GHOST STADIUM clones FIFA ticketing sites to steal fans’ money and accounts
Fake FIFA sites targeted World Cup fans through Facebook ads, stealing logins, personal details and payments. If you entered details, change your FIFA password and contact your payment provider. The tournament has ended; the campaign’s closure is unconfirmed.
If you entered credentials on a fake site, change your FIFA password through fifa.com and check for unauthorised ticket transfers. If you paid, contact your bank or payment provider. Report the scam through ReportCyber; NSW residents can also contact ID Support NSW.
What’s happening
Group-IB disclosed GHOST STADIUM on 27 May: more than 300 fraudulent domains copied FIFA’s login and ticket-purchase pages, with Facebook advertisements providing the main route to victims. The sites collected account credentials, contact information and card details, and took payments for tickets that were not delivered. More than 600 registrations were observed on one domain; the campaign’s total victim count and losses remain unconfirmed. Group-IB’s much larger financial figures were extrapolations, not verified losses. This is a scam, so there is no software patch. FIFA subsequently confirmed the tournament had ended. As of 3 November, the reviewed sources do not establish a campaign-wide shutdown, arrests, victim notification or money recovered.
- What
- Scam
- Affects
- FIFA accounts and FIFA World Cup 2026 ticket buyers
- Fixed in
- Nothing to patch
- Since
- 27 May 2026
- Closed
- 19 July 2026
Timeline
- Update
FIFA updated its ticketing guidance to confirm the tournament had concluded. It said it could not access or manage tickets purchased outside its official sales channels; this was not confirmation that GHOST STADIUM had been stopped.
- Update
ID Support NSW issued a broader warning about fake FIFA websites collecting personal and banking details. It directed affected people to identity support and ReportCyber.
- Update
CERT-EU included GHOST STADIUM in its May cybercrime briefing, reporting the theft of credentials, personal information and payments through FIFA impersonation.
- Made publicNothing to patch
Group-IB disclosed GHOST STADIUM’s phishing and fake-ticket operation across more than 300 domains, primarily promoted through Facebook advertisements. Researchers observed more than 600 registrations on one fraudulent domain.
Sources
- I purchased my FIFA World Cup 2026 tickets through a third-party platform or account. How will I receive my tickets?FIFA · 19 July 2026
- The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football TournamentGroup-IB · 27 May 2026
- Threat Actors Spoofing FIFA Websites in Advance of the 2026 World CupFBI · 27 May 2026
- Cyber Brief 26-06 - May 2026CERT-EU · 2 June 2026
- Scam Alert: Fake FIFA World Cup 2026 websitesID Support NSW · 3 June 2026