Political donors in the U.S. and U.K. are being left vulnerable thanks to poor security practices by political parties.
With the U.S. presidential election just weeks away, there has been a recent surge in campaign donations, making for large volumes of transactions being processed by donation platforms. Donors are often asked to provide personal and financial information, such as names, addresses and credit card details.
However, according to French software firm DataDome, this data isn’t necessarily being kept securely, putting donors at risk.
The company tested three major U.S. political donation platforms in order to assess their security measures against automated and fraudulent activities—and found that all three lacked critical login security measures to protect against bot traffic and credential stuffing attacks.
Only one platform implemented two-factor authentication, while the other two were deemed to have no effective security measures at all, relying solely on basic defenses.
And while all three platforms made use of reCAPTCHA v2 on their registration pages, this free version is less secure and, says DataDome, easily bypassed by sophisticated bots. Login endpoints were left completely unprotected, presenting a significant opportunity for account takeover, said the firm.
“The lack of robust protection on login endpoints exposes user accounts to credential stuffing attacks. These attacks can lead to unauthorized access, allowing attackers to harvest personal information and stored credit card data,” it warned.
“Many users save their credit card information for recurring donations, further increasing the risk of financial theft and data breaches.”
Meanwhile, in the U.K., DataDome tested the donation platforms for the UK’s seven major political parties -Labour, Conservatives, the Liberal Democrats, Reform UK, SNP, Plaid Cymru and the Green Party.
Here, too, all lacked critical security measures. Only three of the sites, Plaid Cymru, SNP, and Reform UK, had a login endpoint, and every site was found to be missing critical security features to protect against bots and credential stuffing attacks.
Only two of the seven websites, Labour and SNP, make use of reCAPTCHA—and even then only use the security feature on account creation pages, not on login pages.
“The use of reCAPTCHA alone is not enough to stop fraud with the trending use of CAPTCHA farms, leaving these sites still vulnerable to bots,” says the firm.
While the 2024 UK election took place earlier this year, the next local elections are scheduled for May 2025, and donation sites and donors are being warned to prepare for future risks.
They should, said DataDome, deploy two-factor authentication across all critical user interactions, including logins and transactions, and transition from basic CAPTCHA systems to more sophisticated bot management solutions that provide real-time detection and mitigation of automated threats.
“In particular, the bot protection must be resilient against sophisticated attackers capable of passing CAPTCHAs using CAPTCHA farms, be able to detect attacks started from thousands of IP addresses using proxies, and be able to detect bots that mimic human-like behaviour,” the company advised.
“The current surge in campaign donations underscores the urgent need for robust cybersecurity measures on donation platforms. Protecting donor information not only safeguards individuals but also upholds the integrity and trust essential for democratic participation.”
