As the 2026 midterm elections draw nearer, a surge in fake election websites poses a significant risk to voters, potentially leading to compromised personal information and illicit financial transactions. Internet intelligence company WhoisXML API has identified over 62,000 domains incorporating election-related names created since September 2025, with a subset of these actively mimicking campaign storefronts and donation pages.
Researchers found that approximately 13,645 of these domains presented campaign-style addresses, designed to appear credible. While many may be controlled by legitimate campaigns, supporters, or domain investors, a concerning number operate as live storefronts selling merchandise and accepting donation-style payments under the guise of supporting specific candidates. These sites leverage familiar campaign cues, such as polished product photos and standardized checkout processes, to foster trust.
Alexandre François, the WhoisXML API researcher behind the study, noted that the use of AI can accelerate the creation of convincing fake websites, making it increasingly difficult for consumers to distinguish authentic pages from fraudulent ones. The study found that a significant majority of these suspicious domains, 90%, obscure the registrant's identity, and 88% were registered for a short, one-year term, raising further red flags when combined with deceptive branding.
Tactics of Deceptive Websites
Fake election websites often employ subtle alterations to domain names, such as replacing a legitimate domain ending like ".com" with ".us" or adding words like "official," "store," or "donate." For instance, a site mimicking a known fundraising address might differ by only the top-level domain. Similarly, a domain registered for a candidate might be significantly younger than the official campaign website, as seen with one example that was 58 days old compared to an official site dating back to 2008.
These deceptive sites may even present a confusing mix of merchandise, selling both pro-candidate items and merchandise critical of the same candidate. Furthermore, some have been observed accepting donation-style payments up to $1,000, even after official campaign donation channels have closed. While the study found no direct evidence of donors losing money or having data misused, the payment platforms themselves are the only entities with visibility into such outcomes.
Revealing Clues in Domain Records
Domain registration records can offer valuable insights, including creation dates, registration periods, and privacy settings. However, legitimate reasons exist for using privacy services and short registration terms. The risk escalates when these details are observed alongside other indicators of deception, such as a domain closely resembling an official address, an unofficial donation flow, or a mismatched disclaimer.
Federal political committees are required to include disclaimers identifying who paid for the communication. The absence or vagueness of such a disclaimer, or a committee name that does not match official records, should prompt immediate caution. Campaigns themselves face challenges in securing every possible domain variation and often rely on monitoring new registrations to identify and report fraudulent sites.
Staying Safe Online
To avoid falling victim to these scams, voters are advised to verify campaign websites and donation links through trusted sources. Instead of clicking on links from unsolicited texts, emails, or social media posts, individuals should independently search for the candidate's official website. Cross-referencing with verified social media accounts can also help confirm legitimacy.
When making contributions, voters should check if payment processors like ActBlue or WinRed appear in the URL, indicated by secure.actblue.com or secure.winred.com, though other processors may also be used. Scrutinizing the full web address for misspellings or unusual endings is crucial. Additionally, scrolling to the bottom of a website to check for a clear disclaimer identifying the paying committee and comparing it with FEC records is recommended.
Consumers are also encouraged to compare the merchandise store or donation page with the official campaign website, paying attention to contact details and return policies. The presence of a browser padlock indicates an encrypted connection but does not verify the authenticity of the website operator. Urgency tactics, such as countdown timers for donations, should be treated with suspicion.
Using a credit card for purchases offers stronger dispute protections than a debit card. Keeping receipts and taking screenshots of transactions is advisable. For online accounts, using unique passwords generated by a password manager and enabling two-factor authentication is essential for security. If a suspected scam occurs, contacting the card issuer or bank immediately to report the issue and request a transaction reversal is a critical step. Reporting the incident to the FTC's ReportFraud system can also aid in broader investigations.