBI at ic3.gov. The FBI’s Internet Crime Complaint Center specifically tracks organized fraud operations. When filing, include the fraudulent domain name, a description of what happened and what information you shared, and all financial transaction details including payment method, amount, account numbers, and any cryptocurrency addresses involved.
Report to the FTC at reportfraud.ftc.gov. FTC reports contribute to enforcement patterns and consumer protection databases. Most victims don’t report, which is exactly what allows these operations to continue across events and cycles. Reporting does not guarantee recovery, but it helps authorities identify and dismantle the responsible networks.
Report on every platform involved. If the scammer operated through a reseller, social media platforms, or other applications, use the in-app reporting function to flag the account for the platform’s trust and safety team.
Screenshot everything before taking any cleanup action. Collect documentation before any account changes or browser clearing in case you need it for a bank dispute or your IC3 filing.
If personal data was shared, act on that separately. Personal information submitted to a fake FIFA site, including passport details or home address, may be used for follow-up phishing or identity fraud. Monitor your financial accounts closely. If you submitted passport details, contact the relevant issuing authority for guidance. The FBI warned that personal data harvested through fake FIFA sites can be used to open new accounts in a victim’s name.
Fraudsters invest considerable time and resources into appearing legitimate and trustworthy, and increasingly elaborate scams tied to the 2026 World Cup have stripped away many of the visual cues people once relied upon. FIFA’s own recent ticket practices have also been called into question recently, which means that it’s increasingly difficult to determine whether a seller is legitimate and determine the fair price of an authentic ticket. Being vigilant and proactive, and preventing others from becoming targets by reporting fraud, will help ensure the World Cup season is a time of fun and camaraderie, not fraud.
This story was produced by SmartCustomer and reviewed and distributed by Stacker.