MissionDefend Blog

Home Articles Get your free assessmentComing soon

Author: Mission Defend Staff

  • The Bill That Looks Official and Isn’t

    The Bill That Looks Official and Isn’t

    The mail comes in on a Tuesday and the administrator sorts it on the counter the way she does every week. Bills in one pile, everything else in the other.

    One envelope has a window, a barcode, and a due date. Inside is a single page headed DOMAIN NAME EXPIRATION NOTICE, with the church’s actual web address printed across the top, an amount — $289.00 — a date sixteen days out, and a line near the bottom:

    Failure to renew your domain name by the expiration date may result in the loss of your online identity, your email service, and your search engine placement.

    It goes in the bills pile. Of course it does. It has the church’s web address on it, and nobody in the building is entirely sure who handles the website since Dave moved to Ohio.

    The church is not going to lose its website, and it doesn’t owe $289.00 to anyone. What’s on the counter is an advertisement dressed as an invoice, and it will succeed against a meaningful share of the organizations that receive it — not because they’re careless, but because it was designed by people who understand exactly how a small office approves a small bill.

    Two words worth decoding first

    A domain is your web address — the yourchurch.org part. It isn’t something you buy once and own forever, like a pew. It’s rented, usually a year at a time.

    A registrar is the company you rent it from — GoDaddy, Namecheap, Network Solutions, or, very often in a church, whatever company the volunteer who built the site in 2014 happened to use. The registrar is the only organization on earth that can renew your domain, and the only one you can owe money to for it.

    That’s the entire trick. The notice on your counter is almost never from your registrar. It’s from a company that looked up your domain in a public database, printed a page resembling a renewal bill, and mailed it hoping you don’t remember who your registrar is.

    Most people don’t. That’s not a character flaw. It’s a detail that comes up once a year at most, usually handled by automatic payment, often set up by someone who has since left.

    The line in the fine print that names it

    Here’s the part almost nobody reads, and the most useful thing in this article.

    Many of these mailings are not illegal. They’re legally structured as solicitations — offers to sell you a service — and they say so, in the smallest type on the page, because federal law requires it. Under the postal statute governing nonmailable matter, a solicitation sent in the guise of a bill or invoice must carry a conspicuous notice to the effect that:

    “This is a solicitation for the order of goods or services, or both, and not a bill, invoice, or statement of account due. You are under no obligation to make any payments on account of this offer unless you accept this offer.”

    When the Federal Trade Commission and the Florida Attorney General sued a company for mailing small businesses official-looking demands for $84 labor law posters, the mailers did carry a disclaimer — buried, phrased as “this offer serves as a solicitation and not to be intended as a bill due.” The FTC’s position was that the rest of the page — the form-style layout, the invented compliance language, the warning about fines — overwhelmed it.

    So teach your staff one habit: before paying any invoice nobody recognizes, read the smallest type on the page. If there’s a sentence saying this is a solicitation and not a bill, you have your answer, and you can throw it away without another thought. If there is no such sentence, you still don’t pay it — you check. But finding that line settles it in ten seconds.

    The rest of the family

    Domain renewal is the most common version aimed at churches. It isn’t the only one.

    Website or search engine “listing” fees. An invoice for a directory listing, a business profile, or search engine submission. The FTC has shut down operations that mailed exactly this to small businesses and nonprofits — in one case, deceptive invoices that listed the recipient’s real domain name or a near-copy of it, with the .com swapped for .org, to create the impression of an existing relationship. Google does not send invoices for appearing in Google.

    Business registry and compliance filings. Notices about annual reports, certificates of good standing, charity registration renewals, or required labor law posters. Your state may genuinely require some of these filings. It will bill you directly and at a lower price, and it will not use a private mailbox in another state.

    Trademark renewals. These arrive after any trademark filing, from official-sounding entities with names built out of the words patent, trademark, registry, and international.

    Copier and toner invoices. The classic. A call establishes your copier model, cartridges arrive, and an invoice follows. Under federal law, merchandise you never ordered may be treated as a gift — you may “retain, use, discard, or dispose of it in any manner” with no obligation to the sender. But an office administrator holding a box of toner and a bill rarely knows that.

    The price is the whole design

    Look again at the amount: $289.00, not $2,890.00.

    That number is not an accident. It sits below the threshold where anyone stops to think. Most churches have an unwritten rule — the treasurer signs off on anything over a thousand dollars, the administrator handles the rest — and these mailings are priced deliberately to land underneath it.

    A $289 charge doesn’t go to the board or get a second look at the finance meeting. It shows up as a line item that reads like a web expense, next to eleven other line items that also read like web expenses, and it renews quietly next year. The other half of the design is fear: every one of these pages implies that something you depend on is about to be switched off, and that the deadline is close. Deadline plus small amount equals paid.

    As for why you’re on the list — there’s no breach here and nothing was stolen. Churches and nonprofits receive these precisely because they are public in ways for-profit companies aren’t. Your domain’s registration record, including which registrar holds it and when it expires, is queryable by anyone. Your charity registration with the state is a public filing. If you file an IRS Form 990, it’s published, with your address and principal officer’s name on it. Your own website lists your staff and your mailing address, because it’s supposed to.

    Every one of those is a legitimate reason to be findable. Together they make a very clean mailing list, and the people who buy it know the organization at the other end has a small office, an approving signature, and a strong instinct not to let anything lapse.

    The rule that closes the whole category

    You cannot train people to recognize every variant; new ones get printed every year. So don’t train recognition — train a procedure.

    An invoice is only paid if someone in the building can name the person who ordered it.

    Not “it looks like something we use.” Not “we probably have that.” A name. Pastor Ellis signed the copier lease. Marcy set up the newsletter service. The website is registered with Namecheap and Dave set it up.

    If nobody can produce a name, the invoice does not get paid this week. It goes in a folder and waits. Nothing bad happens to an organization that pays a real bill three days late. Something bad happens every time it pays a fake one on time.

    That rule fails only when nobody knows what the organization actually subscribes to — which, in most churches, is the real underlying problem. So fix that too. Sit down for half an hour and write a single sheet, one row per recurring service:

    What it is · Who the real vendor is · What it costs · What month it renews · Who set it up · Which card or account pays for it.

    Domain. Website hosting. Email (Microsoft 365 or Google Workspace). The church management system. Giving platform. Email newsletter tool. Livestream service. Accounting software. Copier lease. Alarm monitoring.

    Print it. Put it in the finance folder and give a copy to the treasurer. From then on, every invoice can be checked against it in fifteen seconds — and it’s the single most useful document you can hand to whoever takes over the office after you.

    While you’re there, remove the panic lever on the domain specifically:

    Turn on auto-renew at your real registrar, and register the domain for several years at once if you can. A domain that renews itself automatically cannot be scared into an emergency payment.

    Turn on the registrar lock. This is a setting — usually called domain lock, transfer lock, or registrar lock — that blocks the domain from being moved to another company without your explicit action. Some of these mailings aren’t merely selling an overpriced service — historically, paying certain ones has authorized a transfer of the domain to the sender. The lock stops that.

    Fix the contact email on the domain record. If renewal notices go to a personal address belonging to a volunteer who left, real warnings vanish and fake ones look like the only ones you get. Point it at an address two current people can see.

    Name one person who approves new vendors. Not new invoices — new vendors. Adding a company to the list of organizations you pay money to should be a decision, made once, by a specific person.

    If one already got paid

    This happens, and it is not worth anyone’s embarrassment. Some of these mailings fool accountants.

    Stop the recurrence first. Check whether it was set up as a subscription on a card or as a recurring bank debit, and cancel it at the bank or card issuer. The one-time loss is small; the annual one isn’t.

    Try to reverse it. If it was paid by credit card in the last couple of months, call the card issuer and dispute it. Card networks are reasonably receptive to “we were billed for a service we never ordered.” A mailed check is harder, but if it hasn’t cleared, ask your bank about a stop payment.

    Confirm nothing actually moved. If it was a domain notice, log in to your real registrar and confirm the domain is still there, still yours, still locked, and still set to renew.

    Report it. Mailed fraud goes to the U.S. Postal Inspection Service at uspis.gov, and to the FBI at ic3.gov. Neither will get your money back, but these cases get built out of complaint volume — the FTC’s actions in this area came from exactly that.

    Then add the vendor list to the file, and let the loss buy you the control.

    What to do this week

    Make the recurring-services sheet. One page, one row per service, real vendor name and renewal month. Half an hour at the kitchen table with your bank statement and last year’s card charges in front of you.

