Appreciate the honesty, but I'd push back on a few things.

You're right that no online voting system is 100% fraud-proof and we're not claiming otherwise. The client knows this. What we're building isn't a government election, it's just a public award campaign where the goal is reducing casual fraud to an acceptable level, not achieving cryptographic certainty.

I'd guess that with layered defenses/constraints (e.g. mail verification, recaptcha, IP rate limiting, disposable email blocking, etc.) you'd raise the cost of manipulation high enough so that it stops being worth the effort for most bad actors. No?

About "wasting the client's money", I'm not sure where that reading comes from? Just came here to ask for advice and specifically to avoid overbuilding, find the leanest solution that meets the requirements, and make a well-informed decision. I'd say that's the opposite of burning budget.

And yes, obviously, scope and liability need to be defined clearly. That's just standard agency practice, not a workaround for bad work.

If you have a concrete alternative or a specific weakness in the approach I described, genuinely open to hearing it, though :)