Spoofed Voter Portal Harvested Constituent Data

WRENFIELD, Ont. — November 7, 2026 — By the time the town clerk of Wrenfield checked the numbers, 4,200 residents had already typed their names, home addresses and birth dates into a website the town had never built. The site had the town’s colours, the town’s crest, and a web address one hyphen away from the real one. It asked voters to “confirm” their polling details ahead of next week’s fictional municipal by-election. Every answer went somewhere else.

The page appeared on Monday, shared first in a neighbourhood group chat and then in the comments of the town’s own social media posts. It looked like the official voter-list check the town runs before every election: a short form, a reassuring line about keeping the voters list up to date, and a confirmation screen thanking residents for doing their civic duty. The real town site, wrenfield.ca, carries no such form. The copycat, wrenfield-votes.ca, was registered the previous Friday.

Nobody hacked the town’s systems. The town’s voter list was never touched. The copycat simply stood next to the real thing, in the same colours, and waited for residents to come to it — which they did, in the thousands, because checking your polling station is exactly the kind of sensible, boring errand people do without a second thought in election week.

The voters list was never breached. The voters came to the fake list themselves.

According to the fictional residents who spoke to ODTN News, the first sign of trouble was a text message. Carolyn Beck, a fictional Wrenfield resident, filled in the form on Tuesday morning and received a confirmation text that evening — from a number the town does not use — telling her that her polling location had changed and asking her to reply with her phone number to “verify” the update. She called the town office instead.

“I did everything right,” said Beck. “I checked my polling station the way you’re supposed to. The site had the crest, it had the right colours, it even had the date of the by-election right. I gave it my name and my address because that is what a voter check asks for. I only realised something was wrong when the town told me they had never seen the site.”

A civic errand is a trust errand — and trust was the only credential the site needed.

Elections-security advisors say voter portals are attractive precisely because they ask for exactly the information identity thieves want, and because residents expect to hand it over. A name, a home address and a date of birth is enough to open accounts, reset passwords, and pass the first round of questions at a bank or a phone company. A voter check is also one of the few forms people fill in without suspicion, because the request itself feels official: a town asking its own residents a routine question, in election week, in its own colours.

“A fake shop asks for your card and you hesitate,” said Jules Ferreira, a fictional elections-security advisor who works with small municipalities on voter outreach. “A fake voter portal asks for your name and address and you don’t hesitate at all, because that is what a voter portal is for. The site did not need to break anything. It just needed to look like the place where a good citizen goes to check. Once it had the data, the follow-up texts wrote themselves — a changed polling station here, a verification code there — each one a little more urgent than the last.”

In this fictional case, the copycat stayed live for four days before the town had the domain taken down. The town clerk, Elaine Sorensen, told residents the town never asks anyone to confirm voter details through a link, that no polling locations have changed, and that the real voters list is checked only in person at town hall or through the town’s own website. The town has not said how the collected details are being used, or how many residents have received the follow-up texts.

The fictional residents say they have since changed how they handle election messages. Links in group chats and social media comments are now ignored; the town’s website is typed in by hand or reached through the number on the tax bill. Several households have put fraud alerts on their credit files and are watching for accounts opened in their names, and the town office has taken to answering the same question dozens of times a day: no, your polling station has not moved.

The fix, experts say, is a habit, not a new system: type the address yourself.

That advice applies well beyond one by-election. Across Canada, towns and cities run their civic life through short web addresses and shared links, and a copycat needs only one hyphen to stand beside the real thing. The defence is not a cleverer portal. It is a habit of never arriving at a government service through a link someone else sent, and of calling the number on the paper bill when a text says something has changed.

For voters, the checklist is short: reach the town’s site by typing its address yourself, never through a link in a message or a comment; treat any text about a changed polling station as suspect and call the town office on the number you already have; and if you filled in a form you now doubt, put a fraud alert on your credit file and watch for new accounts. For towns, it is equally simple: publish the real address everywhere, say plainly that voter details are never collected through links, and take copycat domains down the same day they appear.

The fictional residents say the copycat site has been taken down, and the by-election goes ahead as planned.

The ballots were never touched. The voters list was never opened. And the difference — one address, typed by hand instead of tapped in a message — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.