Election Scams Are Getting Harder to Spot as Real Campaign Outreach and Fraud Converge

In September, viewers of a Pennsylvania TV station received a text telling them to “verify your voter profile.” The station’s investigator could not find out who sent it, and the link was flagged as malware. When Check Point Exposure Management researchers followed the link, it led to a political fundraising page.

That small episode sums up the main finding of our report on 2026 US midterm election threats. Voters are having a hard time telling which messages are real, and attackers benefit from that doubt.

Real outreach and fake outreach look alike

Between July and September, election offices in Rhode Island and Washington warned voters about fake emails and texts asking them to confirm registration details. Connecticut’s Secretary of the State warned about spoofed email using its name. The Rhode Island email came from an address that blended two real state domain names, and it threatened a license revocation within 24 hours. Registration has nothing to do with a license, but the deadline pushed people to click before checking.

Figure 1: Voter registration letter reported by Hays County Elections

Genuine political outreach uses the same style. In Texas, Hays County warned residents about a mailer made to look like an official registration notice, with a QR code leading to a site that collected personal information. The sender appears to be a real third-party registration group, and election officials in North Carolina and Georgia raised concerns about its mailings in July. In Georgia, a small news outlet shared a fundraising email as a phishing scam because it said the recipient’s “Voter Verification File” had been flagged in a system audit.

Confusion like this helps attackers. A voter who learns that one odd message was legitimate has less reason to question the next one, even if it is fake.

Breached data makes fakes believable

A message that knows something about you earns trust. On August 31, a seller called Nexus advertised identity document scans for more than 170 million people in the US and Canada on a Russian-language forum, including more than 153 million driver’s licenses, according to the listing. Most states ask for a license number when someone registers online, so a message quoting those details can look like it came from the election office.

Figure 2: Nexus listing shared on another dark web forum, identified by Check Point Exposure Management

Other exposures point the same direction. Check Point Exposure Management researchers found nine credentials tied to Oklahoma State Election Board email addresses, some published as recently as September. We cannot tell whether the passwords still work, but the addresses alone make election staff easier to target. In July, the White House said China and its proxies bought, stole, or hacked voter registration data on as many as 220 million Americans, though an administration official said the intelligence community could not confirm how much was obtained each way.

Scams follow the news

Within hours of the September 9 speech in which President Trump promised a $5,000 payment if Republicans keep Congress, phishing texts invited recipients to “claim” it. The Lamar County Sheriff’s Office in Texas warned residents that government payments do not arrive through links in unsolicited texts.

Check Point Exposure Management researchers also found phishing sites copying Kalshi and Polymarket with the midterms on the page, and 281 domains sharing one analytics ID that sell merchandise under candidate names from both parties. We do not know whether the stores are malicious, but checkout happens on the site itself, so a supporter types card details into a page run by an unknown operator.

Video adds another layer. Edited celebrity clips carrying news logos urged viewers not to vote for one party, and researchers cited by AFP attributed them to a Russian disinformation operation. Campaigns also ran AI-generated versions of their opponents in ads, and 28 of the 31 states with political deepfake laws require only a disclosure statement rather than an outright ban, according to the National Conference of State Legislatures.

What we did not see, and what to do next

Check Point Exposure Management researchers saw no activity aimed at voting systems or vote counting. Between September 1 and October 1, about 4,394 new domains contained “vote”, and 1,036 contained “election.” We found no active phishing on them yet, but new domains often sit idle until the final weeks before an election.

Table 1: New domains containing election terms, collected by Check Point Exposure Management

Voters can protect themselves with a few habits:

• Go to the official state or county election site directly instead of using a link, QR code, or phone number in a message.
• Do not rely on a sender address or accurate personal details, since breached data supplies both.
• Treat urgency as a reason to slow down and set a PIN with your mobile carrier so no one can move your number to another device.

As election day draws near

As Election Day draws near, Check Point researchers recommend relying on official local election channels for trusted information and updates. Voters should watch for lookalike domains, unexpected election-related messages, and requests for sensitive information. At the same time, election offices can strengthen security by monitoring for exposed credentials and requiring multi-factor authentication, while campaigns should clearly identify themselves in all voter outreach.

Check Point Exposure Management researchers uncover election-related scams by monitoring dark web forums, newly registered domains, and leaked credentials. The platform gives security teams that same outside-in view of their organizations, helping them identify and remediate risks before attackers can exploit them.

The coming weeks will bring more legitimate campaign outreach, and potentially more fraudulent messages designed to mimic it. Whether you’re a voter, campaign worker, or election official, a few moments spent verifying a message before acting can make all the difference.

Read the full 2026 US Midterm Election Threats: Pre-Election Update report from Check Point Exposure Management for complete finding, analysis, and recommendations.