World Cup Ticket and Streaming Scams: 2026 Lessons

The short answer

Buy World Cup 2026 tickets only through FIFA.com/tickets or FIFA's official Ticket Exchange Marketplace — FIFA says any other source is unofficial and carries the risk of fraud and invalid tickets. Type www.fifa.com into your address bar by hand; never arrive via an ad, a search result, a social-media post or an email link. The FBI warned on 27 May 2026 of spoofed FIFA domains, fake ticket portals, fraudulent merchandise stores and lottery "you've been selected" emails, and researchers reported more than 4,300 fake FIFA domains — including a pixel-perfect clone with a fake login. Pay by card (for chargeback rights), check the exact domain spelling, and if you already paid a scammer, call your bank to dispute the charge immediately and report it to the FBI's IC3 or your national authority.

The ticket checkout is on the wrong site. Illustrative fake ticket-store composite based on the FBI’s May 2026 warning. The domain, price and availability are fictional. — **The ticket checkout is on the wrong site.** Illustrative fake ticket-store composite based on the FBI’s May 2026 warning. The domain, price and availability are fictional. View the source. Open full-size image.Illustration added 6 October 2026.

Update, 17 October 2026. The tournament ended on 19 July 2026. We have kept this guide, and merged our separate piece on free-stream malware into it, because the same plays return for every major event: a final, a Super Bowl, the 2028 Olympics. Swap in the event's official ticket seller and its licensed broadcaster, and every rule below still applies.

Update · 11 June 2026 — kickoff day

The tournament is now live, and the fraud went live with it. Three threats have escalated since the FBI's warning. (1) A fake "World Cup Visa." Scammers invented a tournament "visa" and charge a processing fee — there is no such document; entry runs through the normal US, Canadian or Mexican visa and ESTA/eTA channels. (2) Malware inside "free stream" apps. Before kickoff, Kaspersky warned that fake IPTV streaming apps had already been used in 2026 to spread the Massiv and Perseus Android banking trojans. See the streaming section below. (3) "Evil twin" Wi-Fi in host cities. A Kaspersky wardriving study of the three Mexican host cities found 10% to 12% of Wi-Fi access points open, with no password: easy cover for rogue hotspots that read what you type. The single rule below still beats all of it.

The 2026 FIFA World Cup runs from 11 June to 19 July across 16 host cities in the United States, Canada and Mexico — the biggest edition ever, and the most heavily targeted by fraud. Demand for tickets, travel and merchandise vastly outstrips supply, and that gap is exactly what scammers monetise. This is a fast guide to staying on the right side of it.

If you think you have already paid a scammer, skip to if you already paid. Speed is what gives a chargeback a chance.

What the FBI actually warned about

On 27 May 2026 the FBI issued a public warning to World Cup fans. According to the bureau, fraudsters are running:

—Spoofed FIFA websites and fake ticket portals. Lookalike domains that copy FIFA's branding and harvest your card details or login when you try to 'buy' a ticket.

—Fraudulent merchandise stores. Fake shops selling official-looking kits and souvenirs that either never arrive or exist only to capture payment details.

—Lottery and 'you've been selected' email scams. Messages congratulating you on winning tickets or early access, linking to a fraudulent booking page that asks for payment or personal data.

—Job and hospitality scams around the tournament. Fake roles and hospitality packages tied to the event, designed to extract fees or identity documents.

What makes 2026 different is the quality of the fakes. Security researchers tracking the campaign reported more than 4,300 fraudulent domains impersonating FIFA, some dormant since 2025 and switched on as the tournament neared, with premium-ticket fraud losses estimated between roughly $71 million and $474 million. One operation researchers named "GHOST STADIUM" ran across hundreds of domains with a pixel-perfect replica of the official FIFA site — including a fake single sign-on login and support in 11 languages. The lesson is blunt: you cannot reliably tell a fake by looking at it, so the defence has to be about the route you took to get there, not how the page appears.

The one rule that beats all of it

Every safe path collapses to a single habit: buy only through FIFA.com/tickets or FIFA's official Ticket Exchange, and get there by typing the address yourself.

FIFA could not be clearer on this. It says any ticket purchased from a source other than FIFA.com/tickets is from an unofficial channel and carries the risk of fraud, scams and invalid tickets, and that its own Ticket Exchange Marketplace is the only verified secondary market — resales there carry the same protections as buying direct. Everything else — the ad, the search result, the social post, the email — is a route a scammer can intercept. Type www.fifa.com into the address bar by hand and you sidestep the entire 4,300-domain forest in one move.

How to spot the fakes

Since you cannot trust appearance, trust these signals instead:

—Check the exact domain spelling. The official site is fifa.com — no hyphens, no extra words, no unusual ending. 'fifa-tickets-2026,' 'fifaworldcup-tickets,' or a country code bolted on are fakes. Read it character by character.

