How to Detect Fake Votes and Voting Fraud
Published 18 August 2026 · 5 min read · Guide
In short
Detect fake votes by looking at patterns rather than totals. Automated voting produces signatures real campaigns do not: a constant rate of arrival, sustained activity through the night in every relevant time zone, votes that outpace page views, clusters of addresses from a handful of unusual email domains, and surges with no matching social media activity. Compare the shape of each entrant's vote curve, not just their position on the leaderboard.
By the time a total looks wrong, the useful evidence is already in the record — you just have to know which shape to look for. Genuine campaigning and automated voting produce visibly different patterns, and the differences are not subtle once you stop staring at the leaderboard and start looking at arrival times. This covers what to look for, and the harder question of what to do about it.
What does genuine campaigning look like?
Establish the normal pattern first, or everything looks suspicious. Real supporter activity is spiky, human and tied to waking hours.
- Bursts, then decay. A post goes out, votes spike within minutes, then tail off over a few hours.
- Daily rhythm. Activity concentrates in mornings and evenings in the supporters' time zone, and drops overnight.
- Page views track votes. People arrive, look at the profile, then vote — so views exceed votes, often by several times.
- Weekend and event-driven peaks. Voting rises around rehearsals, heats, media coverage and the final days.
- Correlated across entrants. A big promotional push by the organiser lifts everyone at once.
A steadily climbing total that never sleeps is not a more successful campaign. It is a different kind of thing entirely.
What are the signatures of automated voting?
| Signal | What you see | How strong an indicator |
|---|---|---|
| Constant arrival rate | A near-straight line over many hours | Strong |
| No overnight dip | Steady voting at 3am in every plausible time zone | Strong |
| Votes exceed page views | More votes than profile visits | Strong |
| Email domain clustering | Many verifications from a few unfamiliar domains | Strong |
| Cooldown pressure | Repeated attempts arriving faster than the limit allows | Moderate to strong |
| Surge without social activity | A jump with nothing visible driving it | Moderate |
| Address diversity anomaly | Many addresses, each casting exactly one vote | Moderate |
| Single entrant diverging | One entrant's curve unlike everyone else's | Weak alone; useful combined |
No single signal is proof. Two or three together, in the same window, on the same entrant, generally are. The vote-to-view ratio is the most useful single check because manipulation tools rarely bother loading the page they are voting on.
How do you actually investigate?
- 1Export or open the vote record for the whole event, not just the entrant in question
- 2Plot votes per hour for every entrant across the full voting period
- 3Identify the window where a curve changes shape, and note when it started
- 4Within that window, look at the source distribution — how many addresses, how many votes each
- 5If email verification is in use, group verifications by domain
- 6Compare vote counts against page views for the same window
- 7Check whether anything legitimate explains it — media coverage, a viral post, an event
- 8Write down what you found before you speak to anyone
What can you not detect?
Being honest about the limits matters, because overconfidence produces false accusations that damage a competition more than the manipulation would have.
- Organised human voting. Fifty real people asked to vote from fifty real phones looks exactly like a successful campaign, because it is one.
- Low-volume duplicate voting. One person voting from three devices is undetectable and immaterial.
- Sophisticated automation. Tools that pace requests to mimic human timing and load the page first are difficult to distinguish from real traffic. Imperva's 2025 Bad Bot Report notes that AI is being used to build more evasive bots that mimic human behaviour.
- Whether a real voter was paid offline. Nothing in the data shows motivation.
This is why prevention matters more than detection, and why the controls in how to prevent online voting fraud are worth more than any amount of forensic skill afterwards.
What should you do once you have found it?
- 1Check what your published rules actually say — you can only act on the rule you published
- 2Decide on the evidence, not on who complained
- 3Remove the invalid votes rather than adjusting a total, so the record still reconciles
- 4Tell all entrants what was found and what was removed, in general terms
- 5Do not name an entrant publicly unless your rules said you would
- 6Do not extend voting to compensate — that penalises entrants who did nothing wrong
- 7Keep the records until any challenge period has closed
Two failure modes are worse than the manipulation itself. Quietly correcting totals, which looks like tampering when it emerges. And accusing an entrant on a single weak signal, which is unrecoverable if you are wrong.
What should you check before the next competition?
- Does the platform store individual votes with timestamps you can actually inspect?
- Can you see page views alongside votes, so the ratio is available?
- Are vote limits enforced on the server rather than in the browser?
- Do the published rules name automated voting and state the consequence?
- Is the voting window short enough to limit setup time for manipulation?
- Is administrative access restricted and logged?
A competition that answers yes to all six will rarely need this article. Evaluation criteria are in how to choose an online voting platform.
Frequently asked questions
- How can you tell if votes are from bots?
- Look at arrival timing rather than volume. Automated voting typically produces a near-constant rate with no overnight dip, and votes that outnumber page views because the tool never loads the profile. Two or three such signals together on one entrant, in the same window, is a reliable indicator; any one alone is not.
- Can you prove who was behind fake votes?
- Usually not, and you rarely need to. Vote records show patterns and sources, not people. The defensible action is to remove votes that breach your published rules, not to attribute them to a named individual — attribution invites a dispute you cannot win on the evidence available.
- What if an entrant accuses another of cheating?
- Investigate from the vote record for the whole event rather than the accused entrant alone, and check for innocent explanations before anything else. Tell the complainant what your process is and when they will hear back. Handling the complaint visibly and consistently matters more than the outcome.
- Should you announce that you removed votes?
- Tell entrants in general terms — that votes identified as automated were removed under the published rules — without naming anyone or detailing your detection method. Silence looks like a cover-up when it emerges later, and specifics simply teach the next attempt what to avoid.
Sources
- OAT-016 Skewing — OWASP Foundation. Automated repeated requests intended to alter metrics such as poll results, listed under names including poll skewing and voting subversion.
- 2025 Bad Bot Report — Imperva (Thales). Automated traffic at 51% of web traffic, and the use of AI to build more evasive bots that mimic human behaviour.
Need the record behind the total? Voorna stores every vote with its timestamp and source, and records page views alongside them.
See how Voorna records votes