World Cup Ticket Scams Surge as Final Nears; Toll Texts, Fake FBI "Recovery" Persist

World Cup ticket scams intensify as the final approaches

With the tournament's final set for July 19 at MetLife Stadium, fraudsters are racing to exploit last-minute ticket demand. The FBI's Internet Crime Complaint Center (IC3) has warned that cyber threat actors are conducting spoofing attacks against the FIFA website, using them to further illegal activity like personal information theft and facilitating monetary scams, often by slightly altering legitimate domain characteristics to gather personal and banking information. Researchers have since catalogued the scale of the problem: more than 13,000 World Cup-linked domain names have been registered in five months, with about 9% considered suspicious or malicious, and over 270,000 compromised credentials already reported in connection with ticketing and fan-platform scams.

Recent coverage notes the scams have evolved beyond fake websites: fraudsters are using fake ticket listings, spoofed FIFA websites, social media posts and artificial intelligence-made scams to steal money and personal information. AVASC's own data mirrors this: our Event & Sports Ticket Resale Scams cluster shows scammers posting fake resale listings and pushing payment through peer-to-peer apps to strangers — a pattern the FBI has separately confirmed with spoofed FIFA domains.

Unpaid-toll texts remain the top complaint AVASC is seeing

Toll smishing is still the single most-reported scam pattern in AVASC's database this period (520 reports), and it's backed by hard external numbers. The FTC has confirmed fake toll payment texts are now the fastest-growing form of government imposter fraud in the country, contributing to a 40% spike in reports and pushing total imposter scam losses to $3.5 billion in 2025. State-level analysis backs this up: New Jersey's cybersecurity center found over 20,000 second-level domains linked to these SMS scams, with the number of fraudulent URLs tied to those domains many times higher, and noted the campaigns are text messages impersonating state toll agencies, motor vehicle agencies, and court systems, claiming unpaid road tolls and threatening fines, legal action, or license suspension if payment isn't made immediately.

What AVASC is seeing lines up exactly: impersonated agencies like EZ-Pass, SunPass, FasTrak and TxTag, sent via mass SMS/RCS blasts to look-alike payment pages on unusual domain extensions.

Fake "FBI/IC3 fund recovery" schemes keep re-victimizing prior scam targets

AVASC's Fund-Recovery Re-Victimization cluster (95 reports) is consistent with an active FBI warning: the Bureau has cautioned that threat actors are spoofing the FBI Internet Crime Complaint Center (IC3) government website, gathering personally identifiable information including name, home address, phone number, email address, and banking information. In a documented variant, scammers create female persona profiles on social media, join financial-fraud victim support groups posing as fellow victims, and direct people to a fake "Chief Director" of IC3 who claims to have recovered lost funds — using this as a ruse to gain financial information and revictimize them. The FBI has been explicit: IC3 will not ask for payment to recover lost funds, nor will it refer a victim to a company requesting payment for recovering funds.