[justin66]

When it comes to fraud, obtaining a ballot is as easy as obtaining a bank check, for example. It's legal (in my state, anyway) for various parties to distribute them, and you could print your own, if you had the right paper. (You'd be in hot water if your ballot wasn't the exact document the state distributes - it's a crime to distribute a ballot that's prepopulated with the user's data, for example)

The security features of the process do not depend on mail-in ballots being unique or scarce.

[dodobirdlord]

The important thing that has to be avoided if you want to perpetrate voter fraud is accidentally submitting a ballot for someone who actually votes themselves. Given that most registered voters do in fact vote it's not a workable approach to just print out ballots and submit them, you also need a reason to believe that the targeted voter isn't going to vote, such as having intercepted their ballot.

[justin66]

In principle you could inconvenience a lot of people by sending in fake ballots randomly, lots of them, and forcing those people to cast provisional ballots when they try to vote in person. And whoever didn't show up, you'd have a decent chance of getting the vote in if you could approximate their signature.

In practice this doesn't happen, I just assume because it's easy to detect, it's a felony that comes with a prison sentence (and a lot of people would be looking for you) and because it actually creates a lot of problems for whichever candidate receives the votes.

I think an alternate scenario, where ballots are sent to a lot of people with the voter's name and address information "helpfully" prepopulated on the form, incorrectly, is perhaps slightly more of a threat. In this case people are at risk of casting a ballot that will be rejected and their board of elections might or might not notify them there's a problem. Sending prepopulated ballots is illegal where I live because an organization trying to be helpful in this way could inadvertently disenfranchise people by mistake with a bad list, but there's the other risk as well.

Again, easy to detect and a crime, and I don't think it's been a problem here.