WRENFIELD, Ont. — November 7, 2026 — By the time the town clerk of Wrenfield checked the numbers, 4,200 residents had already typed their names, home addresses and birth dates into a website the town had never built. The site had the town’s colours, the town’s crest, and a web address one hyphen away from the real one. It asked voters to “confirm” their polling details ahead of next week’s fictional municipal by-election. Every answer went somewhere else.

The page appeared on Monday, shared first in a neighbourhood group chat and then in the comments of the town’s own social media posts. It looked like the official voter-list check the town runs before every election: a short form, a reassuring line about keeping the voters list up to date, and a confirmation screen thanking residents for doing their civic duty. The real town site, wrenfield.ca, carries no such form. The copycat, wrenfield-votes.ca, was registered the previous Friday.

Nobody hacked the town’s systems. The town’s voter list was never touched. The copycat simply stood next to the real thing, in the same colours, and waited for residents to come to it — which they did, in the thousands, because checking your polling station is exactly the kind of sensible, boring errand people do without a second thought in election week.

The voters list was never breached. The voters came to the fake list themselves.

According to the fictional residents who spoke to ODTN News, the first sign of trouble was a text message. Carolyn Beck, a fictional Wrenfield resident, filled in the form on Tuesday morning and received a confirmation text that evening — from a number the town does not use — telling her that her polling location had changed and asking her to reply with her phone number to “verify” the update. She called the town office instead.

“I did everything right,” said Beck. “I checked my polling station the way you’re supposed to. The site had the crest, it had the right colours, it even had the date of the by-election right. I gave it my name and my address because that is what a voter check asks for. I only realised something was wrong when the town told me they had never seen the site.”

A civic errand is a trust errand — and trust was the only credential the site needed.

Elections-security advisors say voter portals are attractive precisely because they ask for exactly the information identity thieves want, and because residents expect to hand it over. A name, a home address and a date of birth is enough to open accounts, reset passwords, and pass the first round of questions at a bank or a phone company. A voter check is also one of the few forms people fill in without suspicion, because the request itself feels official: a town asking its own residents a routine question, in election week, in its own colours.

“A fake shop asks for your card and you hesitate,” said Jules Ferreira, a fictional elections-security advisor who works with small municipalities on voter outreach. “A fake voter portal asks for your name and address and you don’t hesitate at all, because that is what a voter portal is for. The site did not need to break anything. It just needed to look like the place where a good citizen goes to check. Once it had the data, the follow-up texts wrote themselves — a changed polling station here, a verification code there — each one a little more urgent than the last.”

In this fictional case, the copycat stayed live for four days before the town had the domain taken down. The town clerk, Elaine Sorensen, told residents the town never asks anyone to confirm voter details through a link, that no polling locations have changed, and that the real voters list is checked only in person at town hall or through the town’s own website. The town has not said how the collected details are being used, or how many residents have received the follow-up texts.

The fictional residents say they have since changed how they handle election messages. Links in group chats and social media comments are now ignored; the town’s website is typed in by hand or reached through the number on the tax bill. Several households have put fraud alerts on their credit files and are watching for accounts opened in their names, and the town office has taken to answering the same question dozens of times a day: no, your polling station has not moved.

The fix, experts say, is a habit, not a new system: type the address yourself.

That advice applies well beyond one by-election. Across Canada, towns and cities run their civic life through short web addresses and shared links, and a copycat needs only one hyphen to stand beside the real thing. The defence is not a cleverer portal. It is a habit of never arriving at a government service through a link someone else sent, and of calling the number on the paper bill when a text says something has changed.

For voters, the checklist is short: reach the town’s site by typing its address yourself, never through a link in a message or a comment; treat any text about a changed polling station as suspect and call the town office on the number you already have; and if you filled in a form you now doubt, put a fraud alert on your credit file and watch for new accounts. For towns, it is equally simple: publish the real address everywhere, say plainly that voter details are never collected through links, and take copycat domains down the same day they appear.

The fictional residents say the copycat site has been taken down, and the by-election goes ahead as planned.

The ballots were never touched. The voters list was never opened. And the difference — one address, typed by hand instead of tapped in a message — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.

FREDERICTON, N.B. — November 4, 2026 — The meeting was advertised, the link was shared, and the livestream page looked exactly right. When residents of a fictional Fredericton neighbourhood logged on to speak at a town hall about a proposed winter road budget, they were asked to “verify” themselves first — and the details they typed in went to someone who had nothing to do with the council. The town hall had not been hacked. Someone else had built a copy of it and got there first.

The problem was not in the council’s own meeting system. It was in the link most residents found first: a post shared in neighbourhood groups and forwarded by email, promising a simple way to register to speak. The page it led to carried the meeting’s title, its date, and a familiar-looking header. It asked for a name, an address, a phone number, and a “verification” payment card to hold a speaking slot. None of that information ever reached the council.

The meeting had not been moved online. It had never been listed at that link at all.

According to the fictional residents’ association at the centre of the story, the pattern emerged only when several residents compared notes the next morning. They had all registered through the same forwarded link, but none of them appeared on the real speakers’ list, and none of them had received a confirmation from the council’s own address. One resident had even called the number on the fake page to ask about speaking order, and been reassured by a polite voice that her slot was confirmed.

“We tell people to show up and be heard, and that is exactly what they did,” said Helen Marwick, the fictional residents’ association’s chair. “Nobody expects to have to inspect a meeting link the way you would inspect a front door. But someone built a copy of our town hall, put it where neighbours share links, and collected their details as they walked in.”

Spoofed civic meetings are a quiet, growing target for identity fraud.