—Distrust the route, not the look. Did you type the address, or did you arrive via a Google ad, a Facebook or Telegram post, or an email link? Pixel-perfect clones look real — the route is the tell.

—Treat urgency as a weapon. 'Only 3 tickets left,' 'sale ends tonight,' 'final allocation' — manufactured urgency is there to stop you checking. Real official sales do not need to panic you.

—Be suspicious of any 'you won' or 'you've been selected' message. FIFA does not award tickets by surprise email. A congratulations message linking to a booking page is the lottery-scam pattern the FBI named directly.

—A discount on a sold-out match is the bait. If a match is gone on the official site but a stranger offers it cheap, the scarcity is the hook — not a lucky find.

If you already paid: the first moves

If a ticket, package or merch order has turned out to be fake, act in this order:

1Call your bank or card issuer now, report it as fraud, and ask to dispute or reverse the charge. A card payment carries chargeback rights; freeze the card if you entered its details on the fake site.

2Change the password on any account where you logged in through the fake page — and anywhere you reused it — and turn on two-factor authentication. Phishing ticket sites harvest logins as well as card numbers.

3Save the evidence: the URL, screenshots of the listing and messages, the confirmation email, and the payment details. You will need it for the bank and the police report.

4Report it — to the FBI's IC3 at ic3.gov in the US, to Report Fraud in the UK, or to your national police and consumer authority elsewhere. Our international reporting directory lists where to go by country.

5Read the honest recovery odds by payment method so you know what realistically works — a card chargeback is your strongest lever; a bank transfer, crypto or gift card is far harder to reverse.

6Ignore anyone who then contacts you promising to recover your money for a fee. That is the second scam — we cover the pattern in the recovery-scams piece.

The payment method decides your odds. Scammers push fans toward bank transfers, cryptocurrency, gift cards and peer-to-peer apps precisely because those are hard or impossible to claw back. A debit or credit card is the one method that gives you a real chargeback route. If a "seller" — especially one you met on social media — insists on anything other than a card through an official checkout, that insistence is the scam revealing itself.

Free streams: the same play, aimed at your phone

Tickets are one half of an event scam. The other half is the search for a free way to watch. Ahead of the tournament, Kaspersky warned that fake IPTV streaming apps had already been used earlier in 2026 to spread two Android banking trojans. Researchers found Massiv disguised as IPTV apps in February, mostly targeting users in Portugal, Spain, France and Türkiye. In March they reported a campaign spreading Perseus, which is built on the leaked code of an older trojan called Cerberus.

The fake apps usually showed no football at all; some opened a real IPTV site in a built-in browser so nothing looked wrong. Behind that screen, Kaspersky lists what the malware could do:

—Lay fake windows over real ones. Massiv showed fake forms for bank details or official sign-ins on top of legitimate apps.

—Log what you type. Keyboard taps were recorded and sent to the attackers.

—Take over the phone. Perseus abuses Android's Accessibility Services to capture screenshots, tap, swipe, type, launch apps and hide its activity behind a black overlay.

—Search your notes. The English-language version of Perseus hunts note-taking apps such as Google Keep, Samsung Notes, Evernote and OneNote for passwords, recovery phrases and financial data.

Ask one question of that list: what does a video player need any of it for? Nothing. Pirate streaming apps are blocked from the official app stores, so the scam's first job is to get you to install a file from a third-party site. If watching requires an APK download, switching on "install unknown apps" or giving a player Accessibility access, the answer is no. Watch through the licensed broadcaster in your country, using its own app from the official store or its website typed by hand.

If you already installed one: put the phone in airplane mode and remove the app (boot into safe mode, or factory-reset the phone if it resists). Then, from a different trusted device, change your banking, email and crypto passwords and call your bank. If the phone held a crypto recovery phrase in a notes app, treat that phrase as stolen and move the funds to a new wallet. Report it as you would any fraud, and ignore anyone who offers to recover the money for a fee.

Beyond tickets: the other tournament scams

The fraud around a global event is broader than fake tickets. Watch for these too:

—Fake merchandise and streaming sites. Counterfeit-kit shops and "free live stream" pages that harvest card details or install malware. Fake streaming apps have been used to spread Android banking trojans. Buy merch from official stores; watch through licensed broadcasters.

—Travel and accommodation fraud. Non-existent rentals and "sold-out hotel" deals near host cities, paid by transfer. Book through reputable platforms with buyer protection and pay by card — but stay alert even after you book: following a 2026 data breach, scammers are messaging real guests with their genuine reservation details in the Booking.com hotel scam.

—Smishing texts piggybacking on the event. Fake 'delivery,' 'visa,' or 'fan ID' texts ride the same playbook as the package and toll scams we broke down in the USPS-text piece — a small 'fee' is bait for your card.