    Then log in to your registrar, confirm auto-renew and the domain lock are both on, and check that the contact email is one a current staff member reads.

    That’s under an hour, and it retires a category of scam that has been running by mail since before most of us had email.

    If you’d like a wider read on where the gaps are, MissionDefend’s free assessment asks straightforward questions about how your organization handles email, donations, member data, and accounts, and hands back a baseline score with a ranked list of what to address first.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Federal Trade Commission, FTC, Florida AG to small business: Scrutinize “o-fishy-al” invoices; Federal Trade Commission, FTC Halts Cross Border Domain Name Registration Scam; U.S. Code, 39 U.S.C. § 3001, Nonmailable matter and 39 U.S.C. § 3009, Mailing of unordered merchandise; ICANN, FAQs for Registrants: Domain Name Renewals and Expiration.

  • QR Codes in the Bulletin: The Giving Scam Nobody Sees Coming

    QR Codes in the Bulletin: The Giving Scam Nobody Sees Coming

    The giving QR code is on the back of the bulletin, on the screen during announcements, on the laminated card in each pew rack, and on the poster by the door — because it works. Point a phone at the square, the giving page opens, and the awkwardness of passing a plate past a visitor is gone.

    Now consider what that square actually is. A QR code — the name stands for quick response — is a web address printed as a pattern a camera can read. That’s all. And its defining feature is the problem: a human being cannot read it. You can proofread every word of the bulletin, but you cannot proofread the code. A square that sends the congregation to your giving platform and a square that sends them to a scammer’s copy of it look identical from across the room, and nearly identical from six inches.

    The FBI warned about exactly this in a public service announcement back in January 2022: criminals “tamper with both digital and physical QR codes,” swapping legitimate ones for their own to steal credentials and payments. The FTC followed in December 2023 with the consumer version, describing the physical trick already common on parking meters — a scam sticker printed and stuck over the real code.

    A parking meter and a pew card have a lot in common. Both sit unattended in a public place. Both are trusted by the person scanning. And both are asking for money.

    The two directions the swap happens

    On paper, with a sticker. Someone prints their own code on adhesive labels — a task that takes ten minutes and costs nothing — and applies them to the lobby poster, the pew cards, the yard sign for the capital campaign. The fake destination is a page that looks like your giving platform: same logo, lifted from your website; same colors; a form that takes card numbers. Sunday’s gifts flow to an account you’ve never heard of, and the failure is invisible until someone asks why online giving dipped.

    Upstream, in the file. The subtler version never touches your building. It compromises the source of the code: the shared Canva account a volunteer uses for slides, the email thread where the bulletin file gets passed around, the church email account of whoever assembles it. Change the code in the master file once, and the church then prints, projects and distributes the fraud itself, every week, with its own hands.

    And to complete the picture: this scam also arrives at the church from outside — unsolicited packages with “scan to see who sent you this gift” cards, which we covered in the brushing scam. Same square, opposite direction. Today’s post is about the codes you publish.

    Why nobody notices

    Nobody checks the destination. On a phone, the preview that appears when you scan shows a URL for a moment — but giving platforms have long, forgettable addresses full of subdomains ( `yourchurch.givingvendor.com`, `app.vendor.com/give/12345` ), so the congregation has no memory of what the right address looks like. The FTC’s advice — inspect the URL for misspellings before opening — assumes you know what correct is. Most givers don’t.

    That’s not a reason to abandon the codes. It’s the design constraint: the safeguards have to live with the people who publish the code, because the people who scan it can’t be expected to catch anything.

    What to do this week

    Put the giving address into human memory. Pick the shortest true form of your giving URL and print it next to every code, every time: “Scan, or visit yourchurch.org/give.” That one habit does three jobs: givers who prefer typing never scan at all; anyone who scans can compare what opened against what’s printed; and a swapped sticker now has to fake two things that must agree. A code with no readable address beside it is asking the congregation to trust ink they can’t read.

    Make one person the owner of the square. Not a committee — a name. That person generates the code (directly from the giving platform, not from free third-party QR generator sites, which can route through tracking domains you don’t control), keeps the master graphic in one place, and is the only source others copy from. Every “just grab the code from last month’s file” is a link in a chain nobody is watching.

    Add the codes to a monthly walk-through. First Sunday of the month, someone scans every published code in the building — pew cards, posters, yard signs, the slide deck — on their own phone and confirms each lands on the real page. It takes five minutes. While they’re at it: run a fingernail over printed codes. A sticker over ink has an edge you can feel. That’s the FBI’s tampering warning turned into a chore anyone can do.

    Watch the money like a control, not a report. Whoever reconciles giving should treat an unexplained dip in online gifts as a security signal worth a same-week look, not a trend to discuss at the quarterly meeting. In the sticker version of this scam, the finance spreadsheet is the only alarm that ever goes off.

    Tell givers the one rule that survives everything. In the bulletin, once a season: our giving page is yourchurch.org/give — if a code ever takes you anywhere else, close it and tell the office. You’re not teaching the congregation to distrust the plate. You’re giving them the same gift every post in this series comes down to: a known-good channel to fall back on.

    The QR code turned your congregation’s generosity into a single point of failure. It can stay — it should stay — but it graduates from decoration to infrastructure. Infrastructure gets an owner, a checklist, and an alarm.

    The MissionDefend assessment asks who owns your giving links, who can edit what gets printed, and whether anyone would notice a swap — along with the rest of your baseline. Join the launch list.

    Sources: FBI Internet Crime Complaint Center, Cybercriminals Tampering with QR Codes to Steal Victim Funds, Alert I-011822-PSA (January 18, 2022); Federal Trade Commission, Scammers hide harmful links in QR codes to steal your information (December 6, 2023).

  • “Your Subscription Renewed for $499.” There’s No Link — That’s the Point.

    “Your Subscription Renewed for $499.” There’s No Link — That’s the Point.

    The email lands at 8:20 on a Tuesday, near the top of the administrator’s inbox, between a facilities quote and a note about the flowers.

    Order Confirmation — Auto-Renewal Processed Thank you. Your annual subscription has been renewed. The charge will appear on your statement within 24–48 hours. Plan: Total Device Security — 5 devices Amount: $499.00 USD Order ID: 7734-2210-9861 If you did not authorize this renewal, you must cancel within 24 hours to receive a full refund. Call our billing department at (888) 555-0142.

    There is no link to click. Nothing to download. No misspelled sender name, no urgent all-caps subject line, none of the things anyone has ever been trained to look for.

    And the administrator’s first honest reaction is not suspicion. It’s: do we pay for that?

    She’s worked here three years. There are maybe forty things the church pays for. The last administrator set most of them up — some on the church card, some on the pastor’s card, some auto-drafting from checking. She genuinely does not know whether the church subscribes to Total Device Security, and $499 is real money out of a tight budget.

    So she calls. That was the entire objective of the email.

    Callback phishing, decoded

    Callback phishing is a scam that uses an email to make you dial a phone number, where the actual attack happens. You may also see it called TOAD, for telephone-oriented attack delivery — the same thing in acronym form.

    The name describes the structure precisely. The email is not the attack. It’s bait for a phone call, and the attack is a person talking to you.

    That inversion is why it defeats a decade of security training. Everything your staff has been told about email — don’t click the link, don’t open the attachment — is about a message that contains something dangerous. This message contains nothing dangerous at all. It’s an invoice with a phone number on it, which describes roughly half the legitimate mail your office receives.

    Why your spam filter waves it through

    Spam filters catch things. A malicious attachment, a link to a known-bad domain, a login page pretending to be Microsoft, a sender whose address doesn’t match the domain it claims — a filter can inspect all of that and score it. A plain-text invoice with a phone number offers nothing to inspect.

    The State of Wyoming’s technology agency puts the mechanics plainly in its guidance on this scam: since these emails “do not contain malicious links or attachments, they can bypass email spam filters.” No payload to detonate, no URL to check against a blocklist. The message is just words and ten digits, sent from an address that hasn’t done anything wrong yet.

    Say this to your staff plainly. The assumption underneath most office email habits is that the filter is a wall. It isn’t — it catches what can be caught, and this message is built specifically not to be one of those things.

    The FTC has documented the exact template: “scammers send notices about automatic renewals for tech support subscriptions. You might get an email or text message that says you were charged hundreds of dollars to renew your tech support subscription.”

    What happens on the call

    The person who answers is pleasant, unhurried, and competent. There is no pressure in the first two minutes — the opposite, in fact. He is sorry about the confusion. He can absolutely cancel that and process the refund. It’ll take just a moment.

