Check Point finds real campaign outreach and voter-verification scams hard to tell apart
Check Point says voters struggle to tell real campaign outreach from fraud, citing election-office warnings between July and September. Its researchers saw no activity aimed at voting systems or vote counting; the exposure they describe is in messages sent to voters.
The Watch · Security desk
Bar comparison of new domains created between September 1 and October 1: about 4,394 contained the word "vote" and 1,036 contained the word "election", according to Check Point.
New domains, September 1 to October 1 In new domains
| Item | Value | Claim |
|---|---|---|
| Containing "vote", about | 4,394 new domains | 19 |
| Containing "election" | 1,036 new domains | 19 |
What happened
- In September, viewers of a Pennsylvania TV station received a text telling them to "verify your voter profile," and the link in it was flagged as malware.
- A Rhode Island email came from an address that blended two real state domain names and threatened license revocation within 24 hours.
- Hays County, Texas cautioned residents about a mailer made to look like an official registration notice; its QR code pointed to a site that gathered personal information.
- A seller called Nexus advertised, on August 31, scans of identity documents belonging to more than 170 million people across the US and Canada, according to the listing.
- Phishing texts inviting recipients to "claim" a $5,000 payment appeared within hours of President Trump's September 9 speech promising one if Republicans keep Congress.
Why it matters
- constraint Each genuine message that looks suspicious weakens the next warning: a voter who learns one odd message was legitimate has less reason to question the next, even a fake, Check Point says.
- capability A message that quotes a driver's license number can pass for election-office mail, Check Point argues, because most states ask for that number at online registration.
- exposure Election staff are easier to target by name. Check Point found nine Oklahoma State Election Board credentials and cannot say whether the passwords work, but says the addresses alone are enough.
The station's investigator could not find out who sent the Pennsylvania text [2]. Check Point's researchers followed the link and reached a political fundraising page [3]. Check Point says the episode sums up its main finding: voters struggle to sort real messages from fake ones, and that uncertainty works in attackers' favor [25]. In our view the case shows where appearance stops being a usable test. A station investigator could not establish the sender [2], and a voter looking at the same text has less to go on.
From July through September, Rhode Island and Washington election offices issued warnings about bogus emails and texts that asked voters to confirm their registration details [4]. In Connecticut, the Secretary of the State's office cautioned that someone was spoofing its name in email [5]. Check Point says registration has nothing to do with a license, but the 24-hour deadline in the Rhode Island email pushed people to click before checking [7].
Check Point says the Hays County mailer seems to have come from a genuine third-party registration group, one whose mailings had already drawn concern from election officials in North Carolina and Georgia in July [9]. A small Georgia news outlet passed along a fundraising email, labeling it a phishing scam, because the email claimed the recipient's "Voter Verification File" had been flagged in a system audit [10]. Check Point cites that email as genuine outreach in the same style as the fraud.
The government figure in the report comes with a caveat. The White House said in July that China and groups acting for it had obtained voter registration data on up to 220 million Americans through purchase, theft, or hacking, but an administration official said intelligence agencies could not confirm how much came through each of those routes [13].
Lures also follow the news. In Texas, the Lamar County Sheriff's Office told residents that links in unsolicited texts are not how government payments are delivered [15]. Check Point's researchers also found phishing sites copying Kalshi and Polymarket with the midterms on the page [16]. It found 281 domains sharing one analytics ID that sell merchandise under candidate names from both parties [17]. Check Point does not know whether those stores are malicious, but because payment is taken on each store's own site, a supporter ends up entering card details on a page whose operator is unknown [18].
Between September 1 and October 1, about 4,394 new domains contained "vote" and 1,036 contained "election" [19]. Check Point found no active phishing on them yet, and says new domains often sit idle until the final weeks before an election [20].
What to watch
- Whether any of the new "vote" and "election" domains start serving phishing pages as the final weeks before the election arrive.
- Whether anyone identifies the sender of the Pennsylvania "verify your voter profile" text.
- Whether the Oklahoma State Election Board credentials turn out to be live.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In September, viewers of a Pennsylvania TV station received a text telling them to "verify your voter profile," and the link in it was flagged as malware.
- [2]
The Pennsylvania station's investigator could not find out who sent the text.
- [3]
When Check Point Exposure Management researchers followed the link, it led to a political fundraising page.
- [4]
Between July and September, election offices in Rhode Island and Washington warned voters about fake emails and texts asking them to confirm registration details.
- [5]
Connecticut's Secretary of the State warned about spoofed email using its name.
- [6]
The Rhode Island email came from an address that blended two real state domain names and threatened a license revocation within 24 hours.
- [7]
Registration has nothing to do with a license, but the 24-hour deadline pushed people to click before checking.
- [8]
Hays County, Texas warned residents about a mailer made to look like an official registration notice, with a QR code leading to a site that collected personal information.
- [9]
The sender of the Hays County mailer appears to be a real third-party registration group, and election officials in North Carolina and Georgia raised concerns about its mailings in July.
- [10]
In Georgia, a small news outlet shared a fundraising email as a phishing scam because it said the recipient's "Voter Verification File" had been flagged in a system audit; Check Point cites it as genuine political outreach in the same style as the fraud.
- [11]
Check Point Exposure Management researchers found nine credentials tied to Oklahoma State Election Board email addresses, some published as recently as September.
- [12]
Check Point cannot tell whether the Oklahoma passwords still work, but the addresses alone make election staff easier to target.
- [13]
In July, the White House said China and its proxies bought, stole, or hacked voter registration data on as many as 220 million Americans, though an administration official said the intelligence community could not confirm how much was obtained each way.
- [14]
Within hours of the September 9 speech in which President Trump promised a $5,000 payment if Republicans keep Congress, phishing texts invited recipients to "claim" it.
- [15]
The Lamar County Sheriff's Office in Texas warned residents that government payments do not arrive through links in unsolicited texts.
- [16]
Check Point Exposure Management researchers found phishing sites copying Kalshi and Polymarket with the midterms on the page.
- [17]
Check Point found 281 domains sharing one analytics ID that sell merchandise under candidate names from both parties.
- [18]
Check Point does not know whether the merchandise stores are malicious, but checkout happens on the site itself, so a supporter types card details into a page run by an unknown operator.
- [19]
Between September 1 and October 1, about 4,394 new domains contained "vote" and 1,036 contained "election."
- [20]
Check Point found no active phishing on those domains yet, and says new domains often sit idle until the final weeks before an election.
- [21]
Check Point Exposure Management researchers saw no activity aimed at voting systems or vote counting.
- [22]
A voter who learns that one odd message was legitimate has less reason to question the next, even if it is fake.
- [23]
On August 31, a seller called Nexus advertised identity document scans for more than 170 million people in the US and Canada on a Russian-language forum, including more than 153 million driver's licenses, according to the listing.
- [24]
Most states ask for a license number when someone registers online, so a message quoting those details can look like it came from the election office.
- [25]
Check Point says the Pennsylvania episode sums up the main finding of its report on 2026 US midterm election threats: voters are having a hard time telling which messages are real, and attackers benefit from that doubt.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- blog.checkpoint.comElection Scams Are Getting Harder to Spot as Real Campaign Outreach and Fraud Converge
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Leaked credentials and breached dataFollow
- PhishingFollow
- Election SecurityFollow