What breaks when online voting systems rely on cookies or IP addresses to prevent repeat votes?

Why Cookie and IP Checks Fail as Repeat-Vote Controls

Cookie and IP checks answer the wrong question for voting integrity. They ask whether the browser or network location looks familiar, not whether the person behind it is a unique eligible voter. That makes them weak as anti-duplication controls, because the signal is easy to reset, share, or route around and does not bind the vote to a durable voter record.

Online voting systems also have to deal with normal network behaviour that these checks misread. One household, campus, office, mobile carrier, or VPN exit can generate many legitimate voters from the same address, while one determined participant can return with a fresh cookie, a different browser profile, another device, or a different network path. The result is both false negatives and false positives.

The deeper design problem is that repeat-vote prevention is an authorization and identity problem, not a session-fingerprinting problem. If the control cannot distinguish a repeat submission from a new legitimate voter, it can only slow casual abuse. For election architecture and voter access design, NHIMG’s Election Security Guide is the natural starting point for the wider control environment around voting systems.

What an Attacker or Abuser Can Do Instead

Once a system depends on cookies or IP addresses, the attacker’s job becomes simple: change the session marker, change the network marker, or use a shared path that makes the system unsure. That can be done with browser resets, private browsing, alternate devices, mobile handoff, proxies, or VPNs. Even without malicious intent, shared NAT or organisational networks can make honest voters appear duplicated.

This is why the control can be bypassed without breaking the voting platform itself. The underlying application may still record ballots correctly, but the duplicate-prevention layer has no stable basis for deciding whether a vote is from a new person or a returning one. The weakness is structural, not cosmetic.

Repeated attempts to stop abuse with weak signals often create a misleading sense of safety. Teams may see fewer obvious repeat submissions and conclude the control works, while a determined user can still vote more than once. For a broader view of how network-level signals can be spoofed or obscured, NHIMG’s Source Address Validation and Anti-Spoofing Guide explains why network origin alone is not a trustworthy identity signal.

What a Better Repeat-Vote Control Has to Prove

A durable control has to bind the action to a unique voter account, validated credential, or equivalent authoritative identity record, then enforce one eligible vote per record. That usually means separating voter authentication from ballot secrecy, so the system can confirm eligibility without turning the ballot into an identity artifact. The important property is uniqueness, not convenience.

Strong designs also need a recovery path for legitimate re-voting edge cases, such as an issued replacement ballot or a corrected registration state. The control should be explicit about which event revokes the earlier opportunity to vote and which evidence proves that the later vote is the valid one. Without that rule, operators end up relying on heuristics instead of an auditable decision.

For teams comparing access patterns and network assumptions, the relevant lesson is that address-based controls are at best coarse supporting signals. NHIMG’s NAT and Its Security Implications Guide is useful background for understanding why many users can legitimately share one public IP and why IP-based uniqueness is a poor proxy for personhood.

Practitioner Guidance

What to verify: Confirm that the anti-duplication rule is tied to an authoritative voter record, not just a browser artifact or source address. If the system cannot explain why one voter record can submit only one valid ballot, the control is not ready for production use.

Decision rule: If the control is being used as a hard stop, treat it as insufficient unless it is backed by authenticated voter identity and a verifiable one-vote state machine. If it is only being used as a soft signal for anomaly review, make that explicit and do not present it as integrity enforcement.

What practitioners underestimate: The biggest failure mode is not sophisticated compromise, it is false confidence. A mechanism that blocks casual repeat clicks can still leave the election open to determined repeat participation, while also penalising legitimate voters who share networks or devices.

Practitioner takeaway: Repeat-vote prevention must be built on durable identity and issuance rules, because cookies and IPs are observation signals, not trustworthy proof of unique voter entitlement.

Related resources from NHI Mgmt Group

• What breaks when fraud controls rely on IP addresses and cookies alone?
• What breaks when organisations rely on cookies or IP address alone to identify suspicious sessions?
• What do teams get wrong when they rely on cookies or IP addresses to detect guest checkout fraud?
• Why do sessions, cookies, and IP tracking still fail to prevent repeat fraud in modern web applications?