    Then, gently, comes the ask. To process the refund he needs to connect to the computer — so the credit lands on the right device, or so the software can be removed. He gives her a website to visit and a short code to type in.

    That’s a remote access tool — software that lets someone else see and control your computer as if they were sitting at it. There are entirely legitimate versions; your real IT provider probably uses one. In this call, it’s the whole objective. The FTC describes the pattern directly: “they ask for remote access to your computer and pretend to scan it for viruses.”

    From there it goes one of two ways.

    He takes the machine. With control of the computer he installs something that keeps his access after the call ends, harvests saved passwords from the browser, and looks for anything worth having — banking access, the donor database, the mailbox. Some of these are the front door for a ransomware attack weeks later.

    He fakes an overpayment. This is the version that takes money the same day. The FTC describes it step by step: “They take you to a spoofed website that looks real and tell you to enter your bank or credit card information to process the refund. After you do that, they claim there was an error in the amount entered. They say they refunded you too much money and insist you pay them back with gift cards, a wire transfer, a bank transfer, cryptocurrency, or a payment app.”

    With remote control of the screen, he can make the numbers appear to move. A refund of $499 seems to arrive as $4,990. He is distraught — his mistake, he’ll lose his job, can she please just send back the difference? The balance she is looking at was edited in front of her. Nothing was ever refunded, and the money she sends is entirely real.

    The sympathy is engineered. He has spent fifteen minutes being helpful, and now he needs help. Most people, especially people who work at a church, find that very hard to refuse.

    The church-shaped version

    Every element of this lands harder in a small ministry office, and none of it is because anyone was careless.

    Nobody knows the full list of subscriptions. This is the real vulnerability, and it is almost universal. Software was set up by a departed staff member, a volunteer, or a contractor. Renewals auto-draft. The bookkeeper sees a charge and assumes someone approved it. The scam works because “do we pay for that?” is a genuinely open question.

    There’s no IT helpdesk to check with. At a company, this call gets forwarded to the technology team in thirty seconds. In a church office, the administrator is the technology team, and she has a bulletin to finish.

    Payment cards are shared. When the pastor’s card, the church card, and a reimbursement arrangement are all in play, an unrecognized charge doesn’t read as fraud. It reads as something somebody else did.

    The instinct is to be helpful. Front desk coverage rotates, and church offices are staffed by people whose actual job is to be kind to whoever is on the phone.

    None of this is negligence. It’s what a five-person organization looks like, and it can be closed with about an hour of work.

    The rule, and the list

    One sentence, and it covers the entire category:

    Nobody at this organization installs software or grants remote access to a computer because of an incoming email or an incoming call. Ever, for any reason.

    Every legitimate remote support session starts with a relationship you initiated — your IT provider, whom you called, at a number you already had. No refund requires access to your computer. No cancellation requires it. No bank requires it. If someone on a call needs to see your screen and you did not start that relationship, the answer is no.

    The second half is what makes the rule easy to follow: write down what you actually pay for.

    One page or one spreadsheet. Four columns: the service, what it’s for, roughly what it costs and when it renews, and — most importantly — who owns it. Include everything: Microsoft 365 or Google Workspace, the church management system, the giving platform, the website host, the domain registration, the streaming service, accounting software, online backup, alarm monitoring, the copier contract. Pull the last three months of bank and card statements and work through the recurring charges line by line. That is the whole exercise, and it takes an hour the first time.

    Two things come out of it. The security control: when a renewal notice arrives, “do we pay for that?” takes eight seconds instead of being unanswerable. And the money — nearly every organization that does this finds something it’s been paying for and hasn’t used in two years.

    Then one habit on top, which also covers the versions that arrive by text or voicemail: never verify a charge using contact details supplied by the message telling you about the charge. Open your bank or card account the way you normally do — your own bookmark, your own app — and look at the actual transactions. If the charge isn’t there, there’s nothing to cancel. If it is, call the number printed on the back of your card.

    That’s the same money rule that runs through the rest of this blog — verified by voice, on a number you already had — pointed at a different target. The direction of contact is the control.

    And give your staff explicit permission to be unhelpful. Say it out loud: you will never be in trouble for hanging up, or for saying “I’ll have to check on that and call you back.” Without that permission, a polite person facing a polite stranger will stay on the line.

    If it already happened

    If someone granted access or sent money, move today. This is recoverable more often than people expect, and much less often after a week.

    Disconnect that computer from the network — unplug the cable, turn off the Wi-Fi. Do not wipe it, and do not “just reinstall.” Someone technical needs to see what was installed before it goes back into use, and wiping destroys the only record of what happened.

    Call the bank immediately if money moved or if banking details were entered during the call. Say the words fraud and unauthorized, and ask about recalling the transfer. If a card was involved, cancel it.

    Change the passwords for anything that computer could reach — email, the giving platform, the church management system, the accounting software — from a different device, and sign out all active sessions. Turn on multi-factor authentication anywhere it isn’t already on, and check the mailbox for forwarding rules nobody remembers creating. The FTC’s guidance is the same: if you gave a username and password to a tech support scammer, change your password right away.

    Report it. File with the FBI at ic3.gov. If money moved, go to ic3.gov first and quickly — the FBI’s Recovery Asset Team froze $507,042,623 across 3,574 domestic cases in 2025, and that process depends almost entirely on speed.

    And tell someone in the office immediately. The pattern that turns a contained mistake into a serious loss is always the same: someone embarrassed, waiting until Monday.

    What to do this week

    Build the subscription list. Pull three months of statements, write down every recurring charge with an owner’s name beside it, and put the file where the administrator and the treasurer can both reach it. That’s the hour, and it’s the only part of this that takes real time.

    Then send one sentence to everyone who answers the phone or the office email: we never install software or allow remote access because someone contacted us — if you’re asked to, hang up and tell me, and you will never be in trouble for it.

    For a wider look at where a determined caller could get traction, MissionDefend’s free assessment asks plain-English questions about how your organization handles email, payments, vendor accounts, and member data, then returns a baseline score and a ranked list of what to fix first — including the gaps, like an unmanaged pile of subscriptions, that don’t look like security problems until they are.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Federal Trade Commission, How To Spot, Avoid, and Report Tech Support Scams; State of Wyoming Enterprise Technology Services, Callback Phishing; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

  • Tailgating and the Unlocked Door: Social Engineering in Person

    Tailgating and the Unlocked Door: Social Engineering in Person

    On Tuesday morning the side door by the kitchen is propped open with a folding chair, because the food pantry delivery comes on Tuesdays and the volunteers got tired of walking around to let the driver in.

    At 9:40, a man in a polo shirt with a lanyard and a toolbox walks through it. He nods at the volunteer sorting cans — she nods back — and heads down the hall toward the office with the unhurried walk of a man who has been here before. He has never been here. In the next eleven minutes he will be alone with the office computer, the top drawer where the spare key lives, and the filing cabinet with last year’s giving statements.

    Everything this series has covered so far arrives through a screen or a phone. This one walks in. Tailgating is the physical version of social engineering: following someone through a door they unlocked, or being let in because you look like you belong. Security people also call the polite variant piggybacking — where the victim actually holds the door — but the distinction doesn’t matter much in practice. The attack is the same: skip the lock by borrowing someone else’s trust.

    Why a church is the easiest building in town

    It’s worth being honest about this: a church is designed to be walked into. That is the point of the building. The signage says welcome, the culture says welcome, and on any given day the people inside include members, visitors, contractors, delivery drivers, twelve-step groups, tutoring programs, and someone’s cousin picking up folding tables. Nobody can say who “belongs,” because the honest answer is almost everyone.

    CISA — the federal Cybersecurity and Infrastructure Security Agency, which runs a program specifically for houses of worship — frames the problem exactly this way: security planning for congregations has to work with “a congregation’s desire for openness and access,” not against it. The goal is not a church that interrogates strangers. The goal is a church where openness is a decision, not an accident.

    And notice what the intruder in the polo shirt was actually after. Not the sound equipment. The office — because in 2026 the valuable thing in your building is data and access: the computer that’s still logged in, the passwords in the drawer, the donor records, the blank checks, the network jack behind the desk. Physical entry is how an attacker with no technical skills gets everything a hacker wants.

    The four moves, so your team can name them

    The borrowed opening. The propped door, the loading dock during an event, the stream of people arriving for a funeral. No deception needed — just timing. Big, emotional gatherings are ideal cover; nobody checks faces at a funeral.

    The full hands. Boxes, coffee cycles, a ladder — anything that makes a decent person hold the door. The costume does the arguing: florist during a wedding week, HVAC in summer, “the piano tuner” any time.

