Campaign Spoofing Puts Donors at Risk

The FBI warns that scammers are impersonating political candidates and campaigns to solicit donations and steal personal information ahead of the midterms. Attackers use candidates’ names, logos, and AI-generated voices or messages, while weak email authentication can allow fraudulent messages to appear to come from real campaign domains.

Key findings

• The FBI warned that scammers are using candidates’ names, logos, and AI-generated voices and messages to request campaign donations and steal personal information.
• DigiCert reviewed 3,756 campaign domains and found that only 18% enforce DMARC, leaving many domains more vulnerable to email impersonation.
• Scammers can send messages that appear to come from a real campaign and ask supporters to donate or update personal details.
• AI makes it easier for criminals to personalize convincing phishing messages at scale.
• The article recommends authenticating all campaign email and moving DMARC from monitoring mode to enforcement.

Who’s being targeted

• Commonly targeted roles: Voters, Political donors, Campaign staff, Digital campaign managers, Fundraising teams, Communications teams, Board members, Email administrators.
• Affected industries: Political campaigns, Government, Financial services, Retail, Manufacturing, Nonprofit fundraising.
• Attack channels: email.
• Impersonated: A real political candidate or campaign.

Awareness takeaways

• Treat unexpected political donation requests cautiously, even when they use familiar campaign names and logos. Navigate independently to the campaign’s official website rather than using a link in an unsolicited message.
• Do not provide personal information in response to an unexpected campaign email. Verify the request through a trusted, independently found campaign contact channel.
• Organizations that send fundraising or customer-facing email should enforce DMARC, not merely monitor it, to reduce domain spoofing and impersonation risk.
• Assume phishing messages can be convincing and personalized. Good judgment should include independent verification, not just checking whether a message looks professionally written.

Red flags to watch for

• The sender may be spoofing a campaign domain rather than using an authorized campaign email system.
• An unexpected request for money or personal details creates urgency around a political event.
• Campaign branding, logos, and candidate names can be copied and are not proof that a message is legitimate.