FBI and CISA Warn AI Scams Target 2026 Midterms for Cash and Data
Hackers are using AI to clone candidate voices and generate fake donation pages ahead of the 2026 midterms to steal your money and data.
Policy · Source: Reuters
What happened
The FBI and CISA just issued a joint warning ahead of the 2026 U.S. midterm elections. Hackers are deploying AI to run sophisticated financial fraud and data theft operations. They are not just trying to sway your vote. They want your wallet and your personal information. Election officials, candidates, and political organizations are primary targets due to their access to sensitive voter data.
Scammers are using AI tools to clone candidate voices and generate highly convincing fake images. They use these deepfakes to solicit fake campaign donations and sell merchandise that never arrives. In one bizarre scheme, fraudsters are pitching campaign contributions as an investment pool. They promise victims a guaranteed return that supposedly pays out if a candidate wins. They even encourage victims to recruit others into the scam.
The attacks also target voter data directly. Threat actors send text messages claiming the recipient is not registered to vote. These messages link to fake state voter registration pages designed to harvest personally identifiable information. The FBI notes that AI has eliminated the poor grammar and spelling mistakes that used to make phishing obvious. The threat is global. Social media platform X recently suspended over 13,000 accounts linked to foreign influence operations targeting U.S. politics. In the UK, Prime Minister Andy Burnham accused Russia of using bots and fake websites to forge the branding of 28 British organizations.
Key facts
- 2026 — The year of the upcoming U.S. midterm elections targeted by these scams.
- 13,000 — Number of accounts X suspended for suspected foreign influence operations.
- 28 — Number of British organizations whose branding was forged by Russian actors.
Why it matters
Security baselines are shifting for anyone building communication or payment tools. AI makes it incredibly cheap to generate flawless localized phishing campaigns and realistic audio clones at scale. Threat actors now use super intelligence tools to facilitate a continuous learning process that improves automated emails. They use native languages and common vernacular perfectly. If you build software that handles user data or financial transactions, you can no longer rely on users spotting clumsy errors. The barrier to entry for cybercrime has collapsed. Election season hands threat actors a ready-made lure that takes zero creativity to exploit.
Trust in digital communication is breaking down entirely. As threat actors flood the zone with deepfakes and spoofed messages, users will stop trusting unverified links and audio. This forces platforms to adopt strict provenance standards. Builders will need to integrate phishing-resistant multi-factor authentication and robust spam filters just to keep baseline trust. Organizations must also implement standards like Sender Policy Framework and Domain-Keys Identified Mail to limit server spoofing. The UK is even launching a National Centre for Information Defence to combat hostile state information attacks. Governments are preparing for a long war against synthetic media. Software builders are on the front lines.
For builders
Require phishing-resistant MFA
The FBI specifically urges organizations to adopt phishing-resistant multi-factor authentication. If you build enterprise software, your customers will demand this to protect against AI-powered credential harvesting. Legacy password systems are a massive liability.
Adopt watermarks and credentials
CISA advises users to check for watermarks indicating AI-generated content. Platforms that host media must integrate content credentials to help users verify authenticity. If you ignore this, you risk liability for hosting deepfake scams.
Secure encrypted chat apps
The FBI reports an increase in smishing attempts through encrypted chat applications. Builders of messaging platforms must improve spam filtering and external sender warnings. You have to protect users without breaking end-to-end encryption protocols.
My take
AI makes scamming a zero-skill game. The days of laughing at badly translated phishing emails are over. If you build products today, assume your users are actively being hunted by flawless automated deepfakes. You either build defense into your product from day one, or you become the vector for the next massive fraud campaign.
Original reporting: Reuters. This is my rewrite and opinion.