How to stop vote rigging in an online vote

Online votes are rarely broken by sophisticated attacks. They are broken by four dull tactics: one person voting many times, a nominee's ally being given organiser access, a payment that was never really completed being counted, and results being edited after the fact. Deal with those four and you have dealt with most of the risk.

If a vote is free and identified only by a browser, one determined supporter with a private window and a mobile hotspot can cast hundreds. That is why paid voting ties each vote to a confirmed Mobile Money or card transaction — money is a far better scarcity signal than a cookie.

For elections where nobody should pay, scarcity comes from the voter roll instead: one verified voter, one ballot per position, enforced by the platform rather than by a supervisor's memory.

A weak platform trusts whatever the browser or a webhook says about a payment. A vote should only be recorded after the payment status is confirmed with the payment provider directly, and webhook callbacks should be signature-checked before they are believed. Ask any voting platform you are considering how they do this.

The most common real-world rigging is a nominee's relative holding an organiser login. Keep the organiser list short, give judges judging access rather than full project access, and never share one account between several people. If someone leaves the committee, remove them the same day.

Announce the closing time, close on time, and publish from the platform rather than from a spreadsheet someone re-typed. Where a result is contentious, show the nominee how their total was assembled — vote records and judge scores are stored per transaction and per judge.