What happened
Three weeks before the US midterm election, the FBI published a public service announcement warning that scammers could exploit the 2026 vote to run financial fraud schemes. The alert updates a similar warning issued before the 2024 general election.
The bureau said scammers use the names, images, logos and slogans of candidates to fraudulently solicit campaign contributions, sell merchandise that is never delivered, and steal personally identifiable information for use in other fraud. Scammers also use artificial intelligence tools to generate realistic voices, images and written messages that impersonate candidates, campaigns, government entities and contacts the victim trusts. The FBI said that realism makes the schemes harder for victims to detect and increases the likelihood of financial loss or exposure of personal data.
The announcement describes a "campaign investment pool" scheme, where victims are promised a guaranteed return on contribution dollars after the candidate wins and are encouraged to recruit others to increase their share of the payout. It also covers fake political action committees that collect money and keep it, non delivery scams on campaign merchandise, and a voter registration scheme. In that last one, a text or email claims the recipient is not registered to vote and links to a fake state voter registration page. The FBI described it as "a means to steal PII for identity theft and potentially to further target victims for additional fraud schemes." The bureau reminded the public that campaign donations are not an investment and will not increase in value or be returned.
Max Gannon, cyber intelligence team manager at Cofense, said election season hands threat actors "a ready-made lure that takes little creativity, skill, or experience to use," and that AI "has erased the clumsy mistakes that once gave these scams away." He advised verifying any pressure filled message through a source found independently, such as the Federal Election Commission or vote.gov.
Why this is a GRC story
Impersonation is now cheap and specific. A cloned voice removes the awkward tell that used to make a fraudulent request obvious. Controls that rely on recognising a familiar voice need a second, independent channel of verification.
Stolen voter data is a data protection problem, not only an election one. Personal information collected through fake registration pages supports identity theft and further targeting, which then lands on banks, employers and service providers that have to detect the resulting fraud.
Election periods are a known spike window. Fraud and social engineering teams should expect a rise in themed lures reaching staff and customers. Awareness messages sent before the event cost far less than incident response afterwards.
What to watch
Watch whether the complaint data after the November vote shows measurable losses from these schemes, and how platforms and regulators respond to cloned voice and video content in political and commercial settings. Internally, the useful test is whether staff can name the independent verification step they should take when a caller claims urgency and authority, and whether policy requires that step rather than leaving it to individual judgement.
Attribution: Analysis based on the FBI's public service announcement and related public reporting. This article is original commentary, not a repost of the source material.