The 2026 World Cup Starts in 10 Days and Cybercriminals Have Been Deploying Fake FIFA Websites for Weeks: How to Spot Them Before Losing Money and Data
Eric Serrano Bustos
Ten days remain until the 2026 World Cup kicks off — the biggest football tournament in history, with 48 teams and over 100 matches between 11 June and 19 July across the United States, Canada and Mexico — and cybercriminals have spent weeks preparing what may be the largest phishing operation ever tied to a sporting event. Cybersecurity company ESET has identified a network of fraudulent websites that replicate with near-perfect precision the design, menus, purchase flows and registration processes of the official FIFA website, with the goal of stealing personal data, passwords and banking information from fans searching for tickets, merchandise or anything related to the tournament. The difference in 2026 is the technical sophistication of the replicas and the speed at which new domains are being deployed. The FBI has issued specific alerts. SecurityWeek has named it one of the week’s top stories. And FIFA has officially reminded fans that the only authorised ticket sales platform is FIFA.com/tickets.
What is happening with the fake 2026 World Cup websites?
Facts documented by ESET, Escudo Digital, Infobae, SecurityWeek and FIFA’s official advisory:
ESET identified multiple fraudulent pages specifically designed to impersonate official FIFA websites or 2026 World Cup ticket sales platforms. They copy official colours, promotional photography, navigation menus, purchase forms and payment flows.
The detected domains incorporate keywords such as “FIFA”, “World Cup” or “Mundial 2026” alongside sales terms like “shop”, “store”, “tickets” or “official”, with suspicious extensions such as .shop, .store or .site instead of the official .com or .org. Industrial-scale typosquatting.
The objective is threefold: banking data theft (card number, expiry date, CVV) at the point of paying for a ticket or product that will never arrive; credential theft (email and password used on the fake portal, then reused across other services); and personal data harvesting (name, address, phone, passport or national ID) for use in future social engineering attacks or sale on the underground market.
Distribution channels are primarily social media (organic and paid posts), private messages on WhatsApp and Telegram, and phishing emails offering “last-minute tickets” or “official products at a discount.”
The FBI warned about the Kali365 phishing platform and World Cup-related campaigns targeting Microsoft 365 accounts via fake verification pages tied to the tournament.
FIFA confirmed that official 2026 World Cup tickets can only be purchased through FIFA.com/tickets. Any other channel is not official.
Why the 2026 World Cup is the biggest phishing hook of the year
Major sporting events always generate digital fraud campaigns. The 2026 World Cup has characteristics that make it the most powerful hook in recent memory:
The scale is unprecedented. 48 teams — versus 32 in previous editions — means almost half the world has a team in the tournament. The volume of fans searching for tickets, information and merchandise is global and massive.
Tickets are scarce and the urgency is real. 2026 World Cup tickets sold out in hours through official channels. That pushes millions of fans to search unofficial channels, dramatically lowering the scepticism threshold. A fan desperate to get a ticket for Spain’s match is in the optimal psychological state to fall victim to a scam.
The sophistication of the replicas surpasses previous editions. The fake sites of 2026 are not the crude clones of 2014 or 2018. They have valid HTTPS (an SSL certificate no longer means a site is legitimate), responsive design, payment forms that actually process the transaction (charging the amount but delivering no product), and even fake live chat support.
Social media distribution is massive and cheap. An attacker can reach tens of thousands of Spanish fans with a few euros of advertising spend on Meta Ads or TikTok, using creatives designed to look like organic FIFA posts.
How these scams work: from typosquatting to emotional social engineering
Mass registration of typosquatting domains. Attackers register dozens of domains including “FIFA”, “World Cup” or “2026” with small variations or low-credibility extensions (.shop, .store, .site). The cost is a few euros per domain and hundreds can be registered in hours.
Cloning the official website. Using scraping tools, attackers clone the complete design of FIFA.com or the official ticket sales site, including images, fonts, colours and menu structure. The result is visually indistinguishable for an untrained user.
Triggering the emotional hook. The fake page shows “tickets available” for the most in-demand matches (quarter-finals, semi-finals, Spain’s games), “special offer for the next 2 hours” or “last 10 tickets available.” Artificial urgency is the key element that stops the victim from carefully checking the URL.
Purchase form and data theft. The buying process is fully functional: the victim enters personal data (name, passport or national ID, address) and banking details (card, expiry date, CVV). Some sites even process a small real charge so the victim believes the purchase worked, while stealing card data for later use.
Post-exploitation. Stolen data is sold on the underground market, used in personalised follow-up social engineering attacks (“we’re calling about your World Cup ticket purchase”) or employed in direct financial fraud.
Key lessons for businesses: the risk is not just personal
World Cup 2026 scams may seem like a consumer problem. For businesses, the risk is greater than it appears:
Employees buy from corporate devices. An employee accessing a phishing site from their corporate laptop or phone can compromise corporate session cookies stored in the browser, VPN or SSO credentials saved in the browser’s password manager, and the device itself if the site includes a malware payload (drive-by download) alongside the purchase form.
Password reuse is the most common corporate entry vector. If an employee uses the same password on the fake World Cup site as on their corporate account — or if the browser’s password manager autofills corporate credentials on the phishing site — the attacker gains direct access to company systems. The 2026 DBIR we analysed yesterday confirms that compromised credentials remain one of the most prevalent entry vectors.
How to verify a site is legitimate before buying: check that the domain is exactly FIFA.com/tickets (not fifa-tickets.shop or world-cup-2026.store); verify that the SSL certificate belongs to FIFA (a padlock does not guarantee legitimacy, but the domain name in the certificate does); distrust any unofficial channel offering available tickets for sold-out matches; never access ticket purchase sites via a link on social media or private message — always typing the URL directly into the browser.
What to do if an employee has fallen for the scam from a corporate device: notify the security team immediately; urgently change all corporate passwords that may have been exposed; revoke active session tokens; analyse the device for malware; and if card data was compromised, notify the bank immediately to block the card.
Use the World Cup as an awareness opportunity. Major sporting events are the ideal time to reinforce phishing training. A World Cup-themed phishing simulation (sending employees an internal test with a fake ticket website) is one of the highest-impact exercises of the year.
Cybersecurity as a strategic priority
The 2026 World Cup phishing is not a new threat: it is the same social engineering as always, applied to the year’s biggest emotional urgency trigger. What changes in 2026 is the technical sophistication of the replicas and the speed of new domain deployment, driven by generative AI tools that allow attackers to create near-perfect websites in minutes. For businesses, the message is that awareness is not an annual event: it is a continuous process that must be activated especially when the social engineering surface expands — and the start of the 2026 World Cup is exactly that moment.
Apolo Cybersecurity: awareness, simulations and protection against themed phishing
At Apolo Cybersecurity we help businesses protect their employees and systems against themed phishing campaigns like those of the 2026 World Cup: customised phishing simulations with highly relevant current scenarios (tickets, giveaways, merchandise), practical training in detecting fake domains and typosquatting, DNS and browsing filter configuration to block known phishing domains, monitoring of corporate credentials on the underground market, and incident response when an employee falls for a trap from a corporate device.
If your company has employees passionate about football — and almost all do — the next 50 days are the highest phishing risk period of the year. It is the moment to remind them that the only official ticket website is FIFA.com/tickets. And to verify that if someone falls for the trap from a corporate device, you have the protocol to contain it.
%402x.svg){kind=icon}
