CISA + FBI Warn: AI-Powered Phishing Is Coming for Election Season
A joint FBI/CISA Public Service Announcement warns election officials, candidates, and political organizations to expect phishing and smishing campaigns supercharged by AI-generated deepfakes ahead of the 2026 U.S. midterms. This page breaks down the warning and tests your readiness — free, no signup.
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
Bottom line: the agencies are not reporting a confirmed breach — this is an operational warning. The old "spot the typo" days of phishing are over: AI-generated messages now read fluently in your own vernacular, and deepfake audio and video can impersonate people you trust. Verify everything.
Is your campaign ready for AI-powered phishing?
Probably not — and that is what the October 16, 2026 joint PSA from the FBI and CISA is warning about. Election officials and campaigns face phishing and smishing supercharged by AI-generated deepfakes, and the defenses are the same ones that stop every other phishing attack.
What the PSA says (verified)
Issuers: the FBI and CISA, via a joint PSA published October 16, 2026 through the FBI's Internet Crime Complaint Center (IC3 alert I-101626-PSA).
Who is targeted: election officials, candidates, and political organizations — attractive to criminals because of access to voter registration data, government officials, and sensitive campaign information.
The techniques: phishing (email) and smishing (SMS/text). The PSA notes these were already used in past election cycles, and that the FBI has seen a recent rise in smishing through encrypted chat applications.
The AI difference: the PSA's term is "super intelligence" (SI) tooling. SI-generated messages are written in natural language with correct spelling and grammar — the old tells are gone. Deepfake video and audio can create false identities, impersonate real people, and make phishing schemes far more convincing, all at much greater scale.
What it does NOT say: no specific threat actor is named, no vulnerability (CVE) is cited, and no confirmed breach of election systems is reported. This is a readiness warning, not an incident report.
Sources: the full PSA text at ic3.gov/PSA/2026/PSA261016 · CISA resource page at cisa.gov · coverage via Channel NewsAsia/UA.news, Oct 16–17, 2026.
How the defenses stack up (from the PSA)
Phishing-resistant MFA everywhere — passkeys or FIDO2 security keys, especially on email, VPNs, and accounts touching critical systems. This is the single strongest line against credential theft.
Critically evaluate every message's source — check content for signs of AI generation (missing watermarking or content credentials).
Verify requests through a second channel — if someone asks for a password, code, or sensitive file, confirm via a separate channel you trust, not by replying in the same thread.
For organizations: mark external emails with a banner, run strong spam filters that block executables, require unique passphrases, keep systems patched, deploy SPF and DKIM to stop domain spoofing, and limit access to least privilege.
Report it: the FBI asks victims to report to a local FBI field office or the IC3.
Tips drawn from the PSA's "Tips to Protect Yourself" and "Tips to Protect Your Organization" sections — full text.
Phishing FAQ
What did the FBI and CISA warn about on October 16, 2026?
In joint PSA I-101626-PSA, the FBI and CISA warned that election officials, candidates, and political organizations face phishing and smishing supercharged by AI-generated deepfakes. No specific threat actor was named and no breach was reported — it is a readiness warning, not an incident report.
How is AI changing phishing?
AI-generated messages use natural language with correct spelling and grammar — the old tells are gone. Deepfake video and audio can impersonate real people, and the FBI has seen a rise in smishing through encrypted chat apps.
What is the single strongest defense?
Phishing-resistant MFA everywhere — passkeys or FIDO2 security keys on email, VPNs, and critical accounts. Verify sensitive requests through a second trusted channel, and report incidents to a local FBI field office or the IC3.
Honest scope
This check is about message-based deception (phishing, smishing, deepfake impersonation). It does not address voting-machine security, which the PSA does not discuss.
The warning targets election and campaign staff, but the same techniques hit everyone — small businesses, nonprofits, and families see the same AI-phishing playbook.
No tool or page can guarantee you won't be fooled. The quiz below scores your current habits, not your invulnerability.
The 5-question phishing-readiness check
Answer honestly. The PSA's warning is that old warning signs are gone — score how you actually behave, not how you intend to.
Copy your score and warn your circle:
FROM INGENIOUS AI
Phishing starts with a spoofed domain. DomainGuard watches for look-alike domains built to impersonate your organization before they reach anyone's inbox.
Built by Ingenious AI — facts drawn from the FBI/CISA joint PSA (IC3 alert I-101626-PSA, October 16, 2026). This page is not affiliated with or endorsed by any government agency.
This page is general information, not legal advice. Written in a non-partisan spirit: the threat is the technique, never the politics.