FBI Warns of Fake FIFA Websites: How Canadians Can Avoid World Cup Scams
The key impact: If you plan to attend or follow the 2026 FIFA World Cup, you could lose hundreds or thousands of dollars—and have your identity stolen—by buying tickets, merchandise, or hospitality packages from fake websites impersonating FIFA.
The 2026 World Cup runs from June 11 to July 19, 2026, and is co-hosted by Canada, the United States, and Mexico. That makes this scam a direct threat to Canadians.
What is happening?
The FBI has issued a warning about hundreds of fake websites pretending to be FIFA. Cybersecurity firms have identified over 300 phishing sites linked to a Chinese threat actor called "Ghost Stadium."
These fraudulent sites use small tricks to look real:
- Slight spelling changes (e.g.,
fiffa.cominstead offifa.com) - Alternative domain endings (
.org,.xyz,.live) - Fake ads on Google Search and Facebook
- Scam messages sent through Telegram and WhatsApp
Who is affected?
- Canadian soccer fans planning to buy tickets, merchandise, or hospitality packages for the 2026 World Cup
- Anyone searching online for World Cup information—scammers target people using Google and social media ads
- Canadians who receive unsolicited messages about "exclusive" ticket deals or "limited-time" offers
What are the risks?
If you fall for a fake FIFA website, you could:
- Lose money on tickets or merchandise that never arrive
- Have your identity stolen—scammers collect names, addresses, phone numbers, and banking details
- Face further financial fraud if your credit card or bank information is used for other scams
How to spot a fake FIFA website
| Red Flag | What to look for |
|---|---|
| Strange URL | fiffa.com, fifa.org, fifa.xyz, fifa.live |
| Unsolicited messages | Offers sent via WhatsApp, Telegram, or Facebook DM |
| Too-good-to-be-true deals | "Exclusive" tickets at huge discounts |
| Poor grammar or design | Typos, blurry logos, broken links |
| Pressure to act fast | "Limited time" or "only 10 tickets left" |
What you should do
-
Manually type
fifa.cominto your browser—never click on ads or links from search results, social media, or messages. -
Use an ad blocker to reduce the chance of clicking on a malicious ad.
-
Verify the URL ends in
.com—FIFA's official site uses onlyfifa.com. -
Ignore suspicious direct messages—even if they appear to come from a friend or a "FIFA representative."
-
Never enter personal or financial information unless you are 100% certain the site is authentic.
-
Report scams to the Canadian Anti-Fraud Centre (online or by phone) or the FBI's Internet Crime Complaint Center (IC3). Include:
- The fake domain name (e.g.,
fiffa-tickets.com) - Any payment details you provided
- Screenshots of the scam
- The fake domain name (e.g.,
Bottom line
The 2026 World Cup is a huge event for Canada—and scammers know it. Fake FIFA websites are already active, and hundreds more are expected. If you want tickets or merchandise, only use fifa.com and type it manually into your browser. Never click on ads, links, or messages offering "deals." If something feels off, report it. Your money and your identity are worth protecting.