Think for a moment about everything that flows through your online giving page. Every Sunday gift someone sets up on their phone. The recurring donations from families who have supported you for years. The names, email addresses, and giving histories of the people who trust you most. And underneath all of it, a bank account where every dollar eventually lands. When you put it that way, it’s easy to see why someone with bad intentions would find your giving platform far more interesting than almost anything else your church runs online. It sits right where the money and the donor information meet.
Here’s the encouraging part, and it’s the thing I most want you to hold onto: you did not build the payment technology, and you are not expected to. That part is handled by professionals. Your job is much smaller and much more manageable than it sounds. You are guarding a front door and keeping an eye on the money as it moves. That’s it. Let’s walk through what that actually looks like.
Why the giving platform is the target
Attackers follow the money, and your giving platform is where the money is. But it’s not only the deposits they’re after. A donor list is valuable on its own. Names paired with email addresses and a history of generosity are exactly the ingredients someone needs to send convincing scam messages to your congregation later. So when we talk about protecting the giving platform, we’re really protecting two things at once: the funds that keep the lights on, and the trust of the people who gave them.
The good news is that the most effective protections here are not technical wizardry. They’re mostly about who can get in, and about slowing down long enough to double-check when money is involved.
Put a strong lock on the admin door
The single most important habit is turning on multi-factor authentication for every person who has administrative access to the platform. You may have heard it called MFA, two-factor, or two-step verification. It simply means that logging in takes a password plus one more thing, usually a code from a phone. The reason it matters so much is that passwords get guessed, reused, and stolen all the time, and that second step stops a stranger cold even when they’ve gotten hold of the password. The Cybersecurity and Infrastructure Security Agency, the federal agency that advises organizations on exactly this kind of thing, treats multi-factor authentication as one of the most powerful steps any organization can take. Turn it on for everyone who can log in as an administrator, no exceptions.
While you’re in there, take a hard look at who actually needs that administrative access. It’s tempting to give everyone the keys so nobody’s ever locked out, but every additional admin is another door someone could slip through. Keep the number of full administrators as small as you reasonably can. And make sure each person has their own individual login. Shared accounts feel convenient, but they make it impossible to know who did what, and when one leaves, the password walks out with them. Individual logins mean you can remove someone’s access the moment they’re no longer serving in that role.
The one that actually saves the money
If you remember nothing else from this whole post, remember this. The most common way churches and nonprofits lose real money through a giving platform is not a dramatic hack. It’s a quiet request to change where the deposits go. Someone sends an email or a message that looks like it’s from your platform, your bank, or even a staff member, asking you to update the payout or bank account details. If you make that change, the next batch of donations lands in a stranger’s account instead of yours.
The defense is simple, and it works every time you use it. Any change to the payout or bank account information gets verified through a second, separate channel before you touch anything. If a request arrives by email, you confirm it with a phone call to a number you already know is real, not the number in the message. If someone tells you in person, you still verify through the platform’s official settings. The FBI’s Internet Crime Complaint Center has documented for years that this kind of payment-redirection fraud drains enormous sums from organizations, and their advice comes down to the same discipline: independently confirm any change to payment instructions before acting. A two-minute phone call is the cheapest insurance you will ever buy.
Keep watch, and reconcile
Even with good locks and good habits, you want to be the one who notices if something is off, and to notice quickly. Make it a routine to look at your payouts and reconcile what the platform reports against what actually arrives in your bank account. If a diversion or an error ever slips through, regular reconciliation is what catches it in days rather than months. This isn’t a burden reserved for the finance committee; it’s just the ordinary rhythm of paying attention to the money you’ve been entrusted with.
The part you don’t have to worry about
Here’s a genuine relief. A reputable giving platform or payment processor handles the sensitive card data for you, and it does so under a strict industry standard maintained by the PCI Security Standards Council. That means the actual card numbers are their responsibility, not yours. Your church should never store card numbers itself, never write them down, never keep them in a spreadsheet. If you’re ever tempted to, stop. The whole point of using a real processor is that you get to hand that risk to someone built to carry it.
Guard the front door, verify the money
So let’s bring it back to where we started. Keep the login to your giving platform separate from your other accounts and protected with a strong, unique password and that second step. Look at the platform’s own security settings and turn on whatever protections it offers, especially any alerts for logins or changes to payout details. Then simply keep the circle of administrators small, and verify any movement of money through a second channel.
That’s the whole job. You don’t run the payment technology, and you don’t need to. You guard the front door, and you double-check the money when it moves. Do those two things faithfully, and your giving platform becomes one of the best-protected parts of your ministry.
If you’d like a plain-English check of where your church stands today, get on the MissionDefend launch list and you’ll be first in line when our free assessment opens.
Sources
- FBI Internet Crime Complaint Center (IC3), “Business Email Compromise” — ic3.gov
- Cybersecurity and Infrastructure Security Agency (CISA), “More Than a Password” (multi-factor authentication guidance) — cisa.gov
- PCI Security Standards Council, “PCI Security Standards Overview” — pcisecuritystandards.org
- Federal Trade Commission, “Cybersecurity for Small Business” — ftc.gov