    The confident walk. No interaction at all. Enter during office hours, move like you have an appointment, know that the person who might ask questions will assume someone else already did. This is pretexting performed with posture instead of a phone call.

    The advance call. The strongest version pairs both: a phone call Monday — “we’ll have a tech out Thursday for the fire panel inspection” — so that Thursday’s visitor is expected. Expected strangers get escorted to the electrical room and left alone.

    What to do this week

    Retire the propped door; give the regulars a better path. A door held open by a chair is an unlocked building with extra steps. Solve the reason it was propped: a doorbell at the delivery entrance that actually rings where volunteers are, a posted delivery window when someone staffs that door, or a keypad code for the food-pantry team that changes each season. People prop doors when the secure path is annoying. Make the secure path the easy one.

    Draw the one line that matters. Most of the building can stay gloriously open. Pick the two or three spaces that can’t — the office, wherever records and money live, the room with the network equipment — and treat those doors as the perimeter: locked when unoccupied, every time, even for ten minutes. “Locked office, open building” preserves the welcome and removes the prize. Pair it with the screen-lock habit: an office computer left logged in behind an unlocked door is the whole breach, pre-assembled.

    Replace suspicion with hospitality — literally. Train everyone on one move: greet the stranger. “Hi! Can I help you find something?” Warm, natural, entirely on-brand for a church — and devastating to a tailgater, whose whole method is moving unquestioned. A legitimate visitor gets directions. An intruder gets a decision point. Add the escort norm for anyone doing work in a restricted area: contractors are expected visitors with company, not wanderers.

    Verify the advance call like any other pretext. “We’re sending a tech Thursday” gets the same treatment as every unsolicited contact in this series: call the company back on the number from your contract, not the number that called you. And keep a plain sign-in sheet for non-Sunday visitors and workers — not as bureaucracy, but so that “who was in the building Tuesday?” has an answer.

    One more thing worth knowing exists: CISA offers houses of worship a free self-assessment guide and access to regional Protective Security Advisors who will walk your building with you, and FEMA runs a Nonprofit Security Grant Program that has funded exactly these kinds of improvements. You do not have to invent this from scratch.

    The doors of the church should be open. That line is theology, and nothing here argues with it. But open should describe the sanctuary and the welcome — not the filing cabinet, the finance computer, and the drawer with the spare keys. Lock the three doors that matter, greet everyone else, and you’ve kept both promises.

    The MissionDefend assessment covers the physical side of data protection — where records live, who can reach them, what’s locked — alongside the digital. Join the launch list for first access when it opens.

    Sources: Cybersecurity and Infrastructure Security Agency, Protecting Houses of Worship; FEMA, Nonprofit Security Grant Program; Federal Trade Commission, FTC Announces Impersonation Rule Goes into Effect Today (April 1, 2024).

  • The Board Member on the Call Wasn’t Real

    The Board Member on the Call Wasn’t Real

    The finance committee meets at seven on Thursday, on video, the way it has since 2020. Four squares on the screen. The treasurer joins eight minutes late, apologises, says the audio on his end is bad, and keeps his camera on anyway.

    He’s brief. The contractor for the roof project needs the deposit moved tonight to hold the crew for next month — the account details came through this afternoon and he’s forwarded them to the administrator. He asks whether anyone objects. Nobody does. His camera freezes twice while he’s talking, which is completely normal on a church Wi-Fi connection, and which is also the reason nobody looks too closely.

    The treasurer was at his daughter’s recital that evening and did not attend the meeting.

    What a deepfake actually is

    Deepfake is a plain word wearing a technical costume. It means a fake image, video, or audio recording generated by software that has studied real recordings of a person until it can produce new ones — a video of someone saying something they never said, or a voice speaking words the person never spoke.

    There’s no mystery in it and nothing exotic. The software needs examples of the person, and it produces convincing new material from them. The more examples it has, the better the result.

    The two forms that matter to a church are different in maturity, and it’s worth being precise about which is which, because the difference determines how you should think about the risk.

    Where the technology actually is

    Synthetic voice is here, it is cheap, and it is fast. This is the mature threat. Software that clones a voice from a short sample is widely available and requires no skill to operate. The FBI’s public warning on generative AI fraud describes criminals using AI-generated audio to impersonate people — a relative in a crisis asking for immediate financial help, or an account holder calling their own bank — in order to extract funds or gain access to accounts. If a caller’s voice sounds exactly like your finance chair, that no longer tells you anything.

    We’ll cover voice cloning on its own in a later post, because it deserves the room.

    Live synthetic video on a call is real but harder. This is where it’s easy to overstate, so here are the actual facts of the best-documented case.

    In January 2024, an employee at Arup — a London-headquartered engineering and design firm — joined a video conference at the company’s Hong Kong office with people who appeared to be the chief financial officer and other colleagues. They were digital recreations. Over the following week the employee made fifteen transfers totalling HK$200 million, roughly US$25 million. Hong Kong police disclosed the case in February 2024, and Arup confirmed in May 2024 that it had been the victim, with a spokesperson saying the firm notified police in January.

    That is one very large fraud against a global firm with thousands of employees, and it should be read as a demonstration rather than as a description of what happens on a typical Tuesday. The everyday version of this attack is still a plain email or a phone call. But the Arup case establishes something that is no longer arguable: a video call is not proof of who you are talking to.

    The FBI’s guidance reflects the same conclusion, noting that criminals generate AI video to depict executives and authority figures in real-time chats or to lend credibility in private communication.

    Why a church is unusually exposed

    Voice cloning needs reference material. Consider what your organization publishes, on purpose, every single week.

    Sermons. Livestreamed services, archived and public. Podcast episodes. Announcement videos. Staff introduction clips on the website. A capital campaign video with the board chair speaking directly to camera for three minutes.

    Most small businesses have almost nothing like this. A church typically has hours of clean, well-recorded audio of its most authoritative voices, freely downloadable, indexed and organized by name.

    None of that is a reason to stop. The livestream is ministry, and taking it down to prevent a hypothetical fraud would be trading something real for something speculative. The right response is not to publish less. It is to stop treating a familiar voice as identification — because for your organization specifically, a familiar voice is public information.

    The rest of the reference material is public too. Your board members are listed on your website or in your 990 filing. Your bank is on your checks. Your building project is in the newsletter. A fraudster does not need to research you; they need to read you.

    The rule that works no matter how good the fake is

    Everything above is about how convincing the impersonation can be. The control below doesn’t care.

    A decision to move money is never made on a call. It is confirmed on a channel the requester did not choose.

    Sit with that second sentence, because it’s the load-bearing part. If the request came in on a video call, confirmation happens by phone. If it came by phone, confirmation happens by a text to the number in your records, or in person, or on a second call you place. The attacker controls the channel they contacted you through — that’s the one thing you can be certain of. So verification has to happen somewhere else.

    This is the same money rule that runs through everything else on this blog: any change to payment details is verified by voice, on a number you already had, before the payment goes out. The deepfake era changes exactly one thing about it. Voice alone is no longer sufficient confirmation. The channel is doing the verifying now, not the sound of the person.

    Three specific mechanisms make that rule practical.

    A shared verbal passphrase for leadership. Agree on a word or short phrase, in person, among the small group of people who can authorize payments — pastor, treasurer, board chair, administrator. It is never written in email, never stored in a shared drive, never said on a video call. When a request to move money arrives from a person rather than a process, the recipient asks for it. The FBI recommends exactly this technique for families targeted by AI voice fraud: “Create a secret word or phrase with your family to verify their identity.” A leadership team is the same idea with a different roster.

    Pick something unguessable and unGoogleable. Not the church’s founding year, not the pastor’s dog. A random pair of words is ideal, and you should agree in advance that anyone may ask for it without it being awkward, including from the senior person in the room.

    A callback rule. No payment instruction is executed on the strength of the call it arrived on. The administrator hangs up, dials the number already in the personnel file or the vendor contract, and confirms. It adds ten minutes and defeats the entire category.

    Dual approval above a threshold. Pick a dollar figure appropriate to your budget and require two named people to approve anything above it — with the second approval given through a channel other than the one the request came in on. This is the control that survives even when the first person is completely fooled, and it’s why it belongs in your written policy rather than in someone’s habits.

    Write all three down. A control that lives only in the treasurer’s head disappears the moment the treasurer is on vacation, which is the week the request will arrive.

    Tells on a live call, and why they expire

    If you find yourself on a call and something is off, there are things worth trying.

    Ask the person to turn their head fully to one side, or to stand up and step back from the camera. Current systems handle a straight-on face far better than a sharp profile or an unusual angle, and artifacts often appear at the edges — around the ears, the jawline, the hairline, or where hair meets background.

