Thread by @ParkerThayer

ActBlue has a security flaw: it accepts donations from untraceable gift cards bought with cash, and no ID verification.

To prove it, I did it.

Here’s a thread explaining a ludicrously simple loophole for abusing ActBlue🧵

(Read in FULL before conspiracy theorizing)

https://twitter.com/SpeakerJohnson/status/1849437890620576190

Step 1: go to the store and buy a pre-paid visa gift card in cash.

Here’s my receipt, showing I paid CASH for a $25 gift card. At no point did I use anything with a name on it while purchasing the card.

Note the last four numbers “0528”

Step 2: Donate

ActBlue requires an email, address, name, occupation, and employer. Sounds secure?

Nope.

All of this data (minus the email) is easily accessible for millions of people on the public FEC database. It’s trivially easy to copy it manually or with a bot.

I chose John Fetterman, because he’s kinda based sometimes, and gave him $10.

Here’s my receipt showing the one-time-use email that my iPhone automatically created for me and the same last four digits: 0528.

At no point did they ask for any information that I couldn’t have gotten off the FEC website, and there was never ANY name attached to the gift card.

With a free VPN, a pile of cash-bought cards, and the FEC database anybody could donate this way from anywhere in the world.

Now, this doesn’t mean “smurfing” or “strawman donations” are happening on a massive scale. There is lots of misleading info about ActBlue out there.

This is merely to prove that it COULD be done untraceably and with relative ease. This is NOT proof that it’s really happening.

Many of the most prominent claims about smurfing, including one of my own, fail to consider that ActBlue allows users to make dozens of contributions to separate PACs with the click of a button.

In the FEC this makes it APPEAR that donors are giving 1,000+ times a month.

This does not mean the claims are inaccurate, it’s very possible that the donation patterns are inorganic, but many donors that appears suspicious at first might be normal people making on or two donations that look like hundreds.

Either way, this loophole MUST be fixed.

I should also note that it’s possible that @WINRED has the same flaw. It should be fixed immediately if so.

You can’t have BOTH a publicly available database of donor information AND a donation processing system that requires ONLY the information from that database.