Faltam is less than 30 days away from Copa of Mundo in 2026, and criminals are already taking advantage of the interest in the championship to carry out scams using fake FIFA websites. The digital security company ESET identified at least five fraudulent pages created in recent weeks, all with Portuguese versions and suspicious offers of tickets for Brasil matches in the tournament.
The fake websites reproduce the design of the official FIFA portal with a high level of fidelity, including the logo, visual identity and even the ticket purchase flow. Oferecem also offers hosting and championship-related items, such as official t-shirts. The sophistication of the pages allows unwary victims to easily fall for the scam.
Fraudulent Páginas appear in search engines and social networks
According to ESET, fake websites appear in search engines such as Google, in addition to being disseminated on social networks, WhatsApp, SMS and email. Essa distribution across multiple channels significantly expands the reach of criminals and increases the chances of victims accessing malicious pages without realizing the danger.
One of the details that draws attention on fraudulent websites is the presence of an option in Portuguese in the language field. On the official FIFA page, only English, German, French and Spanish are available. Esse specific detail highlights the criminals’ targeting of Brazilians in search of tickets.
The fake website offers the match between Brasil and Marrocos, scheduled for June 13, with tickets supposedly on sale from $2,205 to $1,696. On the official FIFA portal, however, there are no more tickets available for this match. Discrepancy is an important indicator of fraud.
Como criminals imitate the original design
The fraudulent pages reproduce the login procedure practically identically to the legitimate website. Porém, the fake version, differs in one crucial point: while the original platform allows access with Google or Apple accounts, the fraudulent version only accepts data filled manually in a form.
Essa restriction is an important warning sign. Criminals seek to obtain information entered directly by users for identity theft and compromise of personal accounts. Caso the user reuses the same password on other services, the risk of fraud increases significantly.
Outro aspect analyzed by g1 was the visual structure of the pages. Pequenas inconsistencies can give away fraud, such as icons that are too small or misaligned. On one of the fake sites, the user help chat displayed messages in a language that looked like Japanese or Chinese, a clear flaw in the attempt to imitate the official portal.
Detalhes technicians reveal the fraud
The first point of observation is the website address (URL). Páginas from large companies often use well-known domains, without suspicious variations. The official FIFA website, for example, ends in “.com”, while one of the identified fraudsters uses the extension “.shop” and “.store”.
Porém, the situation becomes more complex: another fake website identified by ESET also ends in “.com”, just like the original, but starts with “www.wc26”. FIFA’s official address for ticket sales is “www.fifa.com”. Essa camouflage strategy is known as typosquatting.
- Fake Domínios with suspicious extensions (.shop, .store)
- URLs starting with variations like “wc26” instead of “fifa”
- Letras and symbols swapped with similar characters (such as lowercase “l” for uppercase “I”)
- Endereços that differ only in minute details from the original
What is typosquatting and how does it work
Esse type of scam is known as typosquatting. Criminosos creates addresses very similar to those of real websites and clones the look of the original pages. The victim can fall into the trap by making a typing error or not noticing small changes in the address, which is usually almost identical to the real one.
The strategy includes substitutions such as changing the letter “m” to “rn” or using visually similar characters. In some cases, typosquatting attacks are enhanced with paid online advertisements. The similarity in the address confuses the victim, who clicks on the ad without realizing that they are being redirected to a fraudulent website.
Especialistas in security warn that the combination of passion for football, anxiety about tickets and legitimate appearance of websites creates an extremely favorable environment for scams. Além of financial loss, there is a risk of identity theft and compromise of personal accounts.
Proteger itself from fraud requires constant attention
The first step to avoid becoming a victim is to carefully analyze the website address before accessing any purchase page. Páginas from large companies often use well-known and well-defined domains. Pausar a few seconds to check the URL can save money and personal data.
Também it is important to be wary of prices well below the market. Criminosos often advertises tickets and products with exaggerated discounts to attract victims. If the offer seems too good to be true, it’s probably a scam.
Outro alert is the sense of urgency created by criminals. Scam Páginas often display messages such as “last units” or countdown timers to pressure the victim to complete the purchase quickly. Essa emotional tactic is a classic red flag.
The page structure also deserves analysis. Golpistas may copy the look of official websites, but small inconsistencies indicate fraud. Problemas design, text in strange languages, or misaligned icons are warning signs. Examinar font, spacing, and color details can reveal important differences.
FIFA official Recomendações
g1 reached out to FIFA, which stated that it always encourages fans to only purchase tickets through FIFA.com/tickets, the official and preferred source for Copa’s Mundo. The organization recommends that fans remain alert and avoid unofficial platforms.
“Fans are strongly advised to remain alert, avoid unofficial platforms and use exclusively FIFA’s official channels to purchase tickets and hospitality packages,” says the organization in an official statement.
Confiar only on official channels is the safest strategy. When searching for tickets, directly accessing fifa.com/tickets via manual typing of the URL or official search drastically reduces the risk of exposure to fraud. Nunca clicking on links sent via email or WhatsApp is also an essential security practice.
