As the 2026 US midterm elections approach, cyber scammers are targeting voters with fake campaign websites. A new analysis by internet intelligence firm WhoisXML API reveals that 62,081 election-themed domain names have been created since September 2025. Of these, 13,645 are named to read like campaign sites.
While some of these sites may be legitimate, others use candidate names to sell products and collect donation-like payments. Researchers note that fake sites carry the risk of collecting voters' personal and financial data.
Why are fake election sites on the rise?
National election periods lead to a huge surge in demand for online domain names. While campaign teams want to grab catchy addresses, supporters open fan pages and merchants sell political merchandise. Scammers exploit this confusion by using the same naming formulas.
According to the research, about 46 percent of campaign-like domain names use the "[name]for[office]" or "for[state]" structure. Domain names referencing congressional races are the most common. Senate-themed names come second, while state names are used in a third of the domain names. Texas leads with 537 registrations, followed by Florida, Georgia, Ohio, and Colorado.
How do fake sites mimic real ones?
A small change in the domain name can go unnoticed. WhoisXML API found that massiemoneybomb[.]us closely resembles massiemoneybomb[.]com, a well-known fundraising address. The main difference is the extension after the dot. On a phone screen or in a directly opened link, spotting this difference becomes even harder.
Another site examined, kenpaxton[.]us, was detected when it was 58 days old. Meanwhile, kenpaxton[.]com had been registered since 2008. The fake site sold products supporting the candidate as well as products criticizing the same candidate. This unusual mix hints that the store may not have an official connection.
Alexandre François, who conducted the research, said that artificial intelligence could help operators create convincing sites quickly and at scale.
How do fake donation pages collect data?
According to the research, some store sites allowed visitors to add donation-like payments of up to $1,000 to their shopping cart. Payment processing was carried out through their own payment flows. One store reportedly continued to collect donations even after the candidate's official donation page stopped accepting contributions.
During checkout, full name, address, email, and phone number, as well as credit card information, were requested. Using a familiar payment processor may make the form feel secure, but this only shows how the payment proceeds; it does not verify that the candidate authorized the store or that the money goes to the campaign.
François stressed that the research found no direct evidence that donors lost money or that their data was misused. He said only the payment platforms could access such data, and that information was not part of the study.
How to protect yourself from fake election sites
Before buying online campaign merchandise or making a political donation, apply these checks:
- Reach the campaign from a trusted source: Don't start with links from an unexpected text message, email, or social media comment. Search for the candidate independently and compare the result with the candidate's verified social media account or official profile. François said, "No single sign is enough; it's best to check several together and reach the page through the campaign's own channel."
- Check the full web address: Before entering payment details, look at the address bar. Examine the spelling and the domain extension. Watch out for extra words or letters that mimic the campaign's real address. Scammers may use ".us" instead of ".com", or add words like "official", "store", or "donate".
- Look for the campaign legal disclaimer: Look at the bottom of the site and around the donation form. A federal political committee site must state who paid for the communication. Compare this committee name with the Federal Election Commission (FEC) database. If the names don't match or the disclosure is vague, leave the page.
- Compare the store with the official campaign site: Open the candidate's known website in a separate tab. Look for a direct link to the merchandise store or donation page. If the official site redirects you elsewhere, use that link.
- Know what the lock icon in the browser means: The lock icon only indicates that the site uses an encrypted connection. It provides no proof about the person or business behind the page.
- Slow down when the page creates urgency: Pressure can cause you to overlook obvious warning signs. Be wary of a site that claims a donation match will disappear within minutes.
- Pay by credit card if possible: Credit cards generally offer stronger dispute protection than debit cards. The Federal Trade Commission (FTC) notes that legal protections for credit cards are more comprehensive in billing disputes.
- Use strong antivirus software: A fake campaign site could launch a malicious download or redirect you to other dangerous pages.
- Never use the same password on a campaign store: If the store asks you to create an account, use a unique password. Enable two-factor authentication (2FA).
What should you do after paying on a fake election site?
As soon as you suspect a problem, contact your credit card company or bank. Explain the situation and ask if the transaction can be reversed. The FTC advises consumers who paid a suspected scammer by credit or debit card to contact the card issuer and request a chargeback.
Then file a fraud report through the FTC's ReportFraud system. If you think the site may have violated federal campaign finance law, you can also review the FEC's complaint process.
Remember that fake sites are becoming increasingly sophisticated. The speed and scale provided by artificial intelligence make it harder to judge campaign pages based on appearance alone. Verifying through official sources remains your most effective weapon.
