Security firm Fortinet found that between January and May of this year, more than 13,000 World Cup-themed websites were created. Over 100 of those sites have been flagged as malicious or suspicious. Most are designed to look official, often copying FIFA’s branding and visual identity to trick fans into handing over payment details and personal information in exchange for fake tickets or merchandise that does not exist.
Researchers also identified 1,700 fake social media profiles linked to the tournament, built to harvest data or redirect users to scam purchases. Per GB News, Meta has deployed specific World Cup features on Facebook and Instagram to address the problem, though the platforms declined to detail which features or how they work.
The scale is not surprising. The World Cup is the most-watched event on earth. 48 teams. 104 matches. Hundreds of millions of fans looking for tickets, merchandise, streaming links, and fantasy football access. The financial opportunity for fraud is large enough to justify an industrial-scale operation, and that is what appeared.
FIFA has its own advisory, recommending fans buy tickets only through official channels and verify URLs before entering payment information. This is the same advice given for every major sporting event, and it is given because every major sporting event produces the same pattern.
What is particular to 2026 is the scale. The expanded 48-team format and three-country hosting spread the audience wider than any previous tournament. More fans, more cities, more entry points. The fraud infrastructure matched it.
When 13,000 fake websites appear before the opening whistle, what exactly does that say about the tournament’s actual audience?
Sources
GB News: World Cup 2026 WARNING: Fraudsters target fans across Facebook and Instagram
