Why vote-buying does not work in 2026

People ask us this every week. "Can you just buy 4,000 votes?" No. We will not, and more importantly, it would not help you even if we did. The contest platforms got serious about detection somewhere around 2022, and by 2025 the cat-and-mouse game tilted hard in their favour. This is the long version of why.

We run a small agency in Minsk. We mostly help Polish entrants in EU-run brand contests. We have turned down roughly 31 vote-buying requests in the last year. Below is what we actually see on the detection side, three public-record disqualifications worth studying, and what we do instead. If you want the boring summary first: paid votes leave a fingerprint that looks nothing like real engagement, and brand legal teams have started reading the logs.

The shape of a real vote vs. the shape of a bought one

A genuine vote from a real person who saw your entry on Facebook follows a path. They clicked your share link. Their referrer header says facebook.com or l.facebook.com or m.facebook.com. Their browser fingerprint matches a phone or laptop they have used to load other things. They voted once. Maybe they came back the next day from a different device because you nagged them on WhatsApp. The session has a beginning, a middle, an end.

A purchased vote almost never looks like this. It arrives in a cluster of 40 or 200 within a 90-minute window. The IPs resolve to a handful of residential proxy ranges in countries that have nothing to do with your contest. The email addresses follow patterns: low entropy, sequential digits, throwaway domains. The browser fingerprints repeat. The user-agent strings are weeks out of date. Nobody scrolls. Nobody clicks anything else on the page.

This is not theory. It is what every modern contest platform logs by default. The platforms differ in what they do with that data.

How the three big platforms actually catch you

Gleam: entry-pattern fingerprinting

Gleam (gleam.io) has been doing entry-pattern fingerprinting since at least their 2019 fraud-prevention update, and they have iterated several times since. The system does not just look at IP addresses. It looks at the sequence of actions inside a session, the timing between clicks, the mouse-movement entropy when the JavaScript can capture it, and the relationship between entries across the whole campaign. If 60 "different" users all complete the same five actions in the same order with the same gap between them, Gleam flags the cluster.

The competition organiser sees this in their dashboard as a fraud score. Below the threshold the entries get auto-removed. Above a softer threshold they get marked for manual review. We have seen Gleam reports where 47% of entries on a small Polish campaign were flagged and silently removed before the draw — the entrants never knew. The winner pool was drawn from the remaining 53%.

Woobox: IP clustering and email-domain entropy

Woobox takes a different approach. Their fraud heuristics lean hard on IP clustering (how many "unique" entries share a /24 subnet) and email-domain entropy (the Shannon entropy of the local part of submitted email addresses). If you submit 200 entries from emails like kasia1992@, kasia1993@, kasia1994@, the entropy score collapses and the cluster gets quarantined.

Woobox publishes very little about this publicly, which is smart. We know it works because we have watched campaigns where a client's well-meaning sister-in-law tried to "help" by registering 30 Gmail addresses, and every single one of them was rejected by the time the campaign closed. The sister-in-law was furious. The client lost the entries that would have come from her actual friends, because the whole batch tripped the threshold.

Instagram: the verified-threshold rule

Instagram's own Promotion Guidelines (see facebook.com/policies_center/pages_groups_events/promotions) put the obligation on the contest organiser. The organiser must run a "lawful promotion" and is responsible for fraud. Most brands now require entrants to follow the brand account from a profile that meets certain thresholds — minimum account age, minimum follower count, profile picture present, some posting history. Meta updated this guidance most recently on 14 February 2025; the core rule about organiser liability has been there for years.

This is why "I'll just make 80 burner accounts" does not work. New accounts get filtered before the organiser even sees them. The brand legal team has every incentive to be strict, because a fraudulent draw can void their entire campaign under Polish consumer-protection rules (UOKiK has actually fined organisers who ran sloppy contests; the body of decisions on uokik.gov.pl is worth a skim).

Three real disqualifications from 2024-2025

These are public-record cases. We have anonymised our own clients elsewhere on this site, but these three are matters of public reporting.

Vyper shutdown, 12 September 2024. The viral-contest platform Vyper announced sunset on 12 September 2024, citing platform consolidation. In the months before shutdown, several Vyper-hosted campaigns invalidated leaderboards entirely after fraud audits revealed that the top three positions in multiple sweepstakes were driven by paid-vote services. The brands re-drew winners from filtered pools. Entrants who had paid for votes got nothing and had no recourse — the vote-selling sites do not refund based on the contest outcome.
The "Influencer of the Year" Polish regional contest, March 2025. Reported in regional press, the top finalist was disqualified after the organiser ran a post-contest audit and found that 71% of her votes came from a single Indonesian residential-proxy range over a 36-hour window. The runner-up was promoted. The disqualified finalist's name was published, which had reputation consequences far worse than losing.
Google Misrepresentation policy enforcement wave, effective 24 May 2024. Google's Misrepresentation policy revision (support.google.com/adspolicy/answer/6020955) became actively enforced against vote-buying landing pages in summer 2024. Several Polish and Belarusian "kupić głosy" sites were de-indexed and their Google Ads accounts suspended. The downstream effect: clients who had paid the vote services upfront never got delivery, because the services could no longer drive cheap traffic. We had two prospective clients show us receipts from such services in June 2024. We could not help them recover the money.

