The NJCCIC has observed a phishing campaign claiming recipients have been selected to enter a giveaway for a prize tied to the FIFA World Cup. This type of free-prize-at-the-cost-of-a-
The email tells the recipient they’ve been chosen to enter a FIFA World Cup giveaway and must complete a survey. The message contains a Google APIs URL that, when clicked, redirects to a page impersonating FIFA. The page presents a fake survey asking for age, t-shirt size, and color, with a timer supposedly counting down to the offer’s expiration. After completing the survey, users are redirected to a secure checkout page to pay for shipping to receive a free FIFA shirt. The payment site is designed to capture personally identifiable information (PII) and financial information.
Recommendations
- Avoid clicking links, responding to, or acting on unsolicited emails.
- Confirm requests from senders via contact information obtained from verified and official sources.
- Type official website URLs into browsers manually.
- Users who submitted payment information to these webpages are advised to contact their banking institutions to report the fraudulent purchases.
- Review the Don’t Take the Bait! Phishing and Other Social Engineering Attacks for more information on common phishing and social engineering attacks.
Report malicious cyber activity to the NJCCIC and the FBI’s IC3.
Originally published in the NJCCIC Weekly Bulletin: July 16, 2026
