World Cup 2026 Ticket Scams — FBI Warning & How to Buy Safely

The short answer

Buy World Cup 2026 tickets only through FIFA.com/tickets or FIFA's official Ticket Exchange Marketplace — FIFA says any other source is unofficial and carries the risk of fraud and invalid tickets. Type www.fifa.com into your address bar by hand; never arrive via an ad, a search result, a social-media post or an email link. The FBI warned on 27 May 2026 of spoofed FIFA domains, fake ticket portals, fraudulent merchandise stores and lottery "you've been selected" emails, and researchers reported more than 4,300 fake FIFA domains — including a pixel-perfect clone with a fake login. Pay by card (for chargeback rights), check the exact domain spelling, and if you already paid a scammer, call your bank to dispute the charge immediately and report it to the FBI's IC3 or your national authority.

The 2026 FIFA World Cup runs from 11 June to 19 July across 16 host cities in the United States, Canada and Mexico — the biggest edition ever, and the most heavily targeted by fraud. Demand for tickets, travel and merchandise vastly outstrips supply, and that gap is exactly what scammers monetise. This is a fast guide to staying on the right side of it.

If you think you have already paid a scammer, skip to if you already paid. Speed is what gives a chargeback a chance.

What the FBI actually warned about

On 27 May 2026 the FBI issued a public warning to World Cup fans. According to the bureau, fraudsters are running:

—Spoofed FIFA websites and fake ticket portals. Lookalike domains that copy FIFA's branding and harvest your card details or login when you try to 'buy' a ticket.

—Fraudulent merchandise stores. Fake shops selling official-looking kits and souvenirs that either never arrive or exist only to capture payment details.

—Lottery and 'you've been selected' email scams. Messages congratulating you on winning tickets or early access, linking to a fraudulent booking page that asks for payment or personal data.

—Job and hospitality scams around the tournament. Fake roles and hospitality packages tied to the event, designed to extract fees or identity documents.

What makes 2026 different is the quality of the fakes. Security researchers tracking the campaign reported more than 4,300 fraudulent domains impersonating FIFA, some dormant since 2025 and switched on as the tournament neared, with premium-ticket fraud losses estimated between roughly $71 million and $474 million. One operation researchers named "GHOST STADIUM" ran across hundreds of domains with a pixel-perfect replica of the official FIFA site — including a fake single sign-on login and support in 11 languages. The lesson is blunt: you cannot reliably tell a fake by looking at it, so the defence has to be about the route you took to get there, not how the page appears.

The one rule that beats all of it

Every safe path collapses to a single habit: buy only through FIFA.com/tickets or FIFA's official Ticket Exchange, and get there by typing the address yourself.

FIFA could not be clearer on this. It says any ticket purchased from a source other than FIFA.com/tickets is from an unofficial channel and carries the risk of fraud, scams and invalid tickets, and that its own Ticket Exchange Marketplace is the only verified secondary market — resales there carry the same protections as buying direct. Everything else — the ad, the search result, the social post, the email — is a route a scammer can intercept. Type www.fifa.com into the address bar by hand and you sidestep the entire 4,300-domain forest in one move.

How to spot the fakes

Since you cannot trust appearance, trust these signals instead:

—Check the exact domain spelling. The official site is fifa.com — no hyphens, no extra words, no unusual ending. 'fifa-tickets-2026,' 'fifaworldcup-tickets,' or a country code bolted on are fakes. Read it character by character.

—Distrust the route, not the look. Did you type the address, or did you arrive via a Google ad, a Facebook or Telegram post, or an email link? Pixel-perfect clones look real — the route is the tell.

—Treat urgency as a weapon. 'Only 3 tickets left,' 'sale ends tonight,' 'final allocation' — manufactured urgency is there to stop you checking. Real official sales do not need to panic you.

—Be suspicious of any 'you won' or 'you've been selected' message. FIFA does not award tickets by surprise email. A congratulations message linking to a booking page is the lottery-scam pattern the FBI named directly.

—A discount on a sold-out match is the bait. If a match is gone on the official site but a stranger offers it cheap, the scarcity is the hook — not a lucky find.

If you already paid — the first moves

If a ticket, package or merch order has turned out to be fake, act in this order:

1Call your bank or card issuer now, report it as fraud, and ask to dispute or reverse the charge. A card payment carries chargeback rights; freeze the card if you entered its details on the fake site.

2Change the password on any account where you logged in through the fake page — and anywhere you reused it — and turn on two-factor authentication. Phishing ticket sites harvest logins as well as card numbers.

3Save the evidence: the URL, screenshots of the listing and messages, the confirmation email, and the payment details. You will need it for the bank and the police report.

4Report it — to the FBI's IC3 at ic3.gov in the US, to Action Fraud in the UK, or to your national police and consumer authority elsewhere. Our international reporting directory lists where to go by country.

5Read the honest recovery odds by payment method so you know what realistically works — a card chargeback is your strongest lever; a bank transfer, crypto or gift card is far harder to reverse.

6Ignore anyone who then contacts you promising to recover your money for a fee. That is the second scam — we cover the pattern in the recovery-scams piece.

