The 2026 FIFA World Cup is the largest sporting event ever staged: 48 teams, 104 matches, 16 host cities across the United States, Canada, and Mexico, and tens of millions of fans hunting for tickets, travel, and places to watch. Somewhere north of a month of nonstop, high-emotion, high-dollar demand.

For scammers, that’s not a tournament. That’s a harvest.

With group-stage drama in full swing and the knockout rounds approaching, fraud fighters are seeing exactly what the FBI warned about on the eve of the tournament — and a few things it didn’t.

The FBI’s Warning: FIFA Itself Is Being Spoofed

The scam wave starts with the official website — or rather, dozens of convincing copies of it. In a public service announcement, the FBI’s Internet Crime Complaint Center warned that cyber threat actors are conducting spoofing attacks against FIFA’s website ahead of and during the tournament. The Bureau says it has identified at least 36 fraudulent domains impersonating fifa.com, and expects more to appear as the tournament progresses.

The fakes rely on typosquatting — tiny alterations that a hurried fan won’t notice. One flagged trick: replacing “www” with “wvvw,” so the address reads wvvw.fifa.com at a glance. Others swap letters, add hyphens, or use lookalike top-level domains. The spoofed sites exist to collect names, home addresses, phone numbers, email addresses, and banking information — and to sell World Cup tickets and hospitality products that will never scan at a stadium gate.

The FBI’s advice is blunt: type fifa.com directly into your browser’s address bar rather than arriving through a search engine, and treat “sponsored” search results with particular suspicion, since scammers buy ads to park their imitations above the real thing.

The Ticket Trap

Ticket fraud is the tournament’s signature scam, because desperation does the selling. Matches involving the host nations, Brazil, Argentina, and England sold out instantly, pushing fans to secondary markets — where fraudsters are waiting with screenshots of tickets they don’t own, QR codes copied from someone else’s phone, and “a friend who works at FIFA.”

The patterns to know:

  • Fake resale listings on social media, Craigslist, and fan forums demand payment by Zelle, Venmo, wire, crypto, or gift cards — methods with no buyer protection. Once paid, the seller vanishes or sends a doctored PDF.
  • Phantom hospitality packages mimic FIFA’s official hospitality program, complete with glossy brochures and cloned branding, at “20% off face value.” Legitimate hospitality is sold only through FIFA’s designated provider.
  • Duplicate mobile tickets get sold to multiple buyers; the first person through the turnstile wins, and everyone else is out hundreds or thousands of dollars.

FIFA’s ticketing for 2026 is digital and app-based, which means a screenshot or printout offered by a stranger is close to worthless by design. If a ticket isn’t transferred through FIFA’s official app or purchased via fifa.com/tickets or authorized resale, assume it doesn’t exist.

Streams, QR Codes, and the Rest of the Playbook

Not going to a match? Scammers have a product for you too. Security researchers tracking the tournament have catalogued a supporting cast of fraud:

  • Fake streaming sites promise free HD coverage of every match, then demand a credit card for “verification,” push malware-laden “player updates,” or run credential-phishing overlays styled as broadcaster logins. Real matches are on the official rights holders in your country — in the U.S., that’s the licensed networks and their apps, not a URL from a Telegram group.
  • Malicious QR codes on flyers, stickers, and “free Wi-Fi” posters near stadiums and fan fests redirect to phishing pages. Treat public QR codes in host cities the way you’d treat a USB stick found in a parking lot.
  • Impersonation phishing — emails and texts claiming to be FIFA, ticketing partners, airlines, or hotels reporting a “problem with your booking.” The World Cup edition of the classic travel scam, arriving exactly when you have a booking to worry about.
  • AI-generated promotions — deepfaked footballers and broadcasters endorsing giveaway contests and crypto “fan tokens.” If a video of a star player is offering you free money, it’s neither the player nor free.

Why This World Cup Is Different

Scale, digital tickets, and three host countries make 2026 uniquely scammable. More matches means more inventory to counterfeit. Digital-only ticketing means fans unfamiliar with the official app can be talked into fake “transfer” workflows. And with games across three countries, cross-border travel bookings multiply the surface for fake accommodation listings, visa “processing services,” and airline impersonation. Add the FIFA-spoofing infrastructure the FBI flagged, and every stage of the fan journey — buy, book, travel, watch — has a counterfeit version running in parallel.

Protecting Yourself

The World Cup runs through July 19 — plenty of tournament left, and plenty of time to lose money if you rush. The rules:

  • Buy tickets only through fifa.com/tickets or FIFA’s official app, typed directly into your browser. No sponsored links, no third-party “agents,” no social media sellers.
  • Check the URL character by character. Watch for wvvw-style tricks, misspellings, and anything that doesn’t end in the legitimate domain.
  • Pay with a credit card whenever you buy anything tournament-related. Zelle, wire transfers, crypto, and gift cards are the fraudster’s payment rails of choice because they’re irreversible.
  • Stream only through official rights holders. Free-stream sites are phishing and malware delivery systems with a scoreboard.
  • Don’t scan random QR codes in host cities, and verify “booking problem” messages by contacting the airline or hotel through the number on their official site.
  • Report it. U.S. victims should file with the FBI at ic3.gov and the FTC at reportfraud.ftc.gov; reports are how spoofed domains get found and seized.

The beautiful game deserves better than an ugly aftermath. Slow down, type the address yourself, and make the scammers watch from outside the stadium.