    Ask them to hold a hand up beside their face. Hands are still difficult.

    Better than either: ask something only the real person would know, and make it specific and recent. Not “what’s our budget” — anything published is available. Ask what they ordered at lunch on Tuesday, or what the sanctuary thermostat has been doing, or the name of the person who fixed the parking lot lights. A synthetic impersonation is usually driven by someone reading from research, and research does not include last Tuesday’s lunch.

    Now the honest caveat, which matters more than the tips: these tells are expiring. Every one of them exists because the technology has a current limitation, and current limitations do not stay current. Head turns will get better. Hands will get better. The list above may be substantially useless in two years, and there is no version of it that stays reliable.

    That’s not a reason to skip them. It’s the reason the procedure matters more than the perception. A passphrase and a callback rule work identically whether the fake is crude or flawless, because they never ask anyone to judge how real something looks. They’re the only part of this article with a shelf life.

    If it already happened

    Move fast; recovery is a race measured in hours.

    Call your bank’s fraud line first, before anything else, and ask them to attempt a recall. Wire transfers are hardest to reverse and ACH transfers sometimes possible — either way, the first hour matters more than everything you do afterward.

    Report to the FBI at ic3.gov, and say business email compromise even if the request arrived by video, because that’s the category the Bureau’s recovery process runs on. The FBI’s Recovery Asset Team ran 3,574 domestic cases in 2025 and froze $507,042,623, and that process works dramatically better inside the first 24 to 72 hours.

    Tell your board and your insurer the same day. Many policies have prompt-notice requirements, and a delay can affect coverage.

    Then look at the mailbox. These attacks are frequently preceded by someone reading email inside your organization for weeks. Change passwords from a different device, sign out all sessions, enable multi-factor authentication if it isn’t on, and check every mailbox for forwarding rules nobody remembers creating.

    For scale: the FBI logged 24,768 business email compromise complaints in 2025, with losses of $3,046,598,558 — an average of about $123,005 per report. This is where the money in fraud actually goes, and a synthetic voice or face is simply a new way to open the same door.

    What to do this week

    Choose a passphrase with your leadership team — pastor, treasurer, board chair, administrator — in person or on a call where you can see each other, and agree it is never written down or emailed. Then send one message to whoever executes payments, in your own words: no payment or change of payment details goes out on the strength of a call, however convincing. Hang up, call the number we already have, confirm.

    That’s twenty minutes, and unlike every visual tell in this article, it doesn’t stop working next year.

    Procedures are what hold up when the technology stops helping you tell real from fake. MissionDefend’s free assessment asks plain-English questions about how your organization approves payments, handles email, and manages accounts, then returns a baseline score and a ranked list of what to fix first — including whether your money controls depend on someone recognizing a voice.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud; South China Morning Post, UK multinational Arup confirmed as victim of HK$200 million deepfake scam; CNN, Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

  • Pretexting: The Fake IT Guy and the Vendor Who Isn’t

    Pretexting: The Fake IT Guy and the Vendor Who Isn’t

    The call comes in on a Wednesday around 10 a.m., which is not an accident — late enough that the office is busy, early enough that nobody’s left for lunch.

    “Hi, this is Marcus from TechServe — we handle the copier contract? We’re pushing a security update to all our units this week and I need someone to read me the numbers off the admin sticker on the back. Should take two minutes. Sorry for the hassle — half the churches in the county are on my list today.”

    There is no Marcus. There is no update. But notice everything that call already got right: a plausible company, a plausible task, an apology, a time limit, and a detail — half the churches in the county — that makes the whole thing feel routine. By the time an ask arrives, it doesn’t feel like a request from a stranger. It feels like step three of a process that started before you picked up.

    That manufactured backstory has a name: pretexting. The pretext is the invented situation — the role, the reason, the paperwork — that makes the eventual request seem normal. If phishing is a fake message, pretexting is a fake context. It’s the con artist’s stage set, and it’s the engine inside most of the attacks this series has covered: the fake invoice works because “vendor billing you” is a pretext, and the phone scam works because “your bank’s fraud department” is one.

    The costumes that get worn at churches

    Attackers pick pretexts the target already expects to encounter. For a church or small nonprofit, four costumes come up over and over.

    The IT technician. “We’re doing maintenance on your email this afternoon — I’ll need someone to confirm the login so accounts don’t lock out.” Small congregations rarely have in-house IT, so someone external who handles computer things is entirely believable — most churches genuinely do have a guy. The test is simple: real technicians you actually pay never need your password. Anyone who asks for one is not your technician, whatever the caller ID says.

    The vendor with an account problem. The copier company, the payroll processor, the giving platform, the alarm monitoring service. The caller knows which one you use — often because it’s visible on your website, in a bulletin PDF, or on a sticker by the door — and the “problem” needs an account number, a card update, or remote access to fix.

    The authority up the chain. The diocese, the district office, the denomination’s insurance program, an “auditor” doing an annual review. Hierarchical organizations are trained to respond to the level above them, and attackers borrow that reflex. A folder of official-looking paperwork, a confident tone, and a Friday-afternoon deadline can move remarkable amounts of information.

    The government caller. The IRS about your exempt status, a “grant administrator” about funds you’re eligible for, a court officer about a missed jury summons for your pastor. Impersonating agencies and businesses is now squarely illegal under a rule the Federal Trade Commission put into force on April 1, 2024 — a rule created precisely because the FTC logged over $1.1 billion in reported impersonation-scam losses in 2023, more than triple the 2020 figure. A rule after the fact, of course, only helps you if you didn’t comply during the call.

    Why good people hold the door open

    Pretexting exploits the two instincts churches deliberately cultivate: helpfulness and trust. The volunteer at the desk wants to be useful to the nice technician. The bookkeeper doesn’t want to make the diocese wait. Nobody wants to be the suspicious one — it feels rude, and ministry culture prizes warmth.

    So the fix cannot be “make everyone suspicious.” It won’t take, and it would cost you something real. The fix is to make verification feel like procedure instead of accusation — the same shift that makes a bank teller checking ID feel professional rather than hostile.

    What to do this week

    Give the front desk a script that isn’t rude. One laminated card: “Happy to help with that — our process is to call you back through the main number we have on file for your company. What’s your name and extension?” A real vendor hears bookkeeping hygiene. A pretexter hears the con failing. The power of the callback is that it routes around everything the attacker controls — their number, their story, their urgency — to a channel you already trusted before the call existed.

    Keep a one-page vendor sheet. Every company that can plausibly call you — copier, payroll, giving platform, insurance, IT, alarm — with the phone number from your contract or a bill you’ve paid, not from the internet. Verification only works if the real number takes ten seconds to find. Update it when contracts change, and note who your actual account rep is.

    Decide what the “sticker information” is worth. Serial numbers, account numbers, staff direct lines, which software you use — none of it is secret, exactly, but each piece makes the next pretext more convincing. The attacker who knows your copier model and your administrator’s first name sounds like Marcus. Trim what’s published where you can, and treat unsolicited requests for those details as the reconnaissance they are.

    Rehearse the two-question test. Before acting on any unsolicited contact, staff ask: Did I have a way to expect this? and Am I being given a reason not to verify? A real vendor’s real update survives a callback tomorrow. Only the fake one needs it done on this call, today, before lunch.

    Pretexting is patient, polite, and completely dependent on one thing: the target acting inside the story the attacker built. A callback steps outside the story. Nothing inside it survives that.

    MissionDefend’s free assessment includes the unglamorous controls that stop pretexting — callback rules, vendor verification, front-desk procedure — and shows you which ones your organization is missing. Get on the launch list.

    Sources: Federal Trade Commission, FTC Announces Impersonation Rule Goes into Effect Today (April 1, 2024); Cybersecurity and Infrastructure Security Agency, Recognize and Report Phishing; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

  • The Blackmail Email Every Pastor Eventually Gets

    The Blackmail Email Every Pastor Eventually Gets

    It arrives at 11:40 on a Tuesday night, which is not an accident.

    The subject line is your own old password. Not a password you use now — one you recognize, from years ago, from an account you’d half forgotten. Seeing it sitting there in a subject line does something physical.

    The message says the sender has had access to your devices for months. It says a program on your computer turned on your camera and recorded you. It says there is a list of your contacts — your congregation, your board, your family — and that everything will go to all of them unless a payment in cryptocurrency arrives within 48 hours.

    If you are a pastor, an executive director, or a board chair, there is a good chance you have already received one of these, or will. And there is a very good chance you told no one.

