The FBI recently issued a Public Service Announcement warning that threat actors are creating fraudulent versions of FIFA-affiliated websites to steal personal information, conduct financial fraud, and sell fake products and services. Researchers at Cyble independently reviewed the FIFA domains identified by the FBI and confirmed that many remained active at the time of analysis.
With 48 teams competing across 16 host cities in the United States, Canada, and Mexico, the tournament is expected to attract billions of viewers worldwide, making it an attractive target for cybercriminal activity.
Fake FIFA Domains and Typosquatting Attacks
According to the FBI, attackers are building websites that closely resemble FIFA’s official platform, www.fifa.com. These sites are designed to collect personally identifiable information (PII), including names, addresses, email accounts, banking information, and payment card details.
Many of these operations rely on a typosquatting attack, a technique in which criminals register lookalike FIFA domains featuring slight spelling changes, missing characters, or alternative extensions. Examples identified by the FBI include fifa[.]help, fifa-online[.]com, jobs-fifa[.]com, fifa-ticket[.]live, fifa-hiring[.]com, and ww-fifa[.]com.
Cyble researchers noted that malicious FIFA domains often reappear quickly after takedowns, indicating a continuously evolving fraud infrastructure rather than isolated campaigns.
Ticket, Hospitality, and Recruitment Fraud
One of the most convincing examples analyzed by researchers was ww-fifa[.]com, a typosquatting attack that removes a single "w" from the legitimate FIFA address. The site presented itself as an official FIFA World Cup 2026 portal and promoted premium hospitality packages that allegedly included tickets, food, beverages, lounge access, and other services.
Researchers identified several red flags, including broken images, duplicate page titles, suspicious navigation links, and requests for personal and financial information through illegitimate payment forms.
Cyble also uncovered employment-related FIFA World Cup 2026 scams. The domain fifaworldcup-careers[.]com impersonated a FIFA recruitment portal offering World Cup-related positions. VirusTotal data showed that the website was flagged by 8 of 91 security vendors, while the root domain was flagged by 14 of 91 vendors.
[caption id="" align="aligncenter" width="936"]
Fake FIFA 2026 domain scoring (Source: Cyble)[/caption]WHOIS records revealed that the domain was registered and updated in April 2026, with the registrant's identity hidden behind privacy protection services. Researchers also found two SSL certificates issued on April 15 and April 16, including a wildcard certificate covering subdomains.
How Fans Can Stay Safe
The FBI advises users to type www.fifa.com directly into their browser rather than relying on search engine results, sponsored advertisements, or links received through messages. Users should verify URLs carefully, save official pages as bookmarks, and avoid sharing sensitive information unless a site's legitimacy has been independently confirmed.
The agency also warns that fraudulent streaming platforms are likely to increase as the tournament approaches. Fans should rely only on official FIFA channels and licensed broadcasters when searching for FIFA World Cup 2026 content.
Anyone who encounters a suspected scam should preserve screenshots, domain information, communication records, and payment details before reporting the incident to the Internet Crime Complaint Center (IC3). With FIFA World Cup 2026 scams already active and new FIFA domains appearing regularly, experts warn that vigilance will be critical throughout the tournament period.