Mitigating Cheating & Voter Fraud in Online Contests…
We run online contests of various sorts that involve users voting on entries (usually one vote per user per day). The prizes range from hundreds to thousands of dollars. Over the last four years we have encountered a number of ways people try to cheat, and have implemented couter-measures in each case. As it stands, we use the following measures:
A user must create an account and authenticate (log in). This rules out anonymous vote stuffing.
A user must confirm their email address by clicking a link in a system email to confirm they own and have access to their address. This rules out creating accounts en masse using random (not necessarily valid) email addresses. It also slows down the process a little for one account, and a lot if you're trying to create many.
No Gmail Address Aliases
Users cannot use instant alias addresses such as firstname.lastname@example.org. That slows down potential cheaters.
We routinely audit our signups and voting rosters for strings of email addresses that come from the same private domain (email@example.com, firstname.lastname@example.org, etc.). We also look for similar names, usernames, and "local-parts" of email addresses across domains.
We also show voting result updates on a daily basis, so there's no instant feedback. That way, if someone is trying to cheat, it will take a day to see any results, and unless they went big, they won't know for sure if their method was successful. We try to be as much of a "black box" as possible.
Needless to say, this is all exhausting and getting harder and harder to scale up. We need an easier solution to ensure that we get a lot closer to "one person, one vote" in our contests, while not burdening the user beyond need in the process.
We have explored the possibility of using SMS to attach mobile numbers to accounts in order to verify the person; the jury is still out on this approach: https://ux.stackexchange.com/questions/15980/ways-to-avoid-online-contest-voting-fraud-is-sms-account-verification-too-much/, and Can SMS text messages be used to verify a person's unique identity through a short code system?.
Some suggestions have included using credit cards, mail-in verification, reputation points … but these are all much too onerous for our target users.
What more can we do automatically in the back end to 1) identify cheaters, and more importantly 2) prevent them from even cheating?
We decided not to make our fraud protection leak-proof because one of the developers pointed out "the harder you make it for people to cheat, the harder it is to detect cheating." Instead, we are utilizing a medieval Chinese hunting technique called a three-sided Battue. By making it very difficult to cheat in most ways, but relatively easy to slip through in other ways, we know exactly what to look for and eliminate before the voting results are updated.
We look for patterns in votes, such as one contestant receiving a string of evenly timed votes, then look at the accounts associated with those votes. If there's a pattern to the accounts, we eliminate those accounts, and the associated votes disappear with them.