Fake FIFA Ticket Sites Steal Cards and OTPs

How the attack worked

Criminals built cloned versions of FIFA's official ticketing site, copying tournament news, match schedules, stadium information, and the ticket purchasing flow to make the pages look authentic. Fans arrived at these pages mainly through Facebook and Instagram ads and shared links rather than by navigating directly to an official source. Once a victim reached checkout, the fraudulent site captured card numbers, expiration dates, CVV codes, and one-time passwords (OTPs) in real time, giving attackers everything needed to complete unauthorized transactions.

Researchers observed this was not a single opportunistic site but an organized operation, with multiple operators using shared infrastructure. The FBI reported dozens of fraudulent domains impersonating FIFA, many relying on typosquatting: subtle misspellings or different domain extensions designed to pass a quick glance as the real thing.

Why it succeeded

Several factors made this scam effective:

• The high demand and once-every-four-year timing of the World Cup pushed fans to move quickly, reducing the time spent scrutinizing a site before entering payment details.
• Social media ads and shared links carried an implied trust that a typed-in official URL would not have needed to earn.
• The cloned pages replicated real content like schedules and stadium details, so the visual experience matched expectations of a legitimate ticketing site.
• Capturing the OTP alongside card data let attackers bypass a control (one-time passcodes) that many people assume makes a transaction safe.

What to watch for

• A ticket-buying link that arrived through a social media ad, shared post, text message, or unsolicited email rather than a search for the official site.
• A checkout page requesting an OTP when there is any uncertainty about whether the site is genuinely official.
• A domain that looks almost right but has a misspelling or an unusual extension compared to the official FIFA site.
• Deeply discounted tickets, unusually cheap VIP packages, or a seller creating urgency to purchase immediately.

How to build resistance

Organizations with staff who travel, manage events, or handle expense purchases should reinforce a few habits. Buy tickets only through official sources or authorized partners, and avoid third-party sellers that cannot be verified. Encourage people to type the official website address directly rather than clicking links shared on social platforms. Train finance teams and cardholders to treat OTP requests on unfamiliar checkout pages as a signal to stop and verify the site's legitimacy before entering any payment information.

How did the fake FIFA ticket sites steal payment information?

The phishing infrastructure captured payment card details, including card numbers, expiration dates, CVV codes, and one-time passwords (OTPs) during the checkout process on cloned FIFA ticketing pages.

How did victims end up on these fraudulent ticketing pages?

Much of the malicious traffic originated from Facebook and Instagram, where advertisements and shared links directed fans to fraudulent ticketing websites.

What is typosquatting and how did it play a role in this scam?

Attackers created look alike websites with subtle misspellings or different domain extensions to trick fans into believing they were visiting the official FIFA website.

How can fans avoid falling for World Cup ticket scams?

Purchase tickets directly from official platforms or authorized partners, avoid links shared on social media or in unsolicited messages, and treat unusually cheap tickets or urgent sales pitches as red flags.