The Obama campaign released news on Saturday morning of a holiday weekend, that it had raised a massive $181 million in September. It’s a staggering sum heading into the final month of campaigning. It almost equals his fundraising for July and August combined. But details about Obama’s fundraising windfall and a new report this morning from the Government Accountability Institute (GAI) raise troubling questions. Specifically, how much of this fundraising was illegal?

GAI found that Obama’s donation page doesn’t use any industry-standard credit card security measures. It doesn’t even use the basic Card Verification Value (CVV), the security number on the back of a card, that most other campaigns use. Not using this basic security measure makes it much easier for phantom donations or even foreigners to contribute illegally to the Obama campaign.

In 2008, persons named “Doodad Pro”, “Test Person” and “Good Will,” for example, made donations to the Obama campaign. “Doodad Pro” made an amazing 791 separate donations to the campaign, totaling almost $20k — far above the donation limits. Some of this came to light four years ago, yet the campaign hasn’t put in place any kind of security measures.

It isn’t an oversight but a conscious decision to not use CVV security. In fact, credit card companies charge the campaign higher fees because it doesn’t use this. So, the campaign is paying millions of dollars more in fees than it would not to have basic security.

Tellingly, the Obama campaign does use CVV security in its merchandise store. They utilize higher standards of security to purchase a coffee mug than making an on-line donation. Thus, the campaign has chosen to use two different payment systems on its site. Odd, eh?

It certainly adds important context to the campaign’s announcement that it raised over $180 million in September. The campaign said that over 1.8 million different people donated to the campaign. 98% of these donations were for $250 or less. The campaign doesn’t have to report the names of contributors donating less than $200. With just over 1.7 million people donating an average of $53, the overwhelming majority of the donations aren’t reportable. And a very large number of these donations will be under the $50 threshold where the campaign doesn’t even have to record the donor’s name.

Potentially, hundreds of thousands of individual donations are lost to any kind of security or verification. A “person” could make 1,000 donations of $49 and never be recorded on campaign finance disclosure forms. Their “name” wouldn’t even be recorded anywhere.

Shockingly, almost half the traffic to the Obama campaign website is from foreign sources. More amazingly, Obama.com, which simply redirects to the Obama donation page, gets almost 70% of its traffic from foreign sources.

And, although the Obama campaign owns hundreds of domain names with various iterations on Obama’s name, it doesn’t own Obama.com. That site is owned by an American businessman living in China with close ties to the Chinese government. The businessman, Peter Roche, has been to the White House 19 times since Obama took office and even snagged a seat at the head table for the State Dinner for the Chinese premier.

So, its not like the Obama folks don’t know the Chicago native. He is obviously a supporter and they could presumably have just said, “hey, can we get our domain name back?” There is obviously a reason they find it advantageous to have an outsider own Obama.com. But, what is it?

The Obama campaign gets enormous traffic to its site from overseas. Its donation page, unlike its merchandise store, is explicitly set up to not have any basic security or verification systems. It even pays extra money to not have the security features. It obviously feels it derives some benefit from this, but why and how?

Obviously, some portion of the $90 million the campaign raised from small donors is probably illegal. The question is, how much?

Follow Mike Flynn on Twitter.