Free tools Windows power users keep installed
One-click scans. No signup required.
Election-themed scams exploit urgency, political emotion and familiar names to get people to surrender passwords, one-time codes, payment details or personal information. Protect yourself by refusing to authenticate through an unsolicited message, opening services only through a known app or independently typed address, using a unique password and strong multi-factor authentication (MFA) on every important account, and verifying sensitive requests through a separate trusted channel. If you may have exposed a password or code, use the real service to change it immediately, remove unknown sessions and secure every account where that password was reused.
What election-related phishing and impersonation look like
The Cybersecurity and Infrastructure Security Agency (CISA) uses a broad definition of phishing: a message delivered by email, text message, social media or a malicious website that tries to obtain personal information or persuade you to download something harmful. Elections create particularly effective conditions for these lures because messages can claim that a deadline is approaching, your registration needs attention, your ballot has a problem, a donation is urgent or a political event requires you to sign in.
As an Amazon Associate I earn from qualifying purchases.
An authentic-looking logo, familiar display name or polished writing does not establish that a message is genuine. An attacker may copy a campaign, election office, news organization, fundraising service or even someone you know. Impersonation can also come from a compromised account, or from a convincing voice, video or live message created with generative tools. Treat the request—not the branding or emotional tone—as the thing that must be verified.
CISA’s election guidance and its January 18, 2024 generative-AI-in-elections guidance support the same practical response for individuals: confirm sensitive requests through a secondary channel. Use a phone number, website or contact method you already know to be genuine, never the link, reply address or telephone number supplied in the suspicious message.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The safest rule: never sign in through an unsolicited election message
If an election-related email, text or direct message asks you to log in, provide a password or one-time code, download an attachment, pay money or disclose personal data, stop and open the service independently. Use its official app, a bookmark you created earlier, or an address you type yourself. Once there, check whether the same notice appears in the account. If it does not, contact the organization through a previously trusted channel.
Do not reply to ask whether the message is real. A reply keeps you in the attacker’s conversation and confirms that your address is active. Do not forward a suspicious message to friends while its links or attachments remain active; describe the warning in plain text instead.
How to tell whether an election text or email is suspicious
Use these questions as a screening checklist. None is conclusive by itself: legitimate organizations can make mistakes, and fraudulent messages can be grammatically perfect.
- Was it unexpected? Be cautious when a message appears without a related action you recently took.
- Is it urgent or emotional? A demand tied to a voting deadline, registration status, ballot eligibility, donation goal or breaking political claim is designed to shorten your decision time.
- What does it ask you to do? Requests for passwords, verification codes, payment, identity documents, downloads or unusual personal details deserve independent confirmation.
- Do the sender and destination match? Check the full sender address and the destination domain, not only the display name or logo. A familiar name can be attached to a different address.
- Can you verify it outside the message? Open the service directly or call the organization using contact information found independently.
For public information about registration, polling locations or ballot procedures, start at your official state or local election office website that you locate independently. CISA’s election-security material identifies phishing as a risk to election infrastructure, but it is not a directory for validating every campaign, fundraising or political-news message.
Secure your accounts before an incident
Account protection works best when it is in place before a convincing lure arrives. Start with accounts that can unlock others, then protect accounts that expose your identity or money.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
1. Lock down the email account used for recovery
Your primary email can receive password-reset links and security alerts, so compromise there can spread to other services. Give it a password that is not used anywhere else and enable the strongest MFA the provider offers. Review the recovery email address and phone number, logged-in devices and active sessions, and forwarding rules if those controls are available. Remove an address, number or device you no longer control.
Do not accept an unsolicited message claiming to be email support. Reach support through the provider’s known app or website. Keep a recovery method available, but make sure it is also protected; an abandoned phone number or old mailbox can become the easiest route around your new password.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →2. Protect social, financial and cloud accounts
Enable MFA on social-media, banking, payment, investment, shopping, cloud-storage and work accounts, plus any account that can reset another password. Prioritize services that contain identity information, saved payment methods, private messages or an audience that could be misled by a post from your account.
