Nobody went into ministry to manage firewalls. You took the job to serve people, and somewhere along the way you also became the person who resets passwords, keeps the member database, and gets the email that says the online giving page is down.
So when someone tells you that your church needs a cybersecurity program, the honest reaction is exhaustion. You do not have an IT department. You may not have an IT person. You have a volunteer who is good with computers and a budget that has other plans.
Here is the encouraging part: the handful of things that actually protect a church are not expensive, and most of them are not technical. Attackers who target congregations are not breaking encryption. They are sending an email that looks like it came from your pastor. The defenses that stop them are ordinary, learnable, and largely free.
This guide walks through what those defenses are, in the order that matters most.
Why churches and nonprofits get targeted
There is a persistent belief in small organizations that attackers only care about banks and hospitals. The opposite is closer to the truth. Attackers are running a numbers game, and they optimize for effort, not prestige. A church that holds bank account details, donor records, and a trusted mailing list — with no security staff and no mandatory training — is a far cheaper target than a bank.
The FBI’s Internet Crime Complaint Center logged over a million complaints in 2025 and just under $20.9 billion in reported losses. Business email compromise alone — the category that covers fake invoices and impersonated leaders — accounted for 24,768 complaints and more than $3 billion. Phishing and spoofing generated 191,561 complaints, making it the single most-reported crime type. Almost none of that required technical sophistication. It required someone to believe an email.
Three things make faith-based and nonprofit organizations particularly attractive.
You hold data that is worth money and impossible to replace. Donor giving histories, member contact lists, background check results, counseling notes, children’s ministry records. Some of it is financially valuable. Some of it is simply devastating if it leaks.
Your culture runs on trust and responsiveness. The instinct that makes a church good — assume the best, help quickly, do not interrogate the person asking — is precisely the instinct a social engineer exploits. An email that says “I’m in a meeting, can you handle this discreetly” works far better on a ministry team than on a procurement department.
Money moves in ways that are hard to verify. Offerings, designated gifts, reimbursements, benevolence funds, vendor payments for a building project. Volume is low enough that a single fraudulent transfer does not look out of place, and controls are usually informal.
None of this is a character flaw in your organization. It is a structural reality, and it is fixable.
The order of operations
If you do nothing else in this guide, do these things in this order. They are ranked by how much risk they remove per hour of effort, which is a very different ranking than what a security vendor will give you.
1. Turn on multi-factor authentication everywhere
Multi-factor authentication — the code from an app or a tap on your phone after you enter your password — is the single highest-value change available to you. Microsoft’s own research finds that MFA blocks more than 99.2% of account compromise attacks, which is why the company began enforcing it by default across its admin portals in 2024.
Turn it on for email first, because email is the master key that resets every other password. Then online banking and your payment processor. Then the church management system and the donation platform. Then the domain registrar and website host, which are the accounts nobody thinks about until someone redirects the giving page.
Expect friction. Staff and volunteers will find it annoying for about two weeks and then stop noticing. Roll it out to leadership first so the complaints land on people who understand why.
2. Find out who has access to what
Almost every organization we talk to has at least one surprise here: a former employee whose account is still active, a volunteer with full administrative rights they were given three years ago for one project, a shared login that half the office knows.
Open your email admin console and list every account. Open your donor database and list every user. For each one, ask whether that person still serves in that role and still needs that level of access. Turn off what is no longer needed. This costs an afternoon and nothing else, and it routinely removes more risk than any product you could buy.
While you are there, write down the answer to a question you should be able to answer instantly: who can see the donor database? If that list is longer than you expected, you have found your next project.
3. Make impersonation hard to act on
Since fake requests are the primary attack, build one rule that neutralizes them: any request to move money, change bank details, or buy gift cards is verified by voice before it is acted on. Not by replying to the email — by calling a number you already had.
Write the rule down. Tell everyone who touches money, including volunteers. Tell them explicitly that they will never be criticized for verifying, even if the request really did come from the pastor. The failure mode you are protecting against is a bookkeeper who feels too junior to question leadership.
This rule costs nothing and stops the most expensive category of attack outright.
4. Get your backups right, then test one
Ransomware is not the most common thing that will happen to you, but it is the one that stops a church cold. The recovery plan is backups, and backups only count if you have restored from them.
Your member database, financial records, and shared documents should back up automatically, keep several weeks of history, and store at least one copy somewhere an attacker with your password cannot reach. Cloud platforms like Microsoft 365 and Google Workspace are more resilient than a server in the closet, but they are not a backup by themselves — a deleted or encrypted file syncs its deletion everywhere.
