The nursery coordinator gets an email on a Sunday evening.
Your mailbox has exceeded its storage limit. 3 messages are being held for delivery. Sign in within 24 hours to release them, or they will be deleted.
Something about it feels off. The wording is slightly stiff. She’s never had a quota problem before. She looks at it for a few seconds, decides it’s probably nothing, and deletes it.
That’s the end of it, as far as anyone in the church ever knows.
What she doesn’t know is that the same message went to eleven other people that evening, and that one of them — the volunteer bookkeeper, checking email between services — clicked it and typed in her password.
Nobody in this story behaved badly. The coordinator’s instinct was excellent. She just had nowhere to put it. There was no address to send it to, no button to press, and a small, entirely reasonable fear of being the person who bothered the pastor about an email that turned out to be fine.
The gap between someone noticed and anyone acted is where most of these attacks live. Closing that gap is one of the highest-value things a small organization can do, and it costs nothing.
Your people are already the detection system
Small churches and nonprofits do not have a security team watching the mail flow. What they have is eight or twelve people who know how things normally sound around here.
That knowledge is genuinely good. The office administrator knows the pastor doesn’t send one-line emails asking for a favor while he’s “in a meeting.” The treasurer knows the roofing contractor has never changed bank details mid-project.
Filters catch a great deal, and you should certainly have them turned on. But phishing is designed to survive filters — a well-crafted message from a newly registered domain, with no attachment and no malicious link on any list yet, sails through into the inbox looking ordinary. The last line of detection is a human being noticing that something feels wrong.
Right now, in most small organizations, that noticing produces nothing at all. Not because people don’t care — because there’s nowhere for it to go.
The mechanics: build somewhere to send it
This is the easy half, and it takes about twenty minutes.
Option one: an address everyone knows. Create a shared mailbox or a group address — security@, checkthis@, isthisreal@, whatever your people will actually remember. Point it at two or three people: whoever handles IT things, the office administrator, and one other person so it’s never one person’s holiday that stalls it. Both Microsoft 365 and Google Workspace let you create a shared mailbox or group at no extra cost.
The name matters more than it should. Security sounds formal, and formality makes people hesitate. Checkthis@ sounds like asking a colleague, which is exactly the behavior you want.
Option two: the button that’s already there. Microsoft 365 and Google Workspace both include a report function in the mail app itself.
In Microsoft 365, there’s a built-in Report button in Outlook that lets people flag a message as phishing or junk. An administrator can configure where those reports go — to Microsoft for analysis, to a mailbox you nominate inside the organization, or to both. Choosing “both” is the right answer for most churches: Microsoft’s systems learn from it, and a person in your building sees it too.
In Gmail, opening a message and choosing the report-phishing option under the message’s more menu sends a copy to Google and moves the message out of the inbox.
Use both. The button is one click and gets used; the address is where the awkward cases go — a text message someone got, a phone call, a letter, a QR code on a poster in the lobby. The button only handles email. Real life doesn’t.
Say the same thing on every path. Put the address in the email signature block for staff, on the sheet taped by the office phone, and on the volunteer welcome page. The failure mode isn’t people refusing to report. It’s people not remembering how.
Forward it the right way. One small technical detail makes a real difference to whoever reviews the report. When you forward an email normally, the mail app makes a new message and pastes the old text inside it. What gets lost is the hidden header information — the record of which servers actually handled the message and where it really came from. That’s often the fastest way to tell a genuine message from a convincing forgery, and an ordinary forward destroys it.
Forwarding as an attachment preserves the original message intact, headers and all. Both Gmail and Outlook can do it; in Gmail it’s an option in the message’s menu, and in Outlook you can drag a message into a new one or choose the attachment-forwarding option. The built-in report buttons do this automatically, which is another argument for using them.
Two rules to say out loud alongside it: don’t click anything in the message before you report it, and don’t delete it after — leave it in a folder for a week in case someone needs to look.
The half that actually decides whether this works
Here’s the uncomfortable part. The technical setup is twenty minutes. Whether anyone uses it depends entirely on how the first few reports are received.
People do not report because they are afraid of looking foolish. That’s the whole thing. Not laziness, not indifference — a completely ordinary human reluctance to raise a hand and be wrong in front of colleagues. If a report is met with a delay, a sigh, or a technical explanation of why it was obviously fine, that person will not report again, and neither will anyone they mention it to.
Three commitments, and they need to be said publicly, not just believed privately.
Thank people for every report, including the false alarms — especially the false alarms. The reply to a report about a perfectly legitimate email should be warm and short: “Checked it — this one’s genuine, it’s from the insurance broker. Thanks for flagging it, that was exactly the right call.” Never “that was fine.” The thing you’re reinforcing is not accuracy; it’s the act of asking.
