iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Protecting your accounts during an election starts with one rule: never authenticate, send money, disclose a code, or open a download because an election-related message tells you to. Open the service through its genuine app, a bookmark you already trust, or an address you type yourself. Then secure email first, use a different password on every important account, enable the strongest available multi-factor authentication (MFA), and verify urgent requests through a separate, known contact method.
Election themes make effective lures because they combine deadlines, civic responsibility, money and strong emotions. A message can arrive by email, text, social media, a phone call or a malicious website—and it can look polished. The guidance below applies to personal email, social, financial, cloud and other accounts. A separately labeled section covers controls intended for election-office staff.
What election-related phishing and impersonation look like
Phishing is an attempt to make you reveal information or perform an unsafe action. The message may ask for a password, one-time verification code, payment, personal data or a download. Election-themed versions can claim to concern voter registration, eligibility, ballot status, polling-place changes, campaign donations, a petition, a news alert or a supposed account problem.
Impersonation is broader than a fake email. An attacker may take over a real account and message its contacts, copy a public profile, or use a convincing voice, video or text message. A familiar name, logo or voice is not proof that the request is genuine. CISA’s 2024 guidance on generative AI and elections recommends confirming sensitive requests through a secondary channel and considering identity verification for real-time communications. For personal accounts, that means contacting the person or organization through a method you already know is real—not the phone number, reply address or link supplied in the suspicious message.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why election lures are persuasive
- Urgency: “Act before registration closes” or “fix your ballot today” discourages careful checking.
- Emotion: Political loyalty, fear of losing a vote, outrage or excitement can override normal skepticism.
- Authority: A message may imitate an election office, campaign, news outlet, donation service or a friend.
- Convenience: A one-click sign-in or payment request seems easier than finding the official site yourself.
These characteristics are warning signs, not automatic proof of fraud. Legitimate organizations can send imperfect messages, and sophisticated scams may contain no spelling errors. Judge the request, the channel and the independent evidence together.
Use this quick test before doing anything
Pause and answer each question before clicking, replying or paying:
- Was the message unexpected, unusually urgent, emotionally charged or tied to a deadline?
- Does it request a sign-in, password, verification code, attachment, payment or personal information?
- Does the sender address, phone number or destination domain differ from the organization’s known details? A display name or logo alone proves nothing.
- Can you open the service independently and see the same notice in your account?
- Can you confirm the request using a previously trusted phone number, website or in-person contact?
If any answer raises doubt, stop. Do not reply to “confirm” the request; a reply can tell the sender that your address or number is active.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteHow to tell if an election text is a scam
Do not use a text’s link or callback number to investigate it. Open your browser or the official app yourself and navigate to the relevant account or election-office website. For public election information, use an election office site or another independently verified source. CISA’s election-security toolkit explains that phishing can target election infrastructure, but it is not a directory for validating every campaign or fundraising message.
Never authenticate through a message link
A fake sign-in page can capture a password and the one-time code you enter immediately afterward. Some pages also try to make you install a browser extension or application. Even a page using a familiar logo can be hosted on an unrelated domain.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Instead, use one of these independent routes:
- Open the service’s installed application from your device.
- Use a bookmark you created before receiving the message.
- Type the service’s address yourself, checking the spelling and domain.
- Find the organization’s contact details through an official source you reached independently.
Never disclose a password, recovery code or MFA approval to an unsolicited request. If a caller asks you to read a code aloud or approve a sign-in you did not start, deny it and investigate through the genuine service.
Secure your most important accounts before an incident
1. Harden the email account that controls recovery
Email is often the reset channel for every other account, so protect it first. Set a unique, strong password and enable the strongest MFA the provider offers. Review the controls available in your account for:
- Recovery email addresses and phone numbers.
- Logged-in devices, active sessions and unfamiliar applications.
- Mail-forwarding rules and filters that could hide security notices.
- Recent sign-ins and alerts.
Remove details you no longer control. Keep the recovery route current, but do not add a number or address because an unsolicited “support” message tells you to.
2. Secure social, financial, cloud and reset-capable accounts
Apply MFA and unique credentials to social networks, banking and payment services, cloud storage, shopping accounts and any account that can reset another password. Social accounts deserve special attention because a compromised profile can impersonate you to friends, solicit money and spread additional malicious links.
Use the strongest privacy and security settings available. Remove unused accounts and limit public details—such as a full birth date, address, personal phone number or answers to common security questions—that could help an impersonator or a recovery scam.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Keep every password unique
Do not reuse a password between a campaign site, email, social platform and financial service. If one site is breached or you disclose its password to a fake page, reuse lets an attacker try the same credential elsewhere.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A password manager can generate and store unique passwords. Protect the manager itself with a strong master credential and MFA when offered. The manager solves credential reuse; it does not replace MFA or independent verification of messages.
4. Keep software and recovery routes current
Install operating-system, browser and app updates from the device maker or official app store. Updates reduce exposure to known flaws, while current recovery details help you regain control if a password is changed. Treat unsolicited technical-support contacts as suspicious, even when the caller knows your name or recent activity.
