Election scams are deceptive schemes that exploit voters, candidates, campaign staff, or election officials during an election cycle to steal money, credentials, or trust. They often use phishing, impersonation, fake donation pages, or fraudulent verification requests, creating security and governance risks across email, identity, and communications systems.
What Election Scams Usually Exploit
Election scams work by turning urgency, civic trust, and fast-moving campaign communication into an attack surface. The scammer usually relies on a believable election context, then pressures the target to click, pay, verify, or disclose information before they can validate the request.
That makes the core danger less about any one channel and more about the combination of impersonation, social engineering, and identity abuse. Messages that appear to come from a candidate, campaign vendor, registrar, poll worker, or election body can bypass normal caution because they borrow legitimacy from a real process.
Common Scam Patterns During Election Cycles
Phishing remains the most common pattern, especially when it is paired with fake donation portals, fraudulent sponsorship asks, or requests to “confirm” voter details, event attendance, or account access. These schemes often imitate official branding, copy legitimate wording, and use time pressure to reduce scrutiny.
Impersonation can also target campaign staff, volunteers, contractors, and election administrators through email, text, or voice calls. In practice, the scam may be designed to capture credentials, redirect payments, enroll the victim in a malicious contact channel, or gather enough information for a second-stage fraud attempt.
- Fake donation pages can harvest card data or payment credentials.
- Fraudulent verification requests can steal usernames, passwords, or one-time codes.
- Impersonated officials can coerce recipients into changing payment instructions or sharing sensitive records.
- Lookalike domains and spoofed display names can make the request appear routine.
Why Election Scams Create Security and Governance Risk
Election scams are dangerous because they compromise both trust and process. A successful scam can expose campaign mailboxes, payment systems, volunteer rosters, voter-facing communications, and internal approval chains, then use that access to extend the fraud or distribute additional malicious messages.
They also create governance risk because the victim may believe they are responding to a legitimate election workflow. That confusion can delay reporting, obscure ownership, and make it harder to separate a simple fraud attempt from a broader compromise of communications or identity systems.
How Organisations Reduce Exposure and Recover
Organisations should treat election-related requests as high scrutiny by default, especially when they involve money, credentials, contact changes, or document uploads. Independent verification through a known-good channel is more reliable than replying inside the original message thread.
Defensive controls should focus on domain protection, mailbox filtering, payment validation, multifactor authentication, and user awareness for election-season impersonation tactics. Where compromised accounts are suspected, review message rules, forwarding settings, sent folders, and recent login activity to determine whether the scam became a broader account takeover.
For a deeper control baseline around phishing-resistant authentication and access hardening, see NIST SP 800-63 Digital Identity Guidelines and NIST SP 800-53 Rev 5 Security and Privacy Controls.
Risk and Threat Considerations
Election scams are especially effective because they blend timing pressure with high-trust messaging. The same urgency that makes election communications useful for civic engagement also helps attackers capture credentials, redirect funds, or reach more victims through compromised accounts.
Failure mechanism: The attacker impersonates a trusted election-related sender or service, then uses urgency, authority, or false verification to induce a harmful action before the target can validate the request.
Impact: The result can be stolen money, compromised accounts, fraudulent disclosures, manipulated communications, and broader loss of confidence in election-related workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | AAL/Phishing-resistant authenticators — Digital Identity Guidelines | Election scams exploit login and verification abuse. |
| Recommendation — Require phishing-resistant authentication for accounts handling election communications and finance. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Campaign and election staff accounts are common scam targets. |
| AU-6 — Audit Review, Analysis, and Reporting | Post-scam review depends on tracing account and message activity. | |
| SI-4 — System Monitoring | Detection relies on suspicious login, sender, and forwarding-rule behaviour. | |
| Recommendation — Enforce strong user authentication on election-related systems and mailboxes. Review logs and mailbox activity to confirm whether the scam led to account abuse. Monitor election communications systems for impersonation, rule changes, and anomalous access. | ||
Practitioner Guidance
Why practitioners should care: Election scams rarely stay at the first fraudulent ask. Once a campaign inbox, volunteer list, or finance workflow is trusted, the attacker can reuse that trust to broaden the fraud or pivot into adjacent accounts and communications channels.
What to watch for: Requests that demand immediate payment, login, donation confirmation, routing changes, or secrecy deserve extra scrutiny, especially when the sender identity, domain, or tone is slightly off. In election periods, small inconsistencies are often the earliest warning sign.
Practitioner takeaway: The safest response is to slow the transaction down, verify through an out-of-band contact method, and treat any request involving credentials or payment as suspicious until independently confirmed.
Related resources from NHI Mgmt Group
- Why do bank impersonation scams create a liability problem for identity teams?
- Why do traditional fraud controls miss APP scams even when MFA succeeds?
- Why do MFA and transaction rules fail against impersonation scams?
- Why do pig butchering scams remain effective even with stronger security controls?