Use the strongest privacy and security settings available. Remove unused accounts, reduce publicly visible personal details and review recovery questions or profile information that an impersonator could copy. CISA’s election-related AI guidance specifically recommends hardening personal and organizational social-media accounts and limiting identifying information exposed publicly.
3. Use a different strong password everywhere
Never reuse a password across a campaign site, email account, social platform and financial service. If one site is breached or you disclose a password to a fake page, reuse turns one incident into access to many accounts.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A password manager can create and store unique credentials, and CISA lists password managers among its consumer security recommendations. Protect the manager’s master credential with a strong, unique password and MFA where offered. A password manager solves the uniqueness and storage problem; it does not replace MFA or independent verification of messages.
4. Choose phishing-resistant MFA when possible
CISA identifies FIDO/WebAuthn as the widely available phishing-resistant option. A passkey or compatible security key verifies the legitimate service and can prevent authentication when you have been tricked onto a fake site. Availability depends on the account provider, device and operating system, so check each service’s current security settings.
If FIDO/WebAuthn is not available, use the strongest alternative. CISA recommends number-matching MFA as an interim improvement where migration to FIDO is not yet practical because it reduces some push-bombardment attacks. SMS and ordinary push approvals are less resistant to phishing, but any MFA is safer than password-only access.
| MFA method | Resistance to a fake sign-in site | Availability and recovery considerations |
|---|---|---|
| FIDO/WebAuthn passkey or security key | Designed to prevent authentication on a phishing site by binding the credential to the legitimate service. | Only where the service and device support it. Enroll a backup key or another safe recovery method before relying on one device. |
| Number-matching push approval | Stronger than an unprotected push prompt because you must match the sign-in number, but it is not equivalent to phishing-resistant MFA. | Depends on the provider’s authenticator. Keep the phone and recovery route secured. |
| Standard push approval | Can be abused by repeated approval requests or social engineering. | Widely available; deny unexpected prompts and report repeated attempts. |
| SMS code | More exposed to phishing and phone-number attacks than FIDO/WebAuthn. | Often available as a fallback. Keep the account’s recovery details current and move to a stronger method when offered. |
| Password only | Provides no second barrier if the password is stolen. | Use only temporarily while you enable MFA; do not treat it as an adequate long-term setup for important accounts. |
5. If you use a hardware security key, plan for loss
A FIDO2 security key is an optional physical authenticator for compatible accounts. Confirm support for the services and devices you actually use before buying one. Enroll a backup key or another recovery method during setup; otherwise a lost key can lock you out even though the account itself is secure. The key is a phishing-resistant MFA tool, not a replacement for a password manager, unique passwords or careful message verification.
6. Keep devices, apps and recovery routes current
Install operating-system and app updates through the device maker or official app store. Keep access to your recovery email and phone number, and periodically check that they still belong to you. Account interfaces, passkey support and security-key compatibility change, so review each provider’s current settings rather than relying on an old screenshot or guide.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Verify urgent requests independently
For a donation request, call for payment, password reset, ballot notice or request for personal information, find the organization’s contact information yourself. Type its known web address, use an app already installed from an official store or consult a statement you received before the suspicious message. Do not use a contact method copied from the message.
For a voice or video request, do not assume that a familiar face or voice proves identity. CISA’s January 18, 2024 guidance recommends identity verification for real-time communications and confirmation through a secondary channel. Ask the person to confirm the request through a known phone number or an established account conversation. If the request involves credentials, codes, money or sensitive records, pause until that independent confirmation succeeds.
What to do if you clicked an election scam link
A click alone does not tell you what happened. The next action depends on whether you entered information, approved a sign-in, downloaded a file or sent money. In every case, stop interacting with the message.
- Close the page or message. Do not enter more information, reply, open additional links or run an attachment.
- Identify what you disclosed. Note whether you typed a password, one-time code, payment data or personal information, and whether you approved an MFA prompt.
