The FBI is warning soccer fans to steer clear of a growing wave of counterfeit FIFA websites built to harvest personal and financial data, peddle fake tickets and run other scams during the 2026 World Cup.

In a public service announcement, the bureau said cyber actors have stood up dozens of lookalike domains designed to siphon names, addresses, phone numbers, email accounts and banking details from fans trying to reach the tournament's official site.

The scheme leans on a tactic the bureau calls typosquatting, in which criminals register domains that mimic fifa.com through small misspellings such as fiffa.com or by swapping the .com extension for .org and other suffixes.

Other fake pages pose as FIFA subdomains, including a string of phony career portals like jobs-fifa.com and fifa-careerhub.com aimed at job seekers wanting World Cup work.

Once a user lands on a spoofed page and enters personal information, the FBI said, the operators can open new accounts in the victim's name and run downstream fraud.

The bureau said it has already compiled a roster of fraudulent domains, including fifa.city and fifa.help, fifa-online.com, fifa-ticket.live, fifaworldcup26.sale, wvvw-fifa.com and ww-fifa.com, and expects more to surface as the tournament draws closer.

The warning comes amid heavy demand for tickets to the tournament, the first World Cup co-hosted by the United States, Canada and Mexico. Fake ticketing and hospitality storefronts give scammers a ready hook, the bureau said, with bogus inventory and travel packages doubling as data traps.

The bureau urged fans to type fifa.com directly into the browser bar rather than rely on search results, where paid "sponsored" links can route traffic to imposter sites.

It also recommended bookmarking the official page, reaching subdomains like plus.fifa.com only through FIFA's homepage, and skipping any URL that does not match the legitimate address.

Anyone who suspects they have been targeted can file a complaint with the FBI's Internet Crime Complaint Center.

The bureau asked victims to include the fake domain, a description of the data shared, and any payment details, including cryptocurrency addresses associated with the transaction.