The FBI Just Warned 6.5 Million World Cup Fans. Your Business Has a Problem Too.

Breaking News Cyber Awareness

June 2026  ·  7 min read

The 2026 FIFA World Cup kicks off June 11. The FBI has issued a formal warning about fake event-related websites designed to capture personal information, payment information, and login credentials from fans searching for tickets. What the warning does not say is what those stolen credentials can mean for the businesses those fans work for.

---

Editorial note: This article is for defensive cybersecurity awareness only. It does not link to, reproduce, or enable access to fraudulent sites. The examples below have been kept generic so employees can recognize risky patterns without creating a directory of scam infrastructure.

On May 27, 2026, the FBI's Internet Crime Complaint Center published a formal public service announcement warning that criminals are imitating FIFA's official online presence ahead of the 2026 FIFA World Cup. These sites can closely copy trusted branding, checkout pages, and sign-in screens. They are often promoted through search ads, social media, messaging apps, and email. Their goal is simple: collect personal information, payment information, and login credentials from fans who are rushing to find tickets.

Cybersecurity researchers have identified thousands of suspicious event-related domains registered since August 2025. Some are active now; many more appear to be dormant and could activate as the tournament approaches. The volume matters because attackers do not need to fool everyone. They only need to fool a small percentage of motivated fans during moments of urgency.

Here's the number that matters for your business: researchers have already reported more than 2,500 event-related account credentials exposed in criminal markets and breach datasets. Those credentials belong to real people. Some of those people work for real businesses. And some of them may reuse the same password on a personal account that they use at work.

4,300+ suspicious event-related domains reportedly registered since August 2025 — some active, others dormant and ready to activate Group-IB / FBI IC3, May 2026

2,500+ event-related account credentials reportedly found in breach datasets and criminal markets Group-IB, May 2026

150M ticket requests in the first 15 days of sales — 30x oversubscribed. Desperation is the attacker's advantage. FIFA / Help Net Security, 2026

⚠️ FBI formal warning — issued May 27, 2026 The FBI warned that cyber threat actors are imitating FIFA-related websites in advance of the 2026 FIFA World Cup and that additional fake websites are likely to appear throughout the tournament period. Suspicious activity can be reported at ic3.gov.

Why this is a business problem, not just a fan problem

The FBI warning is framed as consumer advice. Type the URL directly. Avoid sponsored links. Don't click suspicious emails. That's the right advice for an individual fan. But the business risk runs deeper — because of a single documented behavior: password reuse.

We covered this in the credential series. 94% of leaked passwords are reused. An employee who creates an account on a fake event site and enters their email and password may have just handed attackers a credential that — statistically — is likely to work on at least one of their other accounts. Including, potentially, their work email, their company VPN, or their Microsoft 365 login.

The attacker doesn't need to target your business directly. They target the World Cup fan. The fan happens to work for you. The fan reused their password. Your business is now exposed through an attack that never touched your systems, never triggered your security tools, and may not show up in monitoring until months later when someone notices unusual access.

Credentials stolen from consumer scams are often reused across other services. If an employee reused a password at work, your business may be exposed even though the original scam happened outside your systems. That is the business lesson behind the World Cup warning: personal credential theft can become corporate access.

What the fake sites actually look like

These are not obvious scams. Some fraudulent sites imitate official ticketing pages, checkout flows, and sign-in screens closely enough that a rushed fan may not notice the difference. The safest rule is simple: type the official site directly into the browser and avoid ticket links from ads, emails, text messages, messaging apps, or social media posts.

How to recognize risky lookalike sites

Safer:Type the official site directly into your browser

Risky:Ticket sites using unfamiliar endings or urgent sales language

Risky:Domains with extra letters, misspellings, or added words

Risky:Job, prize, resale, or account-update pages that imitate a trusted brand

Risky:Links sent through ads, email, messaging apps, or social media posts

Rule:Never enter passwords or payment details unless you reached the site directly and verified the address yourself.

The five things to do in your business before June 11

1

Send a one-paragraph warning to your team today

Do it now

The single most impactful action in the next hour: message your team explaining that fake World Cup websites are actively harvesting login details, that the FBI has issued a formal warning, and that any event-related account should use a completely unique password — not shared with any work system. Include one rule: reach the official site directly. Never click a ticket link from an email, ad, text message, or social media post.

