If you’re hunting for a World Cup ticket, be careful — scammers are out in full force targeting fans eager to catch a match in person.
Security experts and law enforcement agencies are sounding the alarm about criminals using a variety of tricks to take advantage of soccer fans desperate to attend games at the tournament, which got underway June 11. The event runs through July 19, and the biggest matches are still ahead.
With FIFA setting record-high ticket prices and some games already sold out, the demand is creating a perfect storm for fraud.
Here’s what fans need to watch out for:
If you spot a Facebook post advertising last-minute seats to a hot game at what seems like a great price, slow down before pulling out your wallet. Ask yourself whether the deal seems too good to be true.
Just like other types of fraud, World Cup scammers exploit high demand to pressure buyers into paying for tickets that don’t exist. Britain’s Home Office flagged this tactic last month as part of an ongoing fraud awareness effort, warning fans to watch for classic pressure lines like “lots of interest” or “I need to sell right now.”
“Scammers often use urgency to push you into making hasty decisions,” the agency cautioned.
Social media platforms have become breeding grounds for ticket fraud.
The U.S. Federal Trade Commission put out a consumer alert back in March warning that scammers use social media posts to steer people toward fraudulent websites, where they either advertise phony tickets or sell the same seat to multiple buyers.
The British government also warned that criminals may advertise a spare ticket on social media, then shift the conversation to an encrypted messaging app like WhatsApp, pressure the buyer to wire money to a bank account, and then block the victim and vanish.
Two weeks before the tournament began, Meta Platforms announced that Facebook users searching for World Cup tickets would start seeing pop-up alerts reminding them to purchase only from verified sellers and explaining how to flag suspicious listings.
Cybersecurity experts say criminals are now using artificial intelligence to craft convincing messages, slick-looking fake storefronts, and fraudulent endorsements.
“My advice: assume any World Cup deal that reached you through a social media ad or search result is suspect until proven otherwise,” said Chris Olson, CEO of digital safety company The Media Trust.
Olson said the World Cup is driving a spike in “phishing attacks and cloaking schemes,” adding that “AI-powered phishing campaigns are becoming more sophisticated, more targeted, and more difficult to detect. We’ve seen it all, from data harvesting to fake ticket sales.”
For legitimate tickets, fans should start at the official FIFA website, which handles both direct sales and authorized resale. Established third-party resale platforms like StubHub and SeatGeek are also options, though FIFA cautions that purchasing outside official channels increases the risk of receiving counterfeit or invalid tickets — or paying inflated prices.
Another threat comes from websites designed to look like the official FIFA site. The FBI issued a public service announcement warning that scammers are building copycat FIFA websites to steal personal information or peddle fake tickets and hospitality packages.
The agency identified more than three dozen fraudulent sites with web addresses that can easily be mistaken for the real thing, including examples like fifa-online.com and fifa-ticket.live. Most of those sites have gone dark, and some have been flagged as malware, but the FBI cautioned that new ones will keep popping up.
The FBI recommends typing fifa.com directly into your browser’s address bar rather than using a search engine. If you do use Google, steer clear of sponsored results at the top of the page — the agency warned those could be “paid imitators” trying to divert traffic to scam sites.
Fans who can’t make it to a game in person and plan to stream matches online face their own set of risks.
Not all games will air on free channels, and experts warn that scammers are setting up shady streaming sites to cash in on that demand. According to a report by Assaf Morag, a researcher at cybersecurity firm Flare, cybercriminals typically build copycat streaming sites and promote them through platforms like Telegram, Facebook, Discord, and Reddit.
Drawing on patterns from past major sporting events, illegal streams tend to appear right before a match kicks off. Once viewers click in, criminals can bombard them with scam ads, fake software update prompts, and data harvesting tools — or earn commissions by redirecting them to gambling or adult content sites.
“Nearly 40% of users who access illegal streams experience direct financial losses due to scams, fraud, or compromised payment information,” Morag said. “The trap is incredibly easy to fall into. You click a ‘Play’ button, and the site immediately forces your browser through multiple hidden layers of tracking, pop-ups, and advertising infrastructure explicitly designed to hide malicious software — all while the match never actually loads.”
