Online Voting Phishing Prevention: Six Checks to Run

Online voting phishing prevention starts before you send the first invitation: establish a trusted way to reach the ballot, protect administrator accounts, and rehearse how your team will handle a suspicious message. These six checks help you reduce impersonation risk without confusing members or exposing secret ballots.

A new FBI/CISA warning makes this worth reviewing now. The practical question is simple: could your members and staff distinguish your actual election instructions from a convincing fake?

What the October election-security warning changes

On October 16, 2026, the FBI and the Cybersecurity and Infrastructure Security Agency issued a public service announcement about election phishing. It warns that fraudulent emails and texts can steal login credentials and sensitive information. AI-generated language, audio, and video can make impersonation harder to recognize. Smishing is the same basic deception delivered through text messages.

The announcement addresses the U.S. midterm elections and campaign officials. It does not create a new legal requirement for private member elections. An association or credit union should treat it as a security reminder, not a change to its election rules.

Consider a hypothetical association with 2,400 members. Hours before voting closes, members receive a polished text claiming their ballot access will expire unless they confirm a password. The message copies the association's tone and names the correct election. Familiar details do not establish authenticity.

That is the operational problem: accurate-looking information can still lead to an attacker-controlled page. Teaching members to look for bad spelling is no longer enough.

Make legitimate ballot invitations easy to verify

Give members a trusted reference before the voting window opens. Publish the expected sender address, the exact voting domain, the election dates, and a support number on a page they already know how to reach. Explain when a vendor sends invitations on your behalf so an unfamiliar but legitimate domain does not look like a surprise.

Where your platform supports it, provide a route from the organization's established website to the voting portal. Members can navigate there independently rather than rely on a link in an unexpected message. Do not publish personalized ballot links or credentials on that reference page.

A recognizable display name is not proof of origin. Neither is a padlock: HTTPS protects the connection to a website, not the honesty of its operator. Your instructions should say that staff will not ask members to send passwords or one-time codes by email, text, or phone.

When reviewing an online voting platform, ask the vendor to demonstrate invitation verification and credential recovery together. A clear invitation loses its value if the help desk can be tricked into redirecting access.

Six checks to complete before invitations go out

Run these checks with your election administrator, IT contact, and vendor. Record the outcome and assign an owner to each unresolved issue. They are operational safeguards, not a substitute for checking your governing documents or applicable election law.

1. Approve the message and destination. Compare the final invitation with the published sender and voting domain. Test links using designated test accounts, including on a phone.
2. Check email authentication. Have IT verify SPF and DKIM for every authorized sender and review the DMARC policy. Test legitimate vendor mail before tightening rejection rules.
3. Protect privileged accounts. Ask which administrator and email accounts support phishing-resistant multifactor authentication. Enable it where available; do not assume an emailed code offers the same protection.
4. Rehearse credential recovery. Simulate a caller requesting a new email address and replacement ballot access. Require identity checks through an established process and log approved changes.
5. Test suspicious-message reporting. Make sure members can reach support independently of the suspect message. Confirm who reviews reports while voting is open.
6. Approve the incident decision path. Name who can restrict compromised access, issue corrected instructions, and consider deadline changes under the election's governing rules.

The EAC's misleading-email alert illustrates why sender authentication and domain checks both matter. Email controls help limit spoofing; they do not eliminate lookalike-domain attacks.

Respond to a report without exposing ballot choices

A suspicious message is not, by itself, proof that the voting system was compromised. Start by preserving the message, sender details, destination URL, and time received. Ask whether the recipient clicked, entered credentials, downloaded a file, or approved a login prompt. Keep that report out of general committee email chains.

If credentials may be exposed, involve the vendor and IT team promptly. They should assess account restrictions, session revocation, and secure recovery. Do not tell a member to cast another ballot before checking the platform's replacement and duplicate-vote safeguards.

Your incident record should explain what happened, what evidence was reviewed, who approved the response, and whether participation or administrative actions were affected. It should not become a spreadsheet connecting named members to ballot selections. Ask what evidence the system can provide without reconstructing a secret ballot.

Preserve relevant records under your retention rules and any applicable legal hold. Build this response into your election operations plan. Before changing the closing time, confirm the committee's authority and how all eligible voters will receive consistent instructions. An urgent security concern does not automatically authorize rewriting election procedures.

Frequently Asked Questions

How can members verify an online voting invitation?

Compare its sender and destination with instructions published through a known organizational channel. If anything differs, reach the election team using an established contact method rather than replying to the message or calling its listed number.

Does multifactor authentication stop election phishing?

It reduces risk, but methods differ. The FBI/CISA alert recommends phishing-resistant MFA where possible. Recovery procedures, email security, and administrator permissions still need attention even when MFA is enabled.

Should we cancel voting after a phishing report?

Not automatically. Assess whether access, participation, or election records were affected, then follow your incident plan and governing rules. Document the evidence supporting any decision to continue, restrict access, or change the schedule.

Does DMARC prevent every fake ballot email?

No. DMARC helps receiving mail systems handle messages that fail authentication for a protected domain. An attacker can still use a different, lookalike domain, so members also need a trusted route to verify election instructions.

The Bottom Line

The strongest phishing prevention plan gives members instructions they can verify and gives staff a response they have already practiced. Keep the controls proportionate, preserve ballot secrecy, and document decisions while the evidence is available.

If your next election relies on emailed invitations, ask Votem to review your invitation and recovery workflow before launch. Bring the draft message, approved voting domain, and escalation contacts so the discussion starts with your actual process.