Choose MFA that resists phishing
Any MFA is safer than password-only access, but methods differ. CISA identifies FIDO/WebAuthn—used by security keys and passkeys—as the widely available phishing-resistant option. It binds the authentication to the legitimate website, so a fake site generally cannot complete the login. If an account does not yet offer it, number-matching MFA is an interim improvement over a simple push approval; SMS and ordinary push methods remain more exposed to interception, number-porting, social engineering or approval fatigue.
| MFA method | Phishing resistance | Availability and recovery considerations |
|---|---|---|
| FIDO/WebAuthn security key or passkey | Strongest of the commonly available options; designed to prevent authentication on a fake site. | Only works where the service and device support it. Enroll a backup key or another safe recovery method before relying on one device. |
| Number-matching push approval | Better than an undifferentiated “Approve” prompt because you must match a displayed number, but it is not equivalent to FIDO/WebAuthn. | Requires a compatible authenticator app and a reachable device. Deny unexpected prompts. |
| Ordinary push approval | Vulnerable to repeated prompts and social engineering if you approve one by mistake. | Convenient where offered; review and remove unknown devices. |
| SMS code | Less resistant to phishing and phone-number attacks than FIDO/WebAuthn. | Useful when stronger methods are unavailable, but maintain a separate recovery route and never read a code to a caller. |
Before buying a physical FIDO2 key, confirm that each important service supports it and that your devices have the required connector, wireless capability or browser support. Enroll a backup key or another recovery method and store it safely; otherwise losing the sole key can lock you out. Availability and interfaces vary by provider and can change.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Verify sensitive requests out of band
Use an independent channel whenever a request involves credentials, money, personal data, access to an account or a change to recovery information. For example, look up an organization’s official website yourself and call the published number, or start a new conversation with a contact using a number already saved in your address book. Do not trust contact details in the suspicious message.
For a purported election office, ask whether the request is real before sending information. An election office should not need your password or MFA code. For a friend or family member, call them directly rather than replying to the account that sent the request. A convincing voice or video is not sufficient evidence for a high-risk transaction; confirm through another channel.
What to do if you clicked, entered information or approved a request
Act quickly, but use only the genuine service. The exact recovery screens differ by provider, so treat the following as a practical sequence rather than a universal official checklist.
- Stop interacting with the message. Do not click additional links, open attachments, reply, send money or provide another code.
- Change the exposed password. Open the legitimate app or type the known address yourself. Change the password anywhere else you reused it, starting with email and financial accounts.
- End unknown access. Review active sessions, logged-in devices and connected applications; sign out unfamiliar entries when the service provides that control.
- Check recovery and forwarding settings. Remove unauthorized email addresses, phone numbers, forwarding rules and filters.
- Enable or strengthen MFA. Prefer FIDO/WebAuthn where available; otherwise use the strongest available method and deny unexpected prompts.
- Protect contacts. If your account may have sent messages in your name, warn contacts through a separate channel not to trust recent requests or links.
- Report and recover. Use the platform’s report function and follow the affected service’s current account-recovery instructions. Preserve the message, sender details and timestamps if you may need them for a report.
If you entered payment information, contact the financial institution through its independently verified number and monitor the account. If your device installed an unexpected application or extension, disconnect it from sensitive accounts while you investigate, then remove it using the device maker’s documented process.
Advice specifically for election-office staff
The controls in this section are organizational guidance, not a checklist that every voter can configure. CISA’s election-office checklist, marked as of September 6, 2024, recommends:
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- MFA on all accounts and unique credentials without credential sharing.
- Separate administrative accounts from ordinary user accounts.
- Strong passwords and official email for official business.
- DMARC for domain-based email protection.
- External-email warnings or labels so staff can recognize messages from outside the organization.
- Filtering known malicious indicators.
CISA’s election-security toolkit identifies voter information, election websites, email systems and networks as assets that may be targeted, and points election stakeholders toward phishing training and protective and detection resources. The toolkit says its list is not comprehensive and does not endorse commercial products. Offices should adapt controls to their systems, document an incident-reporting route and rehearse how staff verify urgent requests.
Common mistakes that undermine protection
- Trusting a familiar logo or display name: Both are easy to copy.
- Checking only for typos: Polished scams exist, and legitimate messages can contain mistakes.
- Approving a push because it is annoying: Repeated prompts may be an attempt to make you accept an attacker’s login.
- Using the same password with MFA everywhere: MFA can fail, be bypassed through recovery, or be socially engineered; unique passwords limit the damage.
- Relying on one recovery device: A lost phone or security key can create lockout. Set up a safe backup in advance.
- Sharing a code with “support”: Real support should not need your one-time authentication code.
A practical maintenance schedule
Today
- Secure the recovery email with a unique password and MFA.
- Turn on MFA for social, financial, cloud and other reset-capable accounts.
- Review sessions, recovery details and forwarding rules.
Before election-related activity intensifies
- Replace reused passwords with unique manager-generated credentials.
- Enroll a phishing-resistant passkey or security key where supported, plus a backup route.
- Check privacy settings and remove unnecessary public personal details.
- Tell household members how you independently verify urgent requests.
Whenever a suspicious message arrives
- Pause, inspect the request and open the service independently.
- Confirm sensitive requests through a known secondary channel.
- Report the message and delete it only after preserving details needed for recovery or reporting.
Frequently Asked Questions
Can a phishing link steal my account?
Yes. A fake sign-in page can capture a password and a code you enter, and some links deliver malicious downloads. If you used one, stop using the message, open the real service independently, change the exposed password everywhere it was reused, review sessions and recovery settings, and enable MFA.
How do I secure my social media during an election?
Use a unique password and the strongest MFA available, preferably FIDO/WebAuthn. Review active sessions, recovery details and connected apps, remove unused accounts, tighten privacy settings and limit public personal information that could aid impersonation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Should I buy a security key?
A FIDO2 security key is optional but useful when your important services support FIDO/WebAuthn. Confirm compatibility with your accounts and devices, and enroll a backup key or another safe recovery method to avoid lockout.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
