On September 17, 2026, the Rhode Island Department of State warned voters about a fraudulent text message posing as an official voter registration request. The message asked recipients to click a link to confirm their identity for their voter record, and used phrasing that closely resembled real election office communications, making it easy for voters to be fooled. Rhode Island quickly clarified that the message was unauthorized while directing voters to official channels.
Incidents like this have become common as election offices rely more on text messages and emails to reach voters. These messages are now essential tools for registration reminders, ballot-status updates, polling place information, and notifications of last-minute changes, helping voters plan ahead and reduce confusion. But they also create a new security reality: any electronic communication a legitimate election office can send, a scammer can imitate.
That’s the security nexus. Mass notifications are now a part of election infrastructure, and like any part of infrastructure, they can be exploited. The solution isn’t to stop using them. It’s to make them predictable enough that voters can authenticate them at a glance.
The Security Problem: Impersonation is Easy
Electronic communication is fast and convenient. It’s also fertile grounds for spoofing, as we have seen across various industries, and elections are no different. A scammer only needs a phone number or email account, a basic understanding of election terminology, and a bit of creativity to craft a message that looks official, which has only become easier with AI. In a busy world, people often act quickly, clicking links and responding to prompts when a sender “feels” right.
Election offices can’t control the existence of fraudulent messages. But they can control how recognizable their legitimate messages are. When official communications follow a consistent pattern, fraudulent messages stand out.
The Security Solution: Predictability
The most powerful security tools election officials already have are recognizability and consistency. When voters know the message is coming from the official source and know what real messages look like, they can more easily spot fake ones before clicking anything.
Here are the best practices that turn mass notifications into a security asset.
1. Make your identity obvious.
The first words of a message, the sender’s name, and the email subject line should immediately answer 3 questions:
- Who sent this?
- Why did I receive it?
- How can I verify it?
Messages like:
[State/County Name Elections] Your ballot has been received. Check your status at CountyName.gov/elections.
are instantly recognizable. Messages that begin with “Important Voter Alert” are not.
Clear identity is a security control because it reduces ambiguity which reduces vulnerability. Recognizability and legitimacy come with a .gov domain so ensure your election office is using a .gov email account and informing voters to verify the content at your .gov website.
2. Use one official number or email address for distribution.
Scammers thrive on inconsistency. If your office uses a different number every election cycle, or worse, every message, voters have no baseline for authenticity.
Where technically feasible, use:
- A consistent SMS short or long code
- A consistent sender ID
- A consistent .gov email address and website domain
Publish these on your website, in media releases, on social media, and in voter-facing materials. When voters know that official election texts come from “12345” everything else becomes suspicious. This is authentication through predictability.
3. Publish your messaging practices before Election Day.
Don’t wait for a scam to explain what legitimate messages look like. Create a page titled “How to Recognize Official Election Messages” and link to it prominently. It should explain:
- Whether your office sends texts, emails, or both
- The types of information you send
- Your official sender number and email address
- Whether messages contain links
- What website voters should use to verify information
- What you will NEVER ask for
- How voters can report suspicious messages
- How voters can opt out of texts and unsubscribe from emails
This page becomes your public source of verification. It’s a reference point voters can check independently.
4. Make your website the single source of truth.
Links inside messages are inherently risky. Even legitimate ones can look suspicious. The safest verification mechanism is one voters can access on their own. Make the message clear and verifiable so voters don’t have to trust the link in the message:
If you receive a message that appears to come from us, go directly to State/County Name.gov/elections.
When every message points back to the same authoritative website, voters learn the habit of independent verification. That habit is a security win.
5. Use government domains consistently.
A .gov domain is not a perfect security guarantee, but it is a strong visual signal. Avoid using:
- Multiple unrelated domains
- URL shorteners
- Third-party domains that obscure the destination
If you must use a vendor, explain the relationship publicly on your website and reiterate it in the message:
Our election office uses XYZ Communications to send voter messages. Messages from this program will identify State/County Name Elections as the sender and will direct you to State/CountyName.gov.
Transparency reduces confusion, and confusion is where scammers operate.
6. Publish what you will never request.
This is one of the simplest and most effective protections.
Our election office will never ask you to provide sensitive information, such as your social security number, bank account information, credit-card information, or password by email or text.
When voters know the boundaries, they can spot when something is out-of-bounds.
The Rhode Island scam asked voters to “confirm their identity.” That’s a plausible request, but only if voters don’t know the office’s actual practices.
7. Don’t make your own messages look like phishing.
Before sending a mass notification, conduct an “adversarial review:”
- Does it contain an unexpected link?
- Does the domain look unfamiliar?
- Does it create unnecessary urgency?
- Does it ask for personal information?
- Does it contain a phone number or email that differs from the election office’s published information?
- Does the sender identity match what you’ve published?
If your legitimate message resembles a phishing message, voters will treat it like one. That undermines both communication and security.
8. Have a standard response procedure for suspicious messages.
When voters report a suspicious message, election offices should:
- Collect screenshots, sender information, timestamps, URLS, and any voter interaction
- Confirm whether the message originated from the office or a vendor
- Determine whether the sender identity was spoofed
- Escalate to state officials, vendors, law enforcement, or federal agencies when appropriate
Not every incident requires a public announcement. But when a scam impersonates the election office, requests personal information, directs voters to a fraudulent website, or appears at scale, a public advisory is appropriate. Share the information with the election community; when one jurisdiction is spoofed, it is likely others will be as well.
The advisory should be clear, calm, and direct:
We are aware of fraudulent messages claiming to be from the [State/County Name] Election Office. These messages are not authorized. Do not click links or provide personal information. For official information, visit State/County Name.gov/elections.
This reinforces the single source of truth.
The Bottom Line: Predictability Is a Form of Protection
Election offices should continue using text and email. They are effective, accessible, and voter-friendly. But it is vital to treat mass notifications as a part of election security.
When legitimate messages are predictable, recognizable, and independently verifiable, fraudulent ones become easier for voters to identify and easier for election offices to address.
Make your communications consistent enough that voters can authenticate them at a glance, and you transform mass notifications from a vulnerability into a defense.