- Thousands of fake FIFA domains are already waiting for desperate football fans
- Fraudsters cloned FIFA’s login system with near-perfect visual accuracy for credential theft
- Facebook advertisements are driving victims directly into a large-scale World Cup ticket scam
Over six million fans will fill stadiums across the U.S., Canada, and Mexico when the 2026 FIFA World Cup tournament kicks off in June.
The sheer scale of ticket demand has created ideal conditions for sophisticated fraud operations.
According to Group-IB researchers, they have identified over 4,300 fraudulent domains impersonating FIFA’s official web presence since August 2025, and some of these domains have remained dormant for nearly a year, lying in wait for desperate fans.
The Ghost Stadium scam
A Chinese-speaking threat actor known as Ghost Stadium sits at the centre of this fraud ecosystem.
This financially motivated group has built a pixel-perfect clone of the official FIFA website using a shared phishing kit.
The fake site replicates the legitimate PingIdentity login flow with near flawless accuracy.
Victims who land on these pages see authentic branding loaded directly from FIFA’s own content delivery network.
The system automatically switches between eleven languages based on the visitor’s browser settings.
“Major sporting events are a magnet for fraud. Huge demand, limited tickets, and the fear of missing your country play put fans under pressure to act quickly. Scammers know this,” said Yuan Huang, Global Fraud Intelligence Lead at Group-IB.
“We have identified more than 4,300 fraudulent domains impersonating FIFA’s official web presence ready to exploit fans looking for tickets, some sitting dormant since 2025.”
Facebook advertisements serve as the primary trap for unsuspecting ticket seekers.
These ads display dramatically discounted prices and countdown timers to create artificial urgency.
Clicking the ad leads visitors to a fake hospitality page with a prominent “BUY NOW” button.
Victims who already hold legitimate tickets are tricked into logging in — handing their credentials directly to the attacker.
The fraudster then changes the account password, locks the legitimate owner out, and resells the genuine tickets for profit.
New buyers without existing tickets face a different but equally destructive path.
They complete a detailed checkout form that captures their full name, address, phone number, and payment card details.
The fraudsters accept money through at least five distinct channels, including direct card capture, peer-to-peer apps like Chime and Nequi, and even cryptocurrency conversion through Alchemy Pay. No tickets ever arrive after payment is submitted.
Ghost Stadium does not operate alone in this space. Four independent threat actors are running six parallel fraud schemes simultaneously.
These include fake streaming platforms demanding subscription fees, counterfeit merchandise storefronts targeting Latin American markets, and unlicensed betting sites that harvest passport scans for identity fraud.
More than 2,500 FIFA account credential pairs are already circulating on dark-web markets at prices between $5 and $50 per pair.
How to stay safe
Financial losses from premium-ticket fraud alone are estimated at between $71 million and $474 million.
To stay safe, the safest approach is to assume that any ticket offer outside official channels carries significant risk.
Check the exact domain spelling before entering any credentials. The official site is fifa.com without hyphens or alternative endings.
Enable multi-factor authentication on your FIFA account immediately and change your password if you have not done so recently.
Do not click on ticket ads appearing on Facebook, Instagram, or Telegram, regardless of how compelling the discount appears.
Taking one extra moment to verify before buying can prevent substantial financial and personal harm.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
https://cdn.mos.cms.futurecdn.net/tpCFt5LKnMzPmPZF7w9Fa8-2560-80.jpg
Source link