    This article exists mostly for that second part.

    What the message actually is

    These emails are sent by the million. They are not written for you. Nobody selected you, studied you, or sat outside your house. A list of email addresses was purchased, a template was filled in automatically, and the send button was pressed on all of it at once.

    A typical one reads something like this:

    I know [password] is your password. I placed malware on an adult site you visited and it recorded you through your camera. I also copied your contact list. You have 48 hours to send $1,900 in Bitcoin to the address below. If you pay, I delete everything. If you tell anyone, I send it immediately.

    The FBI has been warning about this family of scam since at least 2016, when it published an alert on extortion emails tied to high-profile data breaches. A later alert describes the same tactic directly — messages claiming “I have a recorded video of you,” made more convincing by including “the recipient’s user name or password” taken from a breach.

    The New York State Police, warning residents about the same automated campaigns, stated the bottom line without hedging: despite these claims, the scammer does not have access to the victim’s device or personal information.

    Where the password came from

    This is the detail that makes the email feel real, and it has a boring explanation.

    A data breach is what happens when a company that stored your information gets broken into and that information is taken. Not your computer — theirs. A retailer, a forum, a fitness app, a hotel chain, a professional association, a church management platform. If you made an account there years ago, your email address and password were sitting in their database, and when that database was stolen, yours went with it.

    Those stolen databases get combined, resold, and eventually circulated freely. Millions of email-and-password pairs, sitting in files anyone can obtain.

    So the scammer’s software takes a line from one of those files, drops the password into a template next to the matching email address, and sends. That’s it. The password in your subject line is evidence of one thing only: that a company you once did business with was breached, probably a long time ago, possibly before you were in your current role.

    It is not evidence of a camera, or malware, or anyone watching anything.

    Some versions include your home address instead, or as well. Same explanation — addresses are in those same breached records, and in a hundred commercial marketing databases besides.

    The version with a photo of your house

    A newer variant, which the New York State Police specifically flagged, includes a photo of the recipient’s home.

    It is startling by design. It is also nothing more than an address run through publicly available street-level map imagery — the same pictures anyone can pull up of any address in the country, automatically, at scale. The photo proves the sender has your address. Your address is in the breached data. The chain ends there.

    Knowing that in advance takes most of the force out of it. That is the entire reason this section exists.

    What to actually do, in order

    Do not reply. Not to argue, not to deny, not to ask what they have. Any response tells an automated system that a live human read the message, and moves your address onto a much more valuable list.

    Do not pay, and do not negotiate. The FBI’s guidance on these schemes is explicit: do not communicate with the perpetrators, and do not pay the ransom, because the funds go on to finance further criminal activity. Payment also marks you as someone who pays, which is followed by another demand.

    Check the password. Go to haveibeenpwned.com — a free, long-established service that lets you enter an email address and see which known breaches it has appeared in. It will usually name the company and the year, which turns an unnerving mystery into a mundane fact you can look at.

    Change that password anywhere it is still in use. This is the one genuine action item in the whole episode. If the password in that email is still protecting your church email, your bank, your donor database, or anything else, change it today. Different password for every account — which in practice means a password manager, because nobody can hold forty of them in their head.

    Turn on multi-factor authentication on your email and anything financial. That’s the extra code or phone tap after the password. Microsoft’s own research finds it blocks more than 99.2% of account compromise attacks. It means a stolen password on its own is no longer enough to get into anything, which is exactly the situation you want to be in the next time a database somewhere is breached — and there will be a next time.

    Report it. File at ic3.gov. The FBI asks that you include the email with its header information and the cryptocurrency address, and use the keyword “Extortion E-mail Scheme.” Your report takes five minutes and joins thousands of others that let investigators trace where the payments go.

    Then delete it and block the sender.

    The part that matters most: tell someone

    Here is the thing the scam is actually built on. Not malware. Not surveillance. The fear of being seen.

    The message is engineered around a specific instruction — don’t tell anyone — because isolation is the mechanism. A person who forwards the email to a colleague within ten minutes almost never pays. A person who sits with it alone at midnight sometimes does.

    For church and nonprofit leaders this pressure lands harder than it does on most people, and it’s worth saying why. Your role is bound up with your reputation in a way that an accountant’s isn’t. You have a congregation, a board, a family, and a sense that the position requires you to be beyond question. That’s precisely the leverage the sender is counting on — and they’re counting on it without knowing a single thing about you.

    So say it plainly, in a staff meeting or an elders’ meeting, before anyone receives one:

    If you get one of these, forward it to me or to [name] the same day. Nobody who receives one of these has done anything wrong. Everyone gets them.

    Say the last part out loud, because it is true and because the person who eventually needs it will not be in a state to work it out for themselves. Receiving a threatening email is not a moral event. It means an address of yours is on a list, along with tens of millions of others.

    If you lead an organization, receiving one yourself is a gift of a teaching moment. Mentioning it — briefly, matter-of-factly, without drama — at the next staff meeting does more to protect your people than any policy document. It tells them this happens to leaders too, and that the response here is a shrug and a report, not shame.

    If a threat is ever genuinely credible

    Almost all of these are bluffs. Not all threats are.

    If someone contacts you with something specific and real — an actual image, an actual private message, knowledge that could only come from an actual relationship — that is a different situation, and it is not one to handle alone or by paying.

    It is a matter for law enforcement, and for one trusted colleague or board member you tell immediately. Contact your local FBI field office or file at ic3.gov, and preserve everything: the messages, the account names, the timestamps. Do not delete, and do not pay. Paying an extortionist who genuinely holds something has never once ended the demands.

    And if the person being threatened is a minor, or if a minor is involved in any way, that goes to law enforcement immediately — not to an internal conversation first.

    The instinct in all of these cases is silence, and silence is the one thing that reliably makes it worse. Whatever the circumstances, a leader facing this should have at least one other person in the room.

    What to do this week

    Take the ten minutes: put your work email address into haveibeenpwned.com, see which breaches it turns up, and change any password from that list still in use. While you’re there, turn on multi-factor authentication for your email account if it isn’t already on.

    Then, at your next staff or board meeting, spend sixty seconds saying the sentence out loud — if you ever get a threatening email demanding payment, forward it to me the same day; everybody gets these and nobody is in trouble. That sentence is the whole defense, and it has to be said before it is needed.

    MissionDefend’s free assessment walks through the basics in plain English — how your organization handles email, donations, member data, and accounts — and hands back a baseline score with a ranked list of what to fix first. Password reuse and missing multi-factor authentication are usually near the top of that list, and they are usually the cheapest things on it to fix.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, Extortion E-mail Schemes Tied to Recent High-Profile Data Breaches; FBI Internet Crime Complaint Center, Online Extortion Scams Increasing During The Covid-19 Crisis; New York State Police, New York State Police warns of nationwide automated sextortion scams; Microsoft, mandatory multifactor authentication guidance.

  • AI Voice Cloning: When the Caller Sounds Exactly Like Your Director

    AI Voice Cloning: When the Caller Sounds Exactly Like Your Director

    The bookkeeper answers on the second ring, and it’s the executive director’s voice. Not a voice like hers — her voice. The slight rasp. The way she says “listen” at the start of a sentence when she’s stressed.

    Listen — I’m about to get on a flight and the auction deposit didn’t go through. I need you to send it again before we lose the venue. I’ll text you the details. Don’t call back, I’m boarding.

    It’s her voice. It is not her.

    This is voice cloning — using artificial intelligence to generate speech that sounds like a specific, real person. The software behind it is cheap, legal, widely available, and needs surprisingly little to work with: a short sample of someone talking is enough to produce a convincing copy saying anything an attacker types. The FBI warned about exactly this in a December 2024 public service announcement: criminals are generating “short audio clips containing a loved one’s voice” to fake a crisis and demand immediate money. The Federal Trade Commission issued the same warning back in March 2023 — all a scammer needs is “a short audio clip of your family member’s voice,” which, the FTC notes, “he could get from content posted online.”

    Read that last part again, and then think about where your pastor’s voice lives.

    Churches are uniquely exposed, and it’s worth saying plainly

    For most small organizations, the boss’s voice isn’t on the internet. For a church, the entire leadership team is on the internet, every single week, in high-quality audio, saying thousands of words in every register — calm, urgent, warm, commanding. The livestream. The sermon podcast. The YouTube archive going back years.

    None of that is a mistake, and the answer is absolutely not to stop. Public preaching is the work. But it changes the math your staff should carry in their heads: for your organization, “it sounded exactly like him” is not evidence of anything. Not anymore. A scammer targeting your church has a better voice sample of your senior pastor than most attackers have of a Fortune 500 CEO.