What brands actually do when they catch buyers

The naive assumption is that the brand just removes the fake votes and lets the entrant keep their real ones. Sometimes that happens. More often it does not. Here is the range of outcomes we have observed, roughly ordered from mildest to harshest.

The cluster of suspicious votes is silently removed. The entrant is none the wiser. They drop in the rankings and assume they just lost.
The entire entry is disqualified, including the legitimate votes. The brand cites the contest terms, which almost always include a "no manipulation" clause.
The entrant is named in the disqualification announcement. This is increasingly common in regional Polish contests and is brutal for influencers.
The brand passes the case to legal. Under Article 6 of EU Directive 2005/29/EC on unfair commercial practices (eur-lex.europa.eu/eli/dir/2005/29/oj), participating in a fraudulent commercial contest can be a violation in some member states' transpositions. Cases are rare. They happen.
The entrant is banned from future campaigns by that brand and often by the platform running the contest. Gleam and Woobox both maintain shared fraud signals across campaigns on their networks.

The contrarian bit

Here is something most agencies will not say out loud: a lot of "vote-buying detection" is theatre, and the platforms know it. They cannot catch every fraud, and they do not try. What they do catch is the lazy, cheap, mass-purchased kind — which is exactly the kind that beginners and panicked finalists buy at 2 a.m. three days before the deadline.

If you are willing to spend €4,000 building a slow, distributed, human-mimicking network over six weeks, you might evade detection. We have seen it done. We will never do it, because (a) it is fraud, and (b) the moment a competitor reports you, the brand will look hard and find you. The cost of getting caught at that level is not just disqualification. It is your real name on a regional-press article that ranks for your real name on Google for years. We have one client who came to us specifically to repair the SEO damage from this kind of incident. We could not fully fix it.

What we will not do, said plainly

We will not buy votes. We will not arrange for someone else to buy votes on your behalf. We will not register accounts for you. We will not log into the contest platform pretending to be you. We will not run scripts against the voting endpoint. We will not pay micro-task workers to vote. We will not use VPN farms, residential proxies, or click-farm services. If you ask, we will say no and refer you to our refund policy, which explains how we handle deposits when the engagement does not proceed.

This is not moral grandstanding. It is selfish. Every one of those tactics has a measurable failure rate above 60% in 2026, and the downside is catastrophic for the client. We would lose them as a client and the case would haunt our portfolio. The math does not work for us, and it does not work for you.

What actually works

The boring answer is that real votes from real people who care about your entry are the only votes that survive a fraud audit. The job, then, is to find those people and give them a reason to vote. This is just marketing.

For a typical Polish-language contest entry — say a photo competition run by a cosmetics brand — we usually build three layers. A small Meta ads campaign targeted at the entrant's own warm audience (people who already follow her, plus a lookalike of her existing engagers), budgeted at around €120-€280 for a two-week contest. A WhatsApp and Messenger outreach plan to her real network, with templates she can personalise. And a content plan for her own feed — three to five posts that give people a reason to click through, not just a request for a vote.

We had a client in Wrocław last autumn (anonymised: she runs a small ceramics studio) who came to us 11 days before the close of a regional artisan contest. She was in 14th place. We did not promise her a win. We told her we could probably move her into the top 5, which is what the prize structure rewarded. She finished 4th with 1,847 votes, of which our audit estimated 1,790 were from genuine, distinct people in her actual reachable network. The remaining 57 were suspicious-looking entries we could not account for — possibly a well-meaning friend who tried something silly. The brand's audit removed those 57 quietly. She kept her place. She got the prize. She is still a client.

Read our process page for how we structure a typical engagement, and pricing for the actual numbers. If you are still shopping around, the FAQ has the short answers.

One last honest thing

We have got this wrong before. In 2022, in our first year, we recommended a Meta ads strategy to a client that was perfectly legitimate but technically violated a clause in the contest terms about "paid promotion" of entries. The brand disqualified her. We refunded in full and rewrote our intake checklist to read the contest terms ourselves before quoting. We now read every set of contest rules end-to-end before the first call. It takes us 20-40 minutes per contest. It has saved us four disqualifications we know about since.

If you take one thing from this article: ask whoever you are about to hire to send you a screenshot of the contest's terms-of-entry page with the relevant clauses highlighted. If they cannot, or will not, hire someone else. We are happy to be that someone else, or to recommend a competitor if our calendar is full. Write to us with the contest URL and a sentence about what you have already tried. We answer in Polish, English or Russian, usually within a working day.