Mitigating Cheating & Voter Fraud in Online Contests…
We run online contests of various sorts that involve users voting on entries (usually one vote per user per day). The prizes range from hundreds to thousands of dollars. Over the last four years we have encountered a number of ways people try to cheat, and have implemented couter-measures in each case. As it stands, we use the following measures:
A user must create an account and authenticate (log in). This rules out anonymous vote stuffing.
A user must confirm their email address by clicking a link in a system email to confirm they own and have access to their address. This rules out creating accounts en masse using random (not necessarily valid) email addresses. It also slows down the process a little for one account, and a lot if you're trying to create many.
No Gmail Address Aliases
Users cannot use instant alias addresses such as firstname.lastname@example.org. That slows down potential cheaters.
We routinely audit our signups and voting rosters for strings of email addresses that come from the same private domain (email@example.com, firstname.lastname@example.org, etc.). We also look for similar names, usernames, and "local-parts" of email addresses across domains.
Needless to say, this is all exhausting and getting harder and harder to scale up. We need a simpler solution to ensure that we get a lot closer to "one person, one vote" in our contests, while not burdening the user beyond need in the process.
SMS Pin Verification
We assume that the typical user has no more than one mobile number. By allowing them to send a pin to their mobile phone via SMS text message, we could verify that the associated account were unique. (We would only allow one account per mobile phone.) If the user doesn't have a mobile phone or is not receiving the SMS message, they would be able to call us during business hours for a manual validation.
Is account verification via SMS text message asking too much of users wanting to vote in an online contest? Have we overlooked better solutions?
We decided to forego SMS verification. Instead, we have a number of ways to detect bad signups and eliminate them, leaving us with (mostly) trustworthy accounts.