    How the scam is actually run

    Voice cloning didn’t invent a new con. It upgraded three old ones we’ve already covered in this series.

    The urgent-request call. The gift card scam — “I need you to handle something quietly” — has historically arrived by email or text, where the impersonation is only a display name. A cloned voice moves it to the phone, where the impersonation is your ears telling you it’s really him. The structure is identical: urgency, secrecy, an odd payment method.

    The family emergency. A grandparent gets a call from a grandchild — the grandchild’s actual voice — in trouble, needing bail or a hospital deposit, begging them not to tell mom and dad. This is the version the FTC’s alert describes, and it targets exactly the older adults a church is best positioned to warn.

    The verification call. The FBI’s PSA notes criminals also use AI-generated audio of a victim’s own voice to get past phone-based identity checks at banks. That one you can’t train away — but it’s a reason to prefer app-based verification over “we’ll call you” security wherever your financial institutions offer a choice.

    One more thing makes the phone version stronger than it should be: the number on the screen can lie. Caller ID spoofing — displaying a number the caller doesn’t own — remains routine, as the FCC documents, and the STIR/SHAKEN verification system that carriers use confirms which network a call came from, not whether the person speaking is honest. A familiar voice from a familiar number can still be neither.

    Why “listen carefully” is not a defense

    You’ll find advice suggesting you listen for robotic cadence or odd pauses. The FBI’s own PSA suggests paying attention to tone and word choice — and that’s worth doing — but treat it as a tripwire, not a wall. The technology improves monthly, the clips are short by design, and a stressed listener on a bad connection hears what they expect to hear. Any defense that requires your bookkeeper to out-listen a machine on the worst morning of her month is not a defense.

    The defense that works is procedural, and it’s the same one that stops every impersonation scam regardless of how good the impersonation is: the request and the verification must travel on different channels.

    What to do this week

    Set the callback rule for money and credentials. Any request to move money, buy gift cards, change banking details, or share a password — no matter who it comes from, no matter how it arrives, no matter how real the voice sounds — is confirmed by hanging up and calling the person back on the number already in your contacts. Not the number that just called. Not a number from the message. The clone can call you; it cannot answer the real person’s phone.

    Agree on a family-style code word for leadership. Pick a phrase the executive team knows and would never appear in a sermon. If a “boarding a plane right now” call ever demands money and can’t take a callback, ask for the word. It’s thirty seconds of setup for a control no voice model can generate. Encourage staff to set the same thing up with their own aging parents — this scam reaches homes before it reaches offices.

    Kill the secrecy lever in policy. Write it down: no financial request at this organization is ever confidential from the treasurer or bookkeeper’s normal verification steps. “Don’t tell anyone” or “don’t call back” is not a request a real leader here will ever make — which converts the scammer’s favorite pressure line into an alarm.

    Tell the congregation about the grandparent version. One announcement, one bulletin line: if a family member calls in crisis asking for money, hang up and call them back on their own number — a voice can be faked. The FTC’s guidance is exactly that — don’t trust the voice, verify through a known channel — and older members are far more likely to hear it from you than from a federal agency’s blog.

    The voice on the phone used to be proof. It’s now just another sender name, as forgeable as the “From” line on an email. The organizations that handle this well won’t be the ones with the sharpest ears — they’ll be the ones where calling back is so routine that nobody even feels awkward doing it.

    The free MissionDefend assessment checks whether verification rules like these actually exist at your church — not just in someone’s head — along with the rest of your security baseline. Join the launch list to get first access.

    Sources: FBI Internet Crime Complaint Center, Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud, Alert I-120324-PSA (December 3, 2024); Federal Trade Commission, Scammers use AI to enhance their family emergency schemes (March 20, 2023); Federal Communications Commission, Caller ID Spoofing.

  • The Job Opening You Never Posted

    The Job Opening You Never Posted

    The first voicemail comes in on a Monday. A woman named Denise, polite and a little apprehensive, asking when her start date is and whether she should bring anything on the first day. She mentions she already deposited the check.

    Nobody at the church knows who she is.

    By Thursday there have been four more calls, one email with a scanned driver’s license attached, and a message from a man who is no longer polite at all, because his bank has just reversed a $3,200 deposit and told him he owes them the money. He has an offer letter with the church’s logo on it. He has text messages from someone who signed off as the church’s “HR coordinator.” He does not have a job, and the church does not have an HR coordinator.

    No one at the church did anything wrong. No system was broken into. Someone simply took the name of a trusted local institution, put it on a job posting, and let the name do the work.

    The posting you never wrote

    The scam is straightforward. A fraudster creates a job listing on a recruitment site, a community Facebook group, or a job board — “remote personal assistant,” “part-time bookkeeper,” “youth ministry coordinator.” The employer name is a real church. Sometimes the logo is lifted from the church website. Sometimes the posting copies the mission statement word for word, because that language is right there to copy.

    The FBI has warned about exactly this pattern, describing how criminals “spoof legitimate companies to post fraudulent job postings on commonly used employment-oriented networking sites,” directing applicants to spoofed websites, email addresses, and phone numbers that the scammers control.

    What follows is fast, and the speed is deliberate. The applicant is contacted within hours. The interview happens entirely over text message, WhatsApp, Signal, or a chat window — never a video call, never in person, occasionally a brief phone call from a number that never answers again. The applicant is hired, usually within two days.

    Then comes the part that actually makes money.

    The check is the whole point

    The new hire is told the organization will provide equipment — a laptop, a monitor, software for the ministry’s donor database. A check arrives, or an image of one, for more than the equipment costs. Deposit it, buy the equipment from “our approved vendor,” and send the balance on to the vendor by wire, payment app, or gift card.

    The check is counterfeit. The money the applicant sends is real.

    The Federal Trade Commission puts it about as plainly as it can be put: “The check is fake and will bounce, and the bank will want you to repay the full amount of the fake check, while the scammer keeps the real money you sent them.”

    The trap is a piece of banking mechanics almost nobody outside of banking knows. Your bank may make a deposited check’s funds available to you well before it knows whether the check is any good. Seeing the balance in your account is not the same as the check having cleared. When it is finally identified as counterfeit, the deposit is reversed — and the person who deposited it is the one holding the loss.

    That’s why the FTC’s rule for job seekers is absolute: “if you get an offer that includes depositing a check and then using some of the money for any reason, that’s a scam.”

    The quieter version: the onboarding packet

    Not every variant involves a check. In some, the “hire” goes smoothly and the only ask is paperwork — a direct deposit authorization, a tax form, a copy of a driver’s license, a Social Security number “for the background check.”

    That packet is the product. It is enough to open accounts, file a fraudulent tax return, or take out credit in the applicant’s name. The FTC’s guidance on remote job scams describes scammers asking targets to “fill out direct deposit and tax forms with your bank account and other personal information.”

    This version is harder to spot because nothing about it feels like a scam. Onboarding paperwork is exactly what a new job involves. The only thing wrong is that the employer doesn’t exist.

    Why churches and nonprofits get picked

    The name buys instant trust. A job seeker who sees “First Baptist” or “Habitat affiliate” or a hospice’s name on a listing relaxes in a way they would not for an unknown LLC. That trust was built over decades by people doing good work, and it is being spent by someone else.

    The brand is sympathetic. Ministry work attracts applicants who are motivated by more than a paycheck, and who are therefore more inclined to give the organization the benefit of the doubt when something is slightly odd.

    There is no HR department to call and check. This is the structural reason, and it is not a failing — it is what a small organization looks like. At a company with 4,000 employees, a suspicious applicant calls recruiting. At a church with a pastor, an administrator, and a part-time music director, there is no recruiting line to call, and the main number goes to voicemail on Wednesday afternoons.

    Your staff page tells the scammer everything. Names, titles, email format, the pastor’s photo. All of it is public on purpose, because a church website that hides its people would be a strange church website. None of that should change.

    And here is what it costs you, even though no money left your accounts.

    You inherit a stream of confused and increasingly angry people, some of whom are out thousands of dollars they did not have. They are not wrong to be upset, and the first person they reach is whoever answers your phone. That is a hard morning for an office administrator who had no warning.

    Then there is the reputational damage, which is slower and more corrosive. The FBI has noted that job seekers “who are unaware they have been scammed may write negative reviews of the victim company; thus, adversely impacting the company’s ratings.” Some people will never learn the church wasn’t involved. They will simply remember the name attached to the worst financial week of their year.