—Host-country reporting. If you are caught out while travelling, report locally too — see our guides for Canada and the full international directory.

If you are unsure whether a ticket offer or site is genuine before you pay, the fastest second opinion is the Scam Checker on this site, or our free case review. Both are read by a human and answered within 24 hours.

From the field. The cruelty of an event like this is that the urgency is real — the match is on a fixed date, the tickets do sell out, and a fan genuinely is racing the clock. Scammers don't manufacture that pressure; they borrow it. That is why the only durable defence is mechanical, not emotional: one official source, one address typed by hand, one payment method with a chargeback. Decide that before you start searching, and the pixel-perfect clone never gets a turn.

One rule, end to end

If you take one habit from this piece, take this: buy tickets only by typing www.fifa.com yourself and paying by card — never from an ad, a social post, an email link, or a stranger asking for a transfer. The fakes are too good to spot by eye, so don't try; control the route instead, and the whole 4,300-domain operation has nothing to catch you with.

Not sure if that ticket site is real? Send it to us before you pay.

Paste the link, the message, the offer. A real expert reviews every case and replies within 24 hours. Free, confidential, no pressure.

Submit a free case review →Full international reporting directory

Common questions about World Cup 2026 ticket scams

Are free streaming apps safe to install for big matches?

Treat any app that promises free live sport and has to be installed from outside the official app stores as hostile. Before the 2026 World Cup, Kaspersky warned that fake IPTV streaming apps had already been used that year to spread the Massiv and Perseus Android banking trojans, which can lay fake bank forms over real apps, log what you type, take control of the phone through Accessibility Services and search note-taking apps for passwords and crypto recovery phrases. Watch through the licensed broadcaster's own app or website instead.

Where is the only safe place to buy World Cup 2026 tickets?

FIFA's official ticketing site, FIFA.com/tickets, and FIFA's own Ticket Exchange Marketplace — the only verified secondary market, where resale purchases carry the same protections as buying direct. FIFA states plainly that any ticket bought outside FIFA.com/tickets is from an unofficial channel and carries the risk of fraud, scams and invalid tickets. Type www.fifa.com directly into your address bar rather than clicking a search result or an ad, because attackers buy ads and lookalike domains to intercept exactly that search. If a deal reaches you through Facebook, Instagram, Telegram or an unsolicited email, treat it as a scam no matter how convincing it looks.

What did the FBI warn about for the 2026 World Cup?

On 27 May 2026 the FBI issued a public warning that fraudsters are targeting World Cup fans with spoofed FIFA domains, fake ticket portals, fraudulent merchandise stores and lottery or 'you've been selected' email scams. The bureau urged fans to buy only through official channels and to verify the exact web address before entering any payment or login details. The warning came as the tournament — running 11 June to 19 July 2026 across the United States, Canada and Mexico — drives enormous global demand that scammers are built to exploit.

How big is the World Cup 2026 scam problem?

Large, and industrialised. Security researchers tracking the campaign reported more than 4,300 fraudulent domains impersonating FIFA, some sitting dormant since 2025 and activated as the tournament approached, with estimates of premium-ticket fraud losses ranging from roughly $71 million to $474 million. One operation researchers named 'GHOST STADIUM' ran a phishing network across hundreds of domains with a pixel-perfect replica of the official FIFA site, including a fake single sign-on login and support in 11 languages. These figures come from the security firms and reporters covering the campaign; the scale is why the only reliable defence is buying through official channels, not judging a site by how real it looks.

I think I bought a fake World Cup ticket — what do I do now?

Move fast. Call your bank or card issuer immediately, report it as fraud, and ask to dispute the charge — a card payment gives you chargeback rights that a bank transfer, crypto or gift card does not. Change the password on any account where you entered credentials on the fake site, and turn on two-factor authentication. Report it: to the FBI's IC3 (ic3.gov) in the US, to Report Fraud in the UK, or to your national police and consumer authority elsewhere. Keep every screenshot, email and receipt. And ignore anyone who then contacts you promising to 'recover' your money for a fee — that is the second scam.

How do I tell a fake FIFA ticket site from the real one?

You often can't tell by looks alone — that is the whole point of a pixel-perfect clone. So judge the route, not the appearance: did you type www.fifa.com yourself, or did you arrive via an ad, a search result, a social post or an email link? Check the exact domain spelling — the official site is fifa.com with no hyphens, no extra words and no unusual ending; lookalikes use small misspellings or add words like 'tickets-fifa' or 'fifa-2026.' Be suspicious of any urgency ('only 3 left,' 'sale ends tonight'), any 'congratulations, you've been selected' email, and any discount on a sold-out match. When in doubt, leave and re-type the address by hand.

Sources & further reading

Claims in this piece are attributed to these sources. Click any of them to verify.

World Cup 2026 ticket and streaming scams: the tournament is over. The playbook is not.