The message to send "The FBI has warned that fake World Cup websites are active right now and may capture login details or payment information. If you're buying tickets or checking match info, go to the official site directly — do not click links from ads, email, texts, or social media. And please make sure any event-related password is different from any password you use for work."

2

Check whether employee work emails appear in known breach databases

Check today

Researchers have reported event-related credentials appearing in breach datasets. HaveIBeenPwned at haveibeenpwned.com allows free domain-level searches — type your company domain and see which employee email addresses have appeared in known breach databases. If any work emails appear, those employees should change their work passwords immediately.

The 60-second check Go to haveibeenpwned.com → click "Domain search" → enter your company domain → review any breached accounts. This is the same check from Part 2 of the credential series. Checking now gives you a window to act before reused passwords are tested against business systems.

3

Remind employees: sponsored search results are not safe results

Training moment

The FBI explicitly warned that attackers may use sponsored search placements and social promotions to move fans toward fraudulent pages. When an employee searches for tickets and clicks the first result, they may be on a fake site before they've noticed the URL.

Two rules before June 11 Skip sponsored results when entering credentials or payment information, and always check the URL before entering any sensitive information. A locked padlock icon does not mean a site is legitimate — fake sites can have SSL certificates too. The URL and the path you used to reach the site matter.

4

This is the credential reuse attack in real time — MFA is your safety net

MFA enforcement

Even if an employee's work credentials are exposed through a fake event site, MFA on all work accounts provides a critical second line of defense. The caveat from the MFA bypass post: push notification MFA can be defeated through prompt bombing. Number matching — the single configuration change that requires the employee to enter a code shown on the login screen — makes prompt bombing fail.

The specific action Confirm MFA is enforced on every work system — not just available, enforced. Enable number matching in your identity provider settings. This closes the gap between "credentials exposed through a consumer scam" and "business compromised." It takes 15 minutes to configure.

5

The tournament runs until July 19 — this risk lasts 40 days

Duration matters

The 2026 World Cup runs from June 11 to July 19 — 40 days. Fraudulent campaigns can change throughout the tournament, especially around knockout rounds, semifinals, and the final when ticket demand and urgency peak again.

The 40-day plan Send the initial warning today. Send a brief reminder when the knockout rounds begin, approximately July 4. Keep the haveibeenpwned domain search bookmarked and run it again mid-tournament. The scam ecosystem will evolve — new sites will launch and your team's awareness will fade with time.

The 2026 World Cup is the largest in history — 48 teams, 104 matches, 6.5 million fans across the US, Canada, and Mexico. There were 150 million ticket requests in the first 15 days alone, making it 30 times oversubscribed. Scammers don't need to trick a majority of those fans. They need to trick a fraction. And among that fraction, some will be your employees — using the same password they use at work.

The bigger lesson behind the World Cup scam

The 2026 World Cup phishing campaign illustrates why credential monitoring matters year-round. Your employees are not being targeted because of where they work. They're being targeted as consumers — as fans, as shoppers, as people who click on things. The credentials they lose in their personal lives can become the credentials that walk into your business.

This is the same mechanism behind many credential-based attacks: passwords lost in one breach, reused in another context, eventually used to access a business system. The World Cup accelerates and focuses the risk. But the underlying vulnerability exists 365 days a year and months before the average business finds out it was exploited.

Veriti Spottr's credential monitoring watches your company domain against known breach databases continuously — including new event-related exposures as they appear. When an employee's work email appears in a new breach, Spottr surfaces it before a reused password can become business access. The World Cup campaign is already running. The question is whether your team is exposed — and whether you find out now or much later.

📚 Credential Security Series — Read the full series

Part 1 → Your Password Policy Isn't Protecting You. Your Employees' Habits Are. Part 2 → Your Credentials Are Already For Sale. Here's How to Find Out in 60 Seconds. Part 3 → You Turned MFA On. Attackers Already Have Three Ways Around It. Part 4 → What Attackers Do With Your Data in the First 60 Minutes Part 5 → The 30-Minute Security Audit Every SMB Owner Should Do This Week Part 6 → The First 24 Hours After You Discover a Breach

Find out whether employee work emails have appeared in known breach databases. Veriti Spottr's beta is free.

Get your CyberScore →

VS

Veriti Spottr Team AI-powered cyber risk clarity for SMBs  ·  veritispottr.com