WASHINGTON (UNITED STATES) - Fraudsters are exploiting interest in the 2026 World Cup with a barrage of scams, as authorities and researchers caution against fake websites impersonating FIFA's official online presence to sell phantom tickets.
Controversy has already swirled around the football governing body's official ticketing for the largest-ever World Cup, which begins June 11 with an expanded 48-team format and 104 matches across the United States, Mexico and Canada.
As sky-high entry costs price many people out, malicious actors are capitalizing on desperate fans seeking bargains outside accredited channels, using techniques experts say represent a "new normal" for major events.
The FBI warned last week of three dozen websites -- with domains such as "fifa-ticket.live" and "fifaworldcup26.sale" -- posing as the authentic fifa.com to steal personal information or sell fake tickets and products.
Singapore-based cybersecurity firm Group-IB reported an even larger scale of deception, identifying more than 4,300 fraudulent domains posing as FIFA-affiliated that have registered since August, including over 300 operated by a single Chinese-speaking actor.
Many of the sites are dormant, researchers said, primed to activate as the competition nears.
"Scammers exploit fan excitement, limited ticket availability and the fear of missing out, knowing people may lower their guard when an opportunity feels exclusive or time-sensitive," Justin Miller, associate professor of practice of cyber studies at the University of Tulsa, told AFP.
"Cybercriminals follow attention, urgency and money, and the World Cup sits at the intersection of all three," Miller added, saying the lookalike sites show increasingly sophisticated cybercriminals consider it "easier to imitate trust than to break through security."
The sites closely resemble fifa.com, stamped with official branding of the World Cup and payment partner Visa. Complex interfaces let users browse match offerings, make selections and proceed through checkout.
AFP reviewed dozens of now-inactive Facebook ads, in multiple languages, directing users to scam ticket pages such as "fifa.house."
Romania-based cybersecurity company Bitdefender also said it found 55 football-related scam ad campaigns on Meta platforms, including promotions for phony collectibles and merchandise.
Meta has started deploying pop-up warnings when Facebook users search for tickets and said it dismantled a network linking to spoofed FIFA sites promoting "fake gambling content."
Some scam sites target job hunters, promising meetings with World Cup employees whose names and photos were lifted from LinkedIn.
"Someone is fraudulently using my name and photo," one staffer wrote on LinkedIn in April.
Offline fraud also appears to be rising. Toronto police said Monday they seized more than 16,000 fake football jerseys and flags, along with two counterfeit trophies.
Authorities in all three host countries have encouraged fans to purchase from verified sources, check web addresses and beware of splashy social media offers.
