The FBI Says Midterm Season Is Open Season on Your Wallet and Your Voter File
On October 15, 2026, IC3 published PSA261015-3: scammers are riding the 2026 U.S. midterm election the same way they rode 2024. Fake campaign money pitches. Fake PACs. Merch that never ships. Fake voter registration links that harvest PII. AI deepfakes of candidates and “trusted” voices. The cyber industry will sell you a webinar. The FBI wants you to stop clicking and start reporting. For once those are compatible hobbies.
This PSA updates I-102924-PSA from October 29, 2024. Same playbook, new election cycle, better generative toys for the bad guys. If someone needs your Social Security number to “confirm you can vote,” that someone is not your county clerk.
What IC3 says the schemes look like
Scammers use names, images, logos, and slogans of candidates to solicit fake contributions, sell merchandise that never arrives, or steal PII for follow-on fraud. They also use AI tools for realistic voice, image, and text impersonation of candidates, campaigns, government entities, and trusted contacts. IC3’s point is not subtle: realism went up, victim detection went down, losses and PII exposure go up with it.
Campaign Investment Pool
You are promised a “guaranteed return” on campaign contribution dollars by parking money in a candidate campaign pool that supposedly pays out after the candidate wins. Bonus round: recruit your friends to grow your share. That is not civic engagement. That is a pyramid with a yard sign.
Political Action Committee scheme (ScamPACs)
You think you are donating to a real PAC, Super PAC, or candidate committee. The scammers have no affiliation and keep the money. Some scam PACs may even look registered. IC3’s tip: if a PAC shows weirdly high fundraising, consulting, compliance, or admin expenses relative to actual political spend, treat that as a smell test, not a vibe.
Online purchase / non-delivery
Campaign merch sites that take payment and ship nothing. Classic non-delivery fraud wearing a red, white, and blue hoodie. Check BBB complaints and reviews before you buy the limited-edition hat from a domain registered last Tuesday.
Voter registration scheme
Text or email says you are not registered in your state. Link goes to a fake state registration page. Goal: steal PII for identity theft and future fraud. Real registration checks belong at www.vote.gov, not in a SMS from “Election Office” with three spelling errors and a sense of urgency.
Defenses that are boring and effective
IC3’s tips, translated out of brochure English:
- Unsolicited calls, texts, emails, surveys: do not hand over PII. Do not click unknown links. Curiosity is how you fund someone else’s vacation.
- Campaign donations are not investments. They do not appreciate. They do not get returned as profit. Anyone promising ROI on a contribution is selling you a story.
- Verify PAC / party / candidate committee registration and financial filings on the Federal Election Commission (FEC) site. Registration alone is not a halo.
- Confirm contact info actually belongs to the org it claims. Spoofed caller ID and lookalike domains are not advanced. They are Tuesday.
- Research sellers before political merch purchases. BBB.org and complaint history beat influencer urgency.
- Check real voter registration at vote.gov, not at panic-link.example.
AI deepfakes: the new coat of paint on old theft
IC3 explicitly calls out AI-generated voices, images, and messages impersonating candidates and trusted contacts. The technical bar for a believable 20-second clip dropped through the floor. The social bar for “my senator called and said wire this PAC” should not drop with it.
Practical habits:
- Out-of-band verify: if a “candidate” asks for money via a novel channel, confirm through a known official site or number you looked up yourself
- Assume voice clones exist for anyone with enough public audio. Callbacks to published campaign HQ numbers beat trusting the inbound call
- Treat viral “exclusive donation match ending in 15 minutes” media as hostile until proven otherwise
Related IC3 messaging around election season has repeatedly warned about impersonation of government and campaign brands. The pattern is consistent across cycles. Only the rendering engine got an upgrade.
How to report without becoming a forum detective
IC3 wants detail, not vibes. If you hit an election-related scam:
- Report to your local FBI field office or www.ic3.gov
- Include: who contacted you; phone, address, email, websites; payment method and transaction info; how contact started; what you were told; what you sent
Incomplete reports still help. Perfect novels are optional. Screenshots and headers beat “it looked official.”
What this is not
- It is not a claim that legitimate campaigns are scams. Real fundraising exists. Scammers parasitically copy it.
- It is not permission to ignore official election communications from addresses and sites you independently verified.
- It is not a substitute for your state’s election security guidance. It is a fraud PSA.
Sloth take
Every election cycle the same script ships with a new skin. Fake PAC, fake merch, fake registration, now with AI voice so grandma thinks the governor called. The cyber industry will turn this into a keynote about “the threat landscape.” The useful version fits on a sticky note: vote.gov for registration, FEC for committee reality checks, no ROI on donations, report to IC3. Democracy is hard. Spotting a phishing domain should not be.
Building awareness content that does not sound like a corporate hostage video? Dark Edge Consulting can help.
Sources
- FBI IC3 PSA: Scammers Exploit 2026 U.S. Midterm Election to Perpetrate Multiple Fraud Schemes (PSA261015-3, Oct 15, 2026) – https://www.ic3.gov/PSA/2026/PSA261015-3
- Prior related PSA I-102924-PSA (Oct 29, 2024) referenced by IC3 as the update baseline