Then do the part everyone skips: pick one file from a month ago and restore it. If you cannot, you do not have backups. You have hope.
5. Train people on the specific scams aimed at them
Generic security awareness training bores people and does not stick. What works is showing your team the actual scams that hit churches: the gift card request from the pastor’s name but the wrong address, the fake invoice from a vendor you really do use, the “your mailbox is full, click here” notice, the urgent wire change from a contractor mid-building-project.
Fifteen minutes at a staff meeting, twice a year, focused on real examples beats an annual hour-long video. And make the point that matters most: the goal is not to never be fooled. The goal is to tell someone immediately when you think you might have been.
6. Write down the few policies that matter
You do not need a policy library. You need a small number of decisions recorded so they survive staff turnover: what devices may access church data, how passwords are handled, who may approve payments and at what threshold, what happens when someone leaves, and what you do if you suspect a breach.
Five pages is plenty. The value is not the document. The value is that the decision has been made once, in calm conditions, rather than improvised during an incident.
What tends to get skipped — and shouldn’t
A few gaps show up again and again, and each is easy to close once you notice it.
The domain registrar. Whoever controls your domain name controls your email and your website. This account is often registered to a volunteer’s personal address, secured with a password from 2017, and forgotten. Find it, secure it with MFA, and make sure at least two current leaders can access it.
Shared logins. One password for the office computer, one for the giving platform, known to everyone who has ever worked there. Shared credentials mean you can never revoke access for one person and can never tell who did what. A password manager with proper sharing solves this for a small monthly cost, and several offer nonprofit pricing.
Your church management software vendor. Your donor and member data lives on their servers. You are entitled to ask how it is protected, whether they support MFA, what happens if they are breached, and how you would get your data back. If the answer is evasive, that is information.
Personal devices. Half your ministry runs from personal phones. That is not going to change, and forbidding it will only push it underground. Instead, require a screen lock and require that church email is accessed through the official app rather than forwarded to a personal Gmail account.
Departures. The most common serious gap in small organizations is that nobody turns off accounts when someone leaves. Make it a line item on whatever checklist already exists for a departure.
What a realistic first year looks like
You are not going to do all of this at once, and you should not try.
A reasonable first ninety days is MFA on email and financial accounts, an access review, the verify-by-voice rule written down and communicated, and one tested restore from backup. That is achievable by one person with a few afternoons, and it removes a large majority of the practical risk.
The rest of the first year is the slower work: policies written, training delivered, vendors reviewed, an incident plan drafted, offboarding fixed. Then you are in the maintenance rhythm — a quarterly access review, twice-yearly training, an annual reassessment — which is what “having a security program” actually means for an organization your size.
The goal is not perfection. The goal is that you know where you stand, you have fixed the things that matter most, and you can tell your board what has been done.
Being honest about limits
An assessment and a plan will not make you unbreachable. Nothing does. Organizations with enormous security teams still have incidents.
What this work buys you is threefold. It removes the easy attacks, which are the overwhelming majority of what will actually be aimed at you. It means that when something does happen, you find out quickly and recover from a backup instead of a catastrophe. And it means you can demonstrate to a board, an insurer, or a grantmaker that you took reasonable care — which is a meaningfully different position to be in, legally and practically, than having done nothing.
If your organization ever needs a formal audit or a penetration test — for a grant, an insurer, or a regulator — this groundwork is what makes that a manageable exercise instead of a painful one.
Where to start this week
Pick the smallest real thing. Turn on multi-factor authentication for your own email account today. Then list who has access to the donor database. Those two actions, done this week, put you ahead of most organizations your size.
When you are ready to see the whole picture rather than one piece at a time, MissionDefend’s free assessment will walk you through plain-English questions about how your organization uses email, handles donations, stores member data, and manages accounts — then give you a baseline score and a ranked list of what to fix first. It takes about thirty minutes and requires no technical knowledge.
We’re finishing it now. Leave your email and we’ll tell you the moment it opens.
No spam and no sales calls — just one email when it’s live, plus a short list of steps you can take in the meantime.
Related reading
- the twelve things that matter for a small church
- what $0, $50 and $500 a month actually buy
- locking down your email platform in a single afternoon
MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or a compliance certification.
Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Microsoft, mandatory multifactor authentication guidance.