Nobody is ever in trouble for reporting — including reporting their own mistake. This one has to be stated in words, at a staff meeting, by whoever is in charge. “If you click something and then think ‘oh no,’ tell me immediately. You will not be in trouble. The only thing that turns a bad click into a bad month is waiting.” Without that sentence spoken aloud, a scared volunteer will spend four hours hoping it was nothing, and four hours is the difference between a password reset and a wire transfer.
Answer fast. Not necessarily with an answer — with an acknowledgment. “Got it, looking now” within the hour. A report that vanishes into a mailbox teaches everyone that reporting is pointless, and that lesson sticks harder than any training.
What to do when one arrives
You need a short routine, not a procedure manual. Five steps:
1. Acknowledge it. One line, straight away.
2. Look at the sender’s actual address, not the display name. The display name is the friendly label your mail app shows — it’s free text and anyone can set it to anything, including your pastor’s name. The real address is what matters, and on a phone it’s usually hidden until you tap it.
3. Ask whether it wants a credential or wants money. Almost every phishing message wants one of two things: for you to sign in somewhere (a fake login page harvesting your password), or for you to move money, buy gift cards, or change payment details. Naming which one tells you what to do next.
4. If it’s real, contain it. Ask your mail administrator to search for the same message across all mailboxes and remove it. Whether they can depends on your subscription: in Microsoft 365 it’s done through eDiscovery or Defender for Office 365, and in Google Workspace only the higher editions include the security investigation tool that deletes mail from other people’s inboxes. If your plan can’t, the fallback is telling everyone to delete it — which is step five anyway. If anyone entered a password, that account’s password changes immediately from a different device, active sessions are signed out, multi-factor authentication is checked, and mail rules are reviewed — attackers routinely add a rule to hide their tracks.
5. Tell everyone. This is the step people skip, and it’s the most valuable one. If a message reached one mailbox, it almost certainly reached several. A two-line note to all staff — “A fake DocuSign email is going around this morning; it’s not from us; delete it” — protects the people who hadn’t opened their email yet.
That last step is also what makes the next report more likely. People who see that their report produced a visible, useful outcome will report again.
Speed is the whole game with money
If a report involves money that has already moved, the clock is the only thing that matters.
The FBI’s Recovery Asset Team exists to freeze fraudulent transfers, and in 2025 it ran 3,574 domestic incidents and froze $507,042,623. That process works dramatically better inside the first 24 to 72 hours. After that, the money has usually been moved onward and the odds fall off a cliff.
Which means the value of a reporting culture is not really about email hygiene. It’s that when the bookkeeper realizes at 4:40 on a Friday that the payment she sent this morning went to the wrong account, she picks up the phone immediately instead of sitting with it over the weekend. Everything you do to make reporting comfortable is, in the end, buying hours on that clock.
For context on scale: business email compromise generated 24,768 complaints in 2025 with reported losses of $3,046,598,558 — an average of about $123,005 per report. Phishing and spoofing, with 191,561 complaints, was the most-reported crime type of the year.
Attempted or successful fraud goes to the FBI at ic3.gov, and identity theft to identitytheft.gov.
Measure it gently, or not at all
If you want a number, use this one: reports per month.
Not accuracy. Not how many were real. Just how many times somebody raised a hand. A church that goes from zero reports a month to six has built a detection capability it did not have before, and the fact that five of the six were harmless is not a problem — it’s the cost of the sixth.
Report the number to the board once or twice a year as a positive indicator. “Staff flagged eleven suspicious messages this year; two were real, one of them was an attempted payment change.” That sentence tells a board more about the organization’s actual security posture than any policy document.
And resist the urge to run a punitive phishing test on your volunteers. If you do simulate one, tell people in advance that it’s coming sometime this quarter, and never publish who clicked. A church is a volunteer organization held together by goodwill; embarrassing a faithful person to make a training point costs more than it teaches.
What to do this week
Create the address. Fifteen minutes: a shared mailbox called checkthis@ (or whatever fits your church), pointed at two people, and — if you’re on Microsoft 365 or Google Workspace — confirm the built-in report button is available and that reports land somewhere a human will see them.
Then, at the next staff meeting, spend two minutes saying the sentence out loud: if anything looks wrong, send it to checkthis@ — you will never be in trouble for asking, and you will never be in trouble for telling me you clicked something.
CISA’s advice to organizations comes down to the same thing: make sure people know how, and to whom, to report a suspicious message.
MissionDefend’s free assessment covers exactly this kind of ground — how your organization handles email, donations, member data, and accounts — in plain English, and gives you a baseline score with a ranked list of what to fix first.
No spam and no sales calls — just one email when it’s live.
Related reading
- what your people are being asked to spot
- the message most likely to land in that mailbox
- the QR code inside a package nobody ordered
MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.
Sources: Microsoft, Configure user reported message settings in Microsoft Defender for Office 365; Google, Avoid and report phishing emails; Cybersecurity and Infrastructure Security Agency, Teach Employees to Avoid Phishing; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.