FBI warns of fake FIFA websites running World Cup fraud schemes
Patch: Block known phishing domains via DNS filtering and educate users to avoid fake FIFA sites.
Patch: Block known phishing domains via DNS filtering and educate users to avoid fake FIFA sites.
Summary
FBI has issued a warning about a wave of fake FIFA websites that appeared ahead of the 2026 World Cup.
The phishing sites mimic fifa.com using subtle misspellings such as fiffa.com and employ a variety of top‑level domains (.org, .xyz, .live, .sale). They also use fake employment portals like jobs‑fifa.com and fifa‑hiring.com to lure visitors. According to Group‑IB and Bitdefender, the campaign includes more than 300 cloned sites that harvest names, addresses, phone numbers, and banking details for identity theft and ticket fraud. The fraudsters promote their portals through Google Search, Facebook ads, Telegram, and WhatsApp, targeting users in the US, Canada, Mexico, the UK, Portugal, Spain, Algeria, Brazil, Germany, and Australia. The FBI advises users to type fifa.com manually, avoid sponsored search ads, verify the .com TLD, use bookmarks, and never enter sensitive data on unverified sites. Victims are encouraged to report incidents to the FBI’s Internet Crime Complaint Center (IC3) with domain details and interaction logs.
Key changes
- Fake domains like fiffa.com, .org, .xyz, .live, .sale used
- 300+ cloned sites harvest names, addresses, phone numbers, banking details
- Fraud promoted through Google Search, Facebook ads, Telegram, WhatsApp
- Users advised to manually type fifa.com, avoid sponsored ads, verify .com TLD
- Report incidents to FBI IC3 with domain and interaction details
- Fake employment portals like jobs‑fifa.com, fifa‑hiring.com used
- Attack targets users in US, Canada, Mexico, UK, Portugal, Spain, Algeria, Brazil, Germany, Australia
- Advice to avoid entering sensitive data on unverified sites