A method carried out by an election server for identifying the election server to a voter over a network, the method comprising: generating first and second credentials for the voter; providing the first and second credentials to the voter with verification data unique to the voter using a secure channel; requesting the first and second credentials from the voter (S901); presenting the verification data to the voter if the voter supplies the credentials in response to the request (S902), wherein the verification data comprises a token ; receiving, from the voter, acknowledgement data unique to the voter (S903) to indicate that the correct token has been presented to the voter after the voter has supplied the credentials altering the verification data using the received acknowledgement data (S904) so that the altered verification data comprises an altered token including the acknowledgement data; and identifying the election server to the voter by presenting the altered verification data to the voter over the network (S905), wherein: the identifying comprises embedding the altered token in a validation page sent to a voting terminal during an electronic election, wherein: the validation page comprises graphical content associated with at least one of the voter or a vote associated with a retrieved electronic ballot; and the validation page (800-2) provides confirmation to the voter of the vote associated with the retrieved electronic ballot, based on at least the graphical content. generating first and second credentials for the voter; providing the first and second credentials to the voter with verification data unique to the voter using a secure channel; requesting the first and second credentials from the voter (S901); presenting the verification data to the voter if the voter supplies the credentials in response to the request (S902), wherein the verification data comprises a token ; receiving, from the voter, acknowledgement data unique to the voter (S903) to indicate that the correct token has been presented to the voter after the voter has supplied the credentials altering the verification data using the received acknowledgement data (S904) so that the altered verification data comprises an altered token including the acknowledgement data; and identifying the election server to the voter by presenting the altered verification data to the voter over the network (S905), wherein: the identifying comprises embedding the altered token in a validation page sent to a voting terminal during an electronic election, wherein: the validation page comprises graphical content associated with at least one of the voter or a vote associated with a retrieved electronic ballot; and the validation page (800-2) provides confirmation to the voter of the vote associated with the retrieved electronic ballot, based on at least the graphical content. the validation page comprises graphical content associated with at least one of the voter or a vote associated with a retrieved electronic ballot; and the validation page (800-2) provides confirmation to the voter of the vote associated with the retrieved electronic ballot, based on at least the graphical content. <EOS>