Scams
Scams that target churches
Churches are trusting, run on volunteers, and publish staff names and emails on their websites. That is what scammers look for. The most common attack needs no technical skill at all.
The "pastor needs a favor" message
A staff member or church member gets an email or text that appears to come from the pastor: "Are you available? I need a quick favor, I'm in a meeting and can't talk." If they reply, the next message asks them to buy gift cards and send the codes, or to make a payment. The sender's name is the pastor's. The address may be a free Gmail account with the pastor's name on it, a lookalike domain, or, where the church has no email protection, the church's own address. The email guide covers the last case.
Do this week
- Adopt one rule: any request involving money, gift cards, a change of bank details, or personal information gets confirmed by a phone call or in-person conversation, using a number you already had. Not a number from the message, and not a reply to it.
- Tell everyone who handles money or answers the church email: the pastor will never ask for gift cards by email or text. Put it in writing, once, and repeat it a few times a year.
- Look at how your staff and pastor appear on your website. Names with a direct email address are what scammers copy. A contact form or a role address (office@) gives them less to work with.
- Know who to call. If someone has already sent money or codes, contact the bank or card company immediately; speed matters. Then report it to the FBI's Internet Crime Complaint Center and the FTC.
Other versions to know
- Lookalike domains
- An address that is almost yours: an extra hyphen, a swapped letter, .church instead of .org. Read the address, not just the name.
- Text-message and chat versions
- The same request through SMS or WhatsApp from an unknown number "using a new phone." The phone-call rule applies the same way.
- Invoice and bank-change fraud
- A real vendor (a contractor, a copier company) appears to email new bank details. Confirm by phone with the vendor, using the number on a previous invoice, before changing anything.
- "Your account is locked" or "you've been hacked, pay us"
- Panic-driven emails and calls follow every big security headline. Do not click or pay. Go to the real site by typing its address, or call the company yourself.
Do this year
- Make a short list of who can authorize payments, and by what channel. Anything outside it gets verified.
- Practice once: send the staff a harmless test message and see who verifies it. Treat misses as a training moment, not a failure.