The payment method decides your odds. Scammers push fans toward bank transfers, cryptocurrency, gift cards and peer-to-peer apps precisely because those are hard or impossible to claw back. A debit or credit card is the one method that gives you a real chargeback route. If a "seller" — especially one you met on social media — insists on anything other than a card through an official checkout, that insistence is the scam revealing itself.

Beyond tickets: the other tournament scams

The fraud around a global event is broader than fake tickets. Watch for these too:

—Fake merchandise and streaming sites. Counterfeit-kit shops and 'free live stream' pages that harvest card details or install malware. Buy merch from official club and FIFA stores; watch matches through licensed broadcasters.

—Travel and accommodation fraud. Non-existent rentals and 'sold-out hotel' deals near host cities, paid by transfer. Book through reputable platforms with buyer protection and pay by card.

—Smishing texts piggybacking on the event. Fake 'delivery,' 'visa,' or 'fan ID' texts ride the same playbook as the package and toll scams we broke down in the USPS-text piece — a small 'fee' is bait for your card.

—Host-country reporting. If you are caught out while travelling, report locally too — see our guides for Canada and the full international directory.

If you are unsure whether a ticket offer or site is genuine before you pay, the fastest second opinion is the Scam Checker on this site, or our free case review. Both are read by a human and answered within 24 hours.

From the field. The cruelty of an event like this is that the urgency is real — the match is on a fixed date, the tickets do sell out, and a fan genuinely is racing the clock. Scammers don't manufacture that pressure; they borrow it. That is why the only durable defence is mechanical, not emotional: one official source, one address typed by hand, one payment method with a chargeback. Decide that before you start searching, and the pixel-perfect clone never gets a turn.

One rule, end to end

If you take one habit from this piece, take this: buy tickets only by typing www.fifa.com yourself and paying by card — never from an ad, a social post, an email link, or a stranger asking for a transfer. The fakes are too good to spot by eye, so don't try; control the route instead, and the whole 4,300-domain operation has nothing to catch you with.

Not sure if that ticket site is real? Send it to us before you pay.

Paste the link, the message, the offer. A real expert reviews every case and replies within 24 hours. Free, confidential, no pressure.

Submit a free case review →Full international reporting directory

Common questions about World Cup 2026 ticket scams

Where is the only safe place to buy World Cup 2026 tickets?

FIFA's official ticketing site, FIFA.com/tickets, and FIFA's own Ticket Exchange Marketplace — the only verified secondary market, where resale purchases carry the same protections as buying direct. FIFA states plainly that any ticket bought outside FIFA.com/tickets is from an unofficial channel and carries the risk of fraud, scams and invalid tickets. Type www.fifa.com directly into your address bar rather than clicking a search result or an ad, because attackers buy ads and lookalike domains to intercept exactly that search. If a deal reaches you through Facebook, Instagram, Telegram or an unsolicited email, treat it as a scam no matter how convincing it looks.

What did the FBI warn about for the 2026 World Cup?

On 27 May 2026 the FBI issued a public warning that fraudsters are targeting World Cup fans with spoofed FIFA domains, fake ticket portals, fraudulent merchandise stores and lottery or 'you've been selected' email scams. The bureau urged fans to buy only through official channels and to verify the exact web address before entering any payment or login details. The warning came as the tournament — running 11 June to 19 July 2026 across the United States, Canada and Mexico — drives enormous global demand that scammers are built to exploit.

How big is the World Cup 2026 scam problem?

Large, and industrialised. Security researchers tracking the campaign reported more than 4,300 fraudulent domains impersonating FIFA, some sitting dormant since 2025 and activated as the tournament approached, with estimates of premium-ticket fraud losses ranging from roughly $71 million to $474 million. One operation researchers named 'GHOST STADIUM' ran a phishing network across hundreds of domains with a pixel-perfect replica of the official FIFA site, including a fake single sign-on login and support in 11 languages. These figures come from the security firms and reporters covering the campaign; the scale is why the only reliable defence is buying through official channels, not judging a site by how real it looks.

I think I bought a fake World Cup ticket — what do I do now?

Move fast. Call your bank or card issuer immediately, report it as fraud, and ask to dispute the charge — a card payment gives you chargeback rights that a bank transfer, crypto or gift card does not. Change the password on any account where you entered credentials on the fake site, and turn on two-factor authentication. Report it: to the FBI's IC3 (ic3.gov) in the US, to Action Fraud in the UK, or to your national police and consumer authority elsewhere. Keep every screenshot, email and receipt. And ignore anyone who then contacts you promising to 'recover' your money for a fee — that is the second scam.

How do I tell a fake FIFA ticket site from the real one?

You often can't tell by looks alone — that is the whole point of a pixel-perfect clone. So judge the route, not the appearance: did you type www.fifa.com yourself, or did you arrive via an ad, a search result, a social post or an email link? Check the exact domain spelling — the official site is fifa.com with no hyphens, no extra words and no unusual ending; lookalikes use small misspellings or add words like 'tickets-fifa' or 'fifa-2026.' Be suspicious of any urgency ('only 3 left,' 'sale ends tonight'), any 'congratulations, you've been selected' email, and any discount on a sold-out match. When in doubt, leave and re-type the address by hand.

Sources & further reading

Claims in this piece are attributed to these sources. Click any of them to verify.

World Cup 2026 ticket scams — the FBI just warned fans, and one fake "FIFA" site is pixel-perfect.