As excitement builds ahead of the 2026 FIFA World Cup, cybercriminals are creating fake FIFA websites to steal personal information and sell fraudulent tickets, prompting the FBI to issue a warning. In a public service announcement issued on May 27, the agency said threat actors are conducting spoofing attacks against FIFA-related websites by creating lookalike domains that mimic the official FIFA website.“The FBI has identified actors engaging in this activity to collect personal information, sell fake World Cup tickets and hospitality products, and to possibly facilitate other malicious activity,” the agency said. According to the FBI, the legitimate FIFA website is hosted at fifa.com. However, scammers have registered numerous domain variations, including fifa-com[.]com and jobs-fifa[.]com, to trick users into believing they are interacting with official FIFA services.FBI detected thousands of fake FIFA domainsThe scale of the campaign appears to be significant. Cybersecurity firm Group-IB said it has identified more than 4,300 fraudulent domains impersonating FIFA’s official web presence since August 2025. The company also reported that a Chinese-speaking scam group was linked to more than 300 of the domains. The operation allegedly uses a “pixel-perfect clone of the official FIFA website, complete with a replicated single sign-on (SSO) authentication flow, and multi-language support in 11 languages.”According to Group-IB, the fraudulent websites have been promoted through Facebook advertisements and fake World Cup ticket offers to attract potential victims. The FBI said attackers often use a tactic known as typo squatting, where domains contain minor spelling changes or alternative domain extensions to imitate legitimate websites.“This form of cyberattack — called typo squatting — relies on Internet users making mistakes, such as common typos, when visiting a URL. Threat actors may also register illegitimate websites such as jobs-fifa[.]com to impersonate legitimate subdomains," the FBI added.List of Fake FIFA websites identified by the FBIThe agency has identified dozens of suspicious domains impersonating FIFA, including:fifa[.]cabfifa[.]pinkfifa[.]bluefifa[.]pubFIFA[.]cityFifa[.]biofifa[.]beerfifa[.]clickfifa[.]camfifa[.]ceofifa[.]helpfilfa[.]orgfifa-online[.]comfifa-2026[.]xyzjobs-fifa[.]comfifa-hr[.]comfifa-careerhub[.]comfifaworldcup-careers[.]comfifa-hiring[.]comfifahiring[.]comfifa-ticket[.]livefifastore.us[.]comfifaworldcup26[.]salefifaworldcup26.xcover-staging[.]comworldcup2026-tickets.com[.]mxworldcup26ticket[.]com2026fifaworldcuptickets[.]onlinefwc2026[.]netfwc2026.web[.]appfifa2026p[.]comfifa2026fworldcup[.]comwvvw-fifa[.]comww-fifa[.]comfifa-com[.]comfifa-com[.]servicesquiniela-fifa-2026.pages[.]devThe FBI warned that additional fake websites are likely to appear before and during the tournament.FBI advises caution when searching for FIFA websitesTo reduce the risk of fraud, the FBI recommends typing fifa.com directly into a browser’s address bar instead of relying on search engine results.The agency also advised users to avoid clicking on sponsored search results, which could lead to imitation websites.“If using a search engine, avoid any ‘sponsored’ results as these can be paid imitators looking to deter traffic from the legitimate FIFA website,” the FBI noted in its warning.Others include using bookmarks to visit official websites, ensuring URLs end in “.com”, avoiding dubious links or advertisements and never sharing sensitive information unless the legitimacy of a website is confirmed.Victims of these scams or those who suffer financial losses should report the incident to the FBI through its Internet Crime Complaint Center (IC3) and provide as much information as possible, including the fake website, any personal information provided and payment-related information when applicable.