- Use the genuine service. Open the provider’s known app or independently typed address, not the suspicious link. Change the exposed password immediately.
- Change reused passwords. Update every account that shared the exposed credential, starting with email and accounts that can reset others.
- End unknown access. Review active sessions and logged-in devices, sign out anything unfamiliar, and inspect recovery details and forwarding rules when the service provides those controls.
- Enable or strengthen MFA. Prefer FIDO/WebAuthn where supported; otherwise use the strongest available method and number matching when offered.
- Warn contacts if necessary. If your account may have sent messages in your name, tell contacts through a separate channel not to trust recent links or requests.
- Report the incident. Use the platform’s report function and follow the affected service’s official account-recovery instructions. Procedures differ by provider; there is no single universal consumer recovery sequence.
If you downloaded an attachment, do not open it again or forward it. Install pending device and application updates from official sources, and use the security and recovery instructions provided by the affected service. If payment information was sent, contact the financial institution through the number on a genuine statement or its independently located website.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11When an account may be impersonating you
Warning signs include messages you did not send, unfamiliar login alerts, changed recovery details, new forwarding rules, posts or direct messages you do not recognize, and contacts reporting requests for money or codes. Do not confront the suspected impersonator through the same compromised account.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Secure the account from a trusted device using the provider’s known address, terminate unknown sessions, restore your recovery information and enable MFA. Tell contacts through another channel that they should ignore recent requests until you confirm control. Preserve the suspicious messages and account alerts for the service’s report process, but do not click their links while collecting them.
Separate guidance for election-office staff
The controls below are for election offices and other organizations, not a checklist every individual voter can configure. CISA’s September 6, 2024 election-office checklist recommends:
- MFA on all accounts and unique credentials without credential sharing.
- Separate administrative accounts from ordinary user accounts.
- Strong passwords, DMARC for email authentication, and a way to flag messages originating outside the organization.
- Filtering of known malicious indicators and use of official email for official business.
CISA’s election-security toolkit identifies voter information, websites, email systems and networks among assets that may be targeted, and points election stakeholders toward phishing training and protective and detection resources. The toolkit states that its list is not comprehensive and does not endorse commercial products. Individual voters should not attempt to configure organizational controls such as DMARC; instead, they should verify election-office requests through the office’s independently found official channel.
Common mistakes that make election scams work
- Trusting a display name. Names and logos are easy to copy; inspect the complete address and verify independently.
- Entering a code because the page looks right. A one-time code can authorize an attacker in real time. Use the service’s known app or address instead.
- Approving an unexpected MFA prompt. Deny it, change the password through the real service and investigate active sessions.
- Using one password for convenience. Unique credentials limit the damage when one site or message is compromised.
- Publishing too much recovery information. Public birthdays, phone numbers, addresses and family details can help an impersonator imitate you or answer recovery questions.
- Relying on an old recovery email or phone. A route you no longer control can defeat otherwise strong account security.
- Assuming a polished message is safe. Modern impersonation can be convincing; independent confirmation is more reliable than style.
A practical account-protection checklist
- Email account has a unique password, current recovery details, MFA and no unfamiliar sessions or forwarding rules.
- Social, financial, cloud and password-manager accounts use unique credentials and MFA.
- FIDO/WebAuthn passkeys or security keys are enabled wherever supported, with a backup recovery route.
- Public profile information is limited, and unused social accounts are closed or secured.
- Operating systems and apps are updated through official channels.
- Election, donation and account notices are opened through known apps or independently typed addresses.
- Sensitive requests are confirmed through a trusted secondary channel.
- You know how to reach each service’s official recovery process before an incident occurs.
What protection can and cannot guarantee
Unique passwords, MFA, privacy settings and independent verification substantially reduce the chance that one deceptive message will take over several accounts. They cannot prove that every political message is genuine, prevent someone from making a fake profile, or guarantee recovery if all your recovery methods are lost. Keep a backup method, review account alerts and treat unexpected requests for credentials, codes, downloads or money as untrusted until verified outside the message.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
