Your weekly dose of scam-proofing in 3 minutes or less. No fluff, just the latest hacks, scams, phishing attacks, and cyber cons you actually need to know about.

The World Cup is on. Your team made it through the group stage. You need tickets.

Official sales are closed. The authorised resale marketplace is sold out. But someone on Facebook Marketplace has two seats — great section, just can't make it, family emergency. They want paying by bank transfer. They seem genuine. Their profile looks real.

You pay. You get a confirmation. You book the flights. You book the hotel. You tell everyone you're going.

You travel six hours. You find the stadium. You join the queue. You reach the gate.

The scanner beeps red.

The steward calls someone over. The people behind you are watching. Your ticket is a duplicate — someone else walked through that gate twenty minutes ago using the same QR code. The seller has already blocked you. The flights are non-refundable. The hotel is paid. Your family is standing next to you in the rain.

That is the full picture. Not just losing money. Losing the trip.

Ahead of the 2026 FIFA World Cup, researchers identified over 4,300 fraudulent domains impersonating FIFA's official web presence — some dormant since August 2025, lying in wait for this exact moment. The FBI's Internet Crime Complaint Center issued a public service announcement on 27 May warning that cybercriminals are spoofing FIFA websites, using fake pages to steal personal information and sell bogus tickets and hospitality packages.

The tournament started less than two weeks ago. The scams have been running for months.

1️⃣ The fake website — and this is the one that should scare you most.

You did not buy from a stranger. You Googled it. You clicked what looked like the right result. The site had the FIFA logo, the official colour scheme, the correct fonts. The login page looked identical to the real thing. You paid. You got a confirmation email with a ticket PDF attached.

A threat actor known as Ghost Stadium built a pixel-perfect clone of the official FIFA website — loading authentic branding directly from FIFA's own servers, replicating the login flow with near-flawless accuracy. Fake sites identified by the FBI include worldcup26ticket[.]com, fifastore.us[.]com, filfa[.]org, and fwc2026.web[.]app.filfa[.]org. One letter different from the real thing. That is all it takes.

2️⃣ The social media seller

A neighbour's cousin's Facebook friend had tickets but can't make it and asks you to Zelle, PayPal, Venmo, or CashApp the money. Now they've ghosted you and no ticket transfer has come through.

This version works because it comes wrapped in social proof. It is not a cold stranger — it is someone two connections away from someone you trust. The payments are via peer-to-peer apps specifically because those transfers are fast, hard to dispute, and almost impossible to reverse.

3️⃣ The duplicate QR code

Scammers purchase one real ticket and sell multiple copies to different buyers, knowing only the first person through the gate will succeed. The ticket you receive is a perfect copy of a genuine one. Real barcode. Real seat number. Real event details. It is completely indistinguishable from the original — until someone else uses it first.

A Reddit user paid $400 for two seats to a Beyoncé concert from a Craigslist seller. The PDF tickets looked entirely official. At the gate, the QR codes were already scanned, sent to multiple buyers simultaneously. The victim was denied entry and could not recover the money.

Money mule scams are the only fraud on this list where the victim is also, in the eyes of the law, a potential criminal. That is what makes them uniquely dangerous, and uniquely effective.

The recruitment works because it targets people who genuinely need money: students, people between jobs, people in debt, people who have just been through a romance scam and are already emotionally compromised. The offer feels like a solution, not a threat.

And the ask seems so harmless. You are not stealing. You are not hacking. You are just moving money from one place to another. The distance between that and "money laundering" is not obvious to most people, which is exactly why criminals use it.

The Global Anti-Scam Alliance estimated global scam losses reached nearly $450 billion in 2025. Money mules are the mechanism that makes those losses disappear into the criminal economy. Every major fraud category — romance scams, task scams, business email compromise, drug trafficking, relies on a network of mule accounts to cash out. Without the mules, the money cannot move. Which is why recruiting them is worth significant criminal investment.

🚩 A URL that looks like the official site but differs by one letter, one word, or one domain extension — check the whole thing, not just the start.

🚩 Tickets available via social media, WhatsApp, or Facebook Marketplace from someone you do not directly know.

🚩 Payment requested by bank transfer, Zelle, PayPal Friends & Family, Venmo, or cash — anything that bypasses buyer protection.

🚩 A PDF ticket or screenshot QR code rather than an in-app transfer through the official platform.

🚩 A seller who is urgent, hard to reach by phone, and only communicates by message.

🚩 Tickets sold outside the official authorised resale channel for that specific event.

✔ Type the official URL directly into your browser — every time.

FIFA is the only authorised source for World Cup tickets. Type, directly into your browser. Do not click search results, sponsored links, or anything in a message. For concerts and other events, go directly to the venue or event's official website and follow their ticketing link from there. The fake sites exist because people click search results. Stop clicking search results.

✔ Only accept in-app transfers through the official platform.

PDF tickets and QR code screenshots can be copied and sold to multiple buyers. Only accept ticket transfers through the official platform's app — Ticketmaster, AXS, See Tickets, or whichever platform the event uses. An in-app transfer invalidates the seller's copy the moment it moves. A PDF does not.

✔ Never pay by bank transfer or peer-to-peer app.

These payment methods have no buyer protection. Once the money moves, it is gone. Pay by credit card wherever possible — it gives you chargeback rights if the tickets are fraudulent. A seller who insists on bank transfer is telling you everything you need to know.

✔ If you use a resale platform, check what protection it actually offers.

Even on reliable third-party sites, check the reseller's refund policy to confirm they guarantee the authenticity and timely arrival of tickets. If the platform does not guarantee authenticity, it does not protect you when the scanner beeps red.

✔ Verify social media sellers independently.

If someone connected to your network is selling tickets, call the mutual contact who connected you before paying anything. Profiles are easy to fake. A phone call is not.

filfa.org. One letter. Six hours of travel. Standing in the rain.

That's it for this week.

Ticket fraud is the scam that keeps working because the conditions that make it work are recreated perfectly at every major event. Sold out. Time pressure. Money already spent. Emotional investment already made.

The World Cup is on right now. The fake FIFA sites have been live for months. The FBI has already issued its warning.

Type the URL yourself. Only accept in-app transfers. Pay by credit card. And if someone on WhatsApp has two great seats going spare, they don't.

Catch you next time,

Dan & the Goldphish Team

📌 P.S. Got a football fan desperately hunting for World Cup tickets right now? This is the one to send them today. Literally today, the tournament is live and the scams are running.