More than 270,000 login credentials tied to World Cup ticketing and fan platforms have already been compromised, according to mobile security firm Zimperium, whose findings were published by security company Proton.
The tournament has over two weeks to go, and fans still hunting for last minute seats are facing the same fraud tactics that have already caught thousands off guard.
The FBI’s Internet Crime Complaint Center issued a public advisory on May 27 warning that cybercriminals were spoofing FIFA websites to steal personal information and sell fake tickets. Named PSA I-052726, the advisory named 36 specific spoofed FIFA domains, including typosquat variants and fake employment portals.
Fake Domains Have Multiplied Since January
Fortinet’s FortiGuard Labs have recorded more than 13,000 domains referencing the FIFA World Cup 2026 registered between January and May. These domains were mostly designed to resemble legitimate ticketing or hospitality pages, and the kind of volume gives scammers a wide net to catch fans still searching for tickets as the tournament heads into its final weeks.
CBS Miami has also reported that the Better Business Bureau’s Scam Tracker has logged at least 15 alleged schemes tied to World Cup ticket sales. Brokers described sellers who open with a convincing offer, then push buyers toward payments outside protected checkout systems. Once a buyer pays through a direct transfer app, cryptocurrency or wire transfer, recovering the money becomes difficult.
High Prices Are Pushing Fans Toward Risky Sellers
FIFA introduced dynamic pricing for this tournament, and the cheapest seats for some United States matches have hovered near $2,000, according to Financial Times reporting. This has also led to a shortage of affordable tickets, further pushing some buyers toward secondary markets, where the highest listings have cleared $2 million.
How to Buy Safely for the Rest of the Tournament
FIFA remains the only authorized source for World Cup tickets, sold through fifa.com/tickets and the FIFA app. The FBI recommends typing that address directly into a browser rather than clicking a search ad or social media link, since malicious ads can redirect users to a spoofed page that looks identical to the real one.
Tickets are delivered digitally through the FIFA app, so a paper ticket or screenshot offered by a private seller is a warning sign. Meta has also introduced pop up notifications on Facebook for users searching World Cup ticket terms, pointing them toward verified sources.
In addition, the Federal Trade Commission is asking anyone targeted by a ticket scam to file a report at reportfraud.ftc.gov, a step officials say helps investigators track new schemes as the tournament continues toward its July 19 final.
