The Cybersecurity and Infrastructure Security Agency and the FBI warned election and campaign staff on Oct. 16 that midterm fundraising season is prime time for phishing and smishing aimed at stealing login credentials to donor files, voter data exports, and wire-instruction inboxes.
Who is in the crosshairs
The public service announcement is aimed at county clerks, state election IT teams, campaign treasurers, and volunteer coordinators—not voters scanning Instagram ads. Attackers mimic legitimate fundraising platforms, cloud document shares, and payroll vendors. The agencies note that generative tools make voice clips and message drafts more convincing, which raises the payoff for compromising a single campaign Gmail account.
Unlike the FBI’s separate Oct. 15 consumer alert about fake donation “investment pools,” this guidance assumes the victim already has access to sensitive systems. A stolen password on a finance director’s account can redirect ACH batches or export donor PII for resale.
Controls CISA wants in place now
Agency guidance prioritizes phishing-resistant MFA—FIDO2 security keys or passkeys where possible—rather than SMS one-time codes that attackers can SIM-swap. IT shops should flag external email banners, route suspicious messages to a security mailbox, and block executable attachments at the gateway. Patching and multifactor coverage for VPN entry points get explicit mention because many small campaigns outsource IT to a single consultant.
Staff should verify wire and payroll changes through a second channel, even when the request looks like it came from a candidate. CISA publishes a fact sheet on implementing phishing-resistant MFA that local governments can hand to vendors.
What volunteers should do
If you handle money for a campaign, use hardware keys or platform passkeys on the accounts that can move funds. Do not approve password resets from an unsolicited text. Report incidents to a local FBI field office or ic3.gov with headers and screenshots. Voters worried about donation scams should still use fec.gov to verify PAC registrations, but this alert is about keeping the back office from becoming the breach vector while fundraising emails peak in late October.
How attacks showed up in past cycles
Federal officials referenced prior election years in which county networks were hit with ransomware days before early voting and in which campaign treasurers received spoofed wire instructions that appeared to come from consultants. The Oct. 16 bulletin does not cite a single new breach, but it treats the midterm calendar as predictable risk: fundraising spikes in October, volunteer turnover is high, and part-time staff may lack corporate-grade security tooling.
Phishing-resistant MFA means factors that resist real-time relay attacks—hardware security keys, device-bound passkeys, or platform authenticators tied to biometrics—not SMS codes that attackers can capture through SIM swaps. CISA’s implementation guide walks IT vendors through rolling those methods out on Google Workspace and Microsoft 365 tenants commonly used by campaigns.
Reporting and recovery steps
If credentials are compromised, CISA recommends isolating the affected device, forcing password resets from a clean machine, and reviewing audit logs for mail-forwarding rules attackers use to hide wire fraud. Election offices should coordinate with the FBI’s CyWatch line and their state chief information security officer before wiping hardware, because forensic images may be needed for criminal referrals.
Donor-facing teams can reduce risk by never collecting card numbers over email and by using FEC-compliant processors with tokenized checkout pages. The PSA is not a voter guide, but it indirectly protects donors by keeping campaign finance systems online through Election Day on Nov. 3.