Civic and cybersecurity advisors say public meetings are attractive precisely because they are open, trusted, and shared in a hurry. A town hall does not need to be breached in the dramatic sense — an attacker only needs to copy its title and date onto a convincing page, and wait for a forwarded link to do the rest. Residents, meanwhile, trust a link shared by a neighbour far more readily than one from a stranger, especially when the page looks official.

“The page did exactly what it was designed to do. It registered people to speak,” said one civic-fraud advisor familiar with meeting-spoof cases. “The attacker did not need to break into the council’s systems. They only needed to stand between residents and the real meeting, and let honest civic participation do the rest.”

In this fictional case, the damage was not a single dramatic theft. Individual residents handed over names, home addresses, phone numbers, and, in some cases, payment-card details entered for “verification.” The association estimates dozens of residents registered through the fake page before it was reported, and several later received suspicious calls and messages using details only the fake form had collected. For the residents, the loss was compounded by the moment of discovery — arriving at a real meeting, ready to speak, to find they had never been registered at all.

The fictional association says it has since changed how it shares meeting links. Real meeting links now come only from the council’s own website and the association’s own mailing list, never from a forwarded social post alone, and the association checks shared links weekly, the way it checks its meeting notices. Residents who used the fake page are being asked to change any password they reused, watch for calls that quote their home address, and check statements for small charges in the days after registering.

The fix, experts say, is deliberately unglamorous: get the link from the source, not the share.

That advice applies well beyond one town hall. Across Canada, residents register for council meetings, school consultations, and public hearings through links passed along in group chats and neighbourhood pages, and most check them only when something goes wrong. The defence is not a cleverer meeting platform. It is a habit of checking where the link came from before handing it personal details.

For residents, the checklist is short: register through the council’s own website or the number printed on its official notice, be suspicious of any meeting page that asks for a payment card to hold a speaking slot, and check that a confirmation comes from the council’s own domain. For civic groups, it is equally simple: publish one official link, say clearly where it will come from, and give residents a simple way to report a copy.

The fictional association says affected residents have been offered help re-registering for the real meeting, and the copycat page has been reported for removal.

The residents showed up to speak. The town hall they joined was never the town’s. And the difference — one link, checked before the details were entered — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.

CEDAR BAY, Ont. — November 1, 2026 — The town asked its residents one simple question: where should the new community centre go? Two sites were on the table, a survey was open for three weeks, and the council expected a few hundred replies. Instead, it received more than eleven thousand — and most of them, staff now believe, were never written by a resident at all.

The flood arrived in the final days of the consultation. Submissions poured in overnight, in batches, many of them worded almost identically, favouring one site by an overwhelming margin. By the time the survey closed, the real voices of Cedar Bay, the fictional Ontario town at the centre of the story, were buried under a pile of submissions nobody could trust.

The consultation had not been ignored. It had been overwhelmed.

According to the fictional town’s account, the warning signs appeared only when staff began sorting the results. Hundreds of submissions arrived within minutes of each other, in the middle of the night. Many used email addresses that followed the same pattern, differing by a single digit. Others repeated the same short comment, punctuation and all, dozens of times over. And almost none of them matched the town’s own records of who had taken part in past consultations.

“We asked people what they thought, and then we couldn’t hear them,” said Helen Ashford, Cedar Bay’s fictional town clerk. “The genuine replies were still in there. We just couldn’t tell, at a glance, which ones they were. A consultation that nobody trusts is worse than no consultation at all.”

Public consultations are a quiet, growing target for manipulation.

Civic-engagement advisors say online consultations are attractive precisely because they are built on trust. They are usually open to everyone, require little or no verification, and their results are quoted in council reports as if they were a clean measure of public opinion. A flood of fake submissions does not need to hack anything — it only needs a form that accepts whatever it is given, as many times as it is given.

“The form did exactly what it was designed to do. It collected answers,” said one civic-technology advisor familiar with consultation cases. “The problem is that collecting answers is not the same as hearing residents. Without even basic checks — one submission per person, a pause when thousands arrive at once, a way to spot copies — a consultation can be steered by whoever is willing to submit the most.”

In this fictional case, the stakes were a single decision about where to build, but the damage went further. Council postponed the vote on the community centre, the town’s staff spent weeks sorting real submissions from fake ones by hand, and some residents who had taken the time to reply wondered aloud whether their views had counted at all.

Cedar Bay says it has since changed how it consults. Future surveys will require a verified local address or library card number, submissions will be rate-limited so that sudden overnight surges trigger a review, and duplicate wording will be flagged before results are tallied. The town will also publish, alongside any consultation result, how many submissions were set aside and why — so residents can see the cleaning, not just the conclusion.

The fix, experts say, is deliberately unglamorous: verify the voice, not just the vote.

That advice applies well beyond one town. Across Canada, municipalities, school boards, and public agencies run online consultations on everything from transit routes to zoning changes, and most still treat every submission as equal, no matter how it arrived. The defence is not a harder survey. It is proof that the people answering are the people the question was asked of.

For public bodies, the checklist is short: tie submissions to a light but real identity check, limit how fast submissions can arrive from a single source, flag identical wording automatically, and report openly how many responses were excluded and why. For residents, it is equally simple: use the official channel, give a verifiable contact, and say so plainly if a consultation result looks too one-sided to be real.

Cedar Bay says the community-centre decision will return to council once the genuine submissions have been separated and counted, and the town has apologised to residents whose replies were caught in the clean-up.

The town asked a question. Thousands of strangers answered it first. And the difference — a form with no way to tell a resident from a script — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.