Mitigating Cheating & Voter Fraud in Online Contests…
We run online contests of various sorts that involve users voting on entries (usually one vote per user per day). The prizes range from hundreds to thousands of dollars. Over the last four years we have encountered a number of ways people try to cheat, and have implemented couter-measures in each case. As it stands, we use the following measures:
A user must create an account and authenticate (log in). This rules out anonymous vote stuffing.
A user must confirm their email address by clicking a link in a system email to confirm they own and have access to their address. This rules out creating accounts en masse using random (not necessarily valid) email addresses. It also slows down the process a little for one account, and a lot if you're trying to create many.
No Gmail Address Aliases
Users cannot use instant alias addresses such as email@example.com. That slows down potential cheaters.
We routinely audit our signups and voting rosters for strings of email addresses that come from the same private domain (firstname.lastname@example.org, email@example.com, etc.). We also look for similar names, usernames, and "local-parts" of email addresses across domains.
Needless to say, this is all exhausting and getting harder and harder to scale up. We need a simpler solution to ensure that we get a lot closer to "one person, one vote" in our contests, while not burdening the user beyond need in the process.
SMS Pin Verification
We assume that the typical user has no more than one mobile number. By allowing them to send a pin to their mobile phone via SMS text message, we could verify that the associated account were unique. (We would only allow one account per mobile phone.) If the user doesn't have a mobile phone or is not receiving the SMS message, they would be able to call us during business hours for a manual validation.
Is account verification via SMS text message asking too much of users wanting to vote in an online contest? Have we overlooked better solutions?
We decided to forego SMS verification. Instead, we have a number of ways to detect bad signups and eliminate them, leaving us with (mostly) trustworthy accounts.
Upon further consultation with contest law experts, we determined that a "contest" based solely on votes from the public was actually no contest at all, because it didn't pass the skill test: voters are not qualified to judge skill and it was basically up to chance who would get the most votes. Or, even worse, it was up to the skill and efforts of the entrant as a promotor, which constituted "consideration" and would put the whole thing within dangerous reach of being an "illegal lottery." To offset the "chance" and "consideration" factors, we made voting count for less than 50% of the results and used a panel of qualified judges to determine greater than 50% of the results (in our case, we chose 40%/60% – voting/judging). (For a visual reference on contests vs. sweepstakes, I made a little explainer here: https://pbs.twimg.com/media/BzC5VH2CQAAN-LB.png:large.)
Net-net: by making judging greater than 50% of the outcome, we mitigated the effects of cheating without having to plug holes on bad behavior, kept the contest a contest, and avoided an accusation of running an illegal lottery.