    What actually closes it

    Publish every real opening in one place, on your own website. One page — /jobs or /employment — that is the single source of truth. If there are no openings, the page should say so in a sentence. This is the whole defense in one move, and it works because it gives every applicant, and every reporter, and every skeptical spouse a place to check. The FBI’s advice to job seekers is precisely this: verify job postings found on networking and third-party sites on the hiring company’s own website.

    Put a short standing notice on that page. Say the things you’d otherwise have to say fifty times on the phone:

    All open positions are listed on this page. We do not conduct interviews only by text or chat. We never send money, checks, or equipment funds to an applicant, and we never ask an applicant to purchase anything on our behalf. If you have been contacted by someone claiming to hire on our behalf and this page does not list the role, it is not us — please contact us at [number].

    The rule to state and never bend: every real opening is listed on our own website, and no legitimate hire of ours ever begins with a check.

    Search for yourself once a quarter. Ten minutes. Put your organization’s name into a job board search, into Facebook, into a plain web search alongside the word “hiring.” The FBI specifically recommends that businesses proactively search for fraudulent postings under their own name. If you find one, report it to the platform — every major job site and social network has a report link on the listing itself — and ask for it to be removed.

    Respond publicly when it happens. A short post on your website and social accounts, and a line in the newsletter. Not defensive, not lengthy. We’ve learned that someone is posting fake job openings using our name. We are not hiring for these roles. Our real openings are always here. If you were contacted, here’s what to do. Silence lets the story be told by people who are furious and misinformed.

    Report it. Send the details to the FBI at ic3.gov, and to the FTC at reportfraud.ftc.gov. Include screenshots of the posting, the account that posted it, and any messages applicants forwarded to you. Encourage the applicants to file their own reports — theirs carry the financial loss, which is what drives a case.

    If you’re the applicant reading this

    Some of you found this page because you searched the church’s name at eleven at night with a bad feeling. Here is the short version.

    You are not gullible. This scam is engineered to feel normal, and it borrows the credibility of an institution that spent years earning it.

    Call the organization at a number you found yourself, on their own website — not one from the offer letter or the messages. Ask whether the role exists. That one call resolves most of these.

    If you already deposited a check and sent money on, call your bank immediately and say the words fake check scam. Speed genuinely matters. Then report it at ic3.gov.

    If you handed over a Social Security number, bank details, or a copy of your ID, go to identitytheft.gov. It is the FTC’s official site, it is free, and it will generate a specific recovery plan for you — freezing credit, disputing accounts, the whole sequence — rather than leaving you to figure it out. The FTC directs job scam victims there for exactly this reason.

    And tell someone in your life today rather than next week. The single thing that turns this from a bad experience into a long one is the silence people keep out of embarrassment.

    What to do this week

    Create or update one page on your website listing every current opening — including a plain sentence when there are none — and add the standing notice above. Then spend ten minutes searching your organization’s name on a job board and on Facebook to see whether anything is already out there.

    That’s about thirty minutes, and it turns a scam you can’t prevent into one you can answer in a single sentence.

    If you want to know what else about your organization is easy for a stranger to borrow, MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts, then returns a baseline score and a ranked list of what to fix first — including the public-facing gaps like this one that most security checklists skip entirely.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, Scammers Exploit Security Weaknesses on Job Recruitment Websites to Impersonate Legitimate Businesses; Federal Trade Commission, Job Scams; Federal Trade Commission, Searching for a job to work remotely? Avoid scams and identity theft.

  • Smishing: Text-Message Scams Aimed at Church Staff

    Smishing: Text-Message Scams Aimed at Church Staff

    The text arrives on a Saturday, while the office is closed and the administrator is in the grocery store checkout line.

    USPS: Your package could not be delivered due to an incomplete address. Update your information within 24 hours: [link]

    She is expecting a package — the new children’s ministry curriculum, ordered Tuesday. The link looks vaguely official. She’s holding a phone in one hand and a gallon of milk in the other. This is precisely the moment the message was designed for.

    This is smishing — phishing carried out by text message. The name is a mash-up of SMS (the technical name for a text message) and phishing (tricking someone into clicking a link or giving up information by pretending to be someone they trust). Same con as the fake email, different doorway. And the doorway matters, because the phone in your pocket gets a level of trust and speed of response that email never did.

    Why texts work when emails fail

    Your email has a spam filter that has been learning for twenty years. Your text messages, for the most part, do not. A scam that would never survive the trip to your inbox lands on your lock screen untouched.

    The behavior around texts is different too. People answer texts fast — usually within minutes, often mid-task, standing up, one-handed. Nobody prints a text out and walks it down the hall to ask the treasurer if it looks right. And on a phone, the single best defense you have on a computer — hovering over a link to see where it really goes — mostly isn’t available. The screen is small, the address is shortened, and the browser hides the details.

    The scale of the problem is not small. The Federal Trade Commission reported that Americans lost $470 million to text-message scams in 2024 — five times the losses reported in 2020, even though the number of reports went down. Fewer people are falling for it; the ones who do are losing more.

    The five texts your staff will actually receive

    The FTC’s data names the five most common text scams by reported losses. Every one of them maps cleanly onto a week in a church office.

    The fake package notice. The most common of all. “Your delivery could not be completed.” A church office receives packages constantly — curriculum, supplies, communion cups, things five different volunteers ordered — so someone is always expecting a delivery. That’s what makes it work. The link leads to a page that harvests your address, your card number, or your login.

    The bogus job offer. Recruiting texts for part-time, work-from-home positions — sometimes called task scams, because they pay small amounts for trivial online tasks before demanding a deposit to “unlock” larger earnings. These circulate through congregations, and they sometimes borrow a real ministry’s name to look credible.

    The fake fraud alert. “Did you attempt a purchase of $487.23 at Best Buy? Reply NO to dispute.” There was no purchase. The reply — or the phone call that follows — is the scam. It ends with the “bank” walking the victim through moving money to a “safe account” that belongs to the attacker.

    The unpaid toll. A small, plausible amount — a few dollars — with a payment link and a late-fee threat. Small enough to pay without thinking, which is the entire design.

    The wrong number. “Hi, is this Jennifer? We’re still on for Tuesday?” It looks like a misdial. Replying politely starts a friendly conversation that, over weeks, becomes a relationship — and eventually an investment opportunity. This one costs its victims the most, and it targets exactly the demographic most churches serve.

    The church-office wrinkle

    For a business, smishing is a consumer problem that occasionally reaches payroll. For a church, it’s stickier, for one structural reason: the phone that receives the scam is almost never a device the organization controls. It’s the administrator’s personal phone, the volunteer treasurer’s personal phone, the youth director’s personal phone — carrying church email, the giving platform app, and the group chat with every leader in it.

    That means you cannot solve this with software. There is no filter you can buy for a phone you don’t own. What you can change is the procedure — what a person does in the ten seconds after the message lands.

    What to do this week

    Adopt the two-line text policy. Say it at the next staff meeting, put it in the volunteer handbook, and have leadership repeat it until it’s folklore: We never handle money, passwords, or account changes by text. If a text asks for any of those, it’s fake until proven otherwise by a phone call to a number we already have. That single rule defeats every scam on the FTC’s list, because every one of them needs the text itself to carry the action.

    Teach the app-not-the-link habit. If a text claims to be your bank, the postal service, or a toll authority, the response is never the link in the message — it’s opening the official app, or typing the address you already know. If the alert is real, it will be waiting there.

    Report, then delete. Forward scam texts to 7726 — that spells SPAM on a keypad — which helps carriers block similar messages for everyone. Then report it at ReportFraud.ftc.gov, and delete it. Don’t reply, not even “STOP,” to a message you believe is a scam; a reply confirms the number is live.

    Warn the congregation once a season. A single line in the bulletin or newsletter — the church will never text you asking for gift cards, payments, or personal information — protects the people your staff can’t. The wrong-number romance scam in particular preys on older adults, and a warning from a trusted pulpit lands where a news story doesn’t.

    Smishing is the same social engineering we covered on day one of this series — persuasion instead of hacking — squeezed into 160 characters. The persuasion doesn’t survive a pause and a phone call. Build the pause into the routine.

    Want to know where your organization actually stands? MissionDefend’s free assessment asks plain-English questions about how your church handles email, texts, donations and member data, then gives you a prioritized plan. Join the launch list and be first in line.

    Sources: Federal Trade Commission, New FTC Data Show Top Text Message Scams of 2024; Overall Losses to Text Scams Hit $470 Million (April 16, 2025); Federal Trade Commission, How To Recognize and Report Spam Text Messages; Cybersecurity and Infrastructure Security Agency, Recognize and Report Phishing.