MissionDefend Blog

Home Articles Get your free assessmentComing soon

Tag: business email compromise

  • Six Weeks of Risk: Fraud in the Year-End Giving Season

    Six Weeks of Risk: Fraud in the Year-End Giving Season

    It’s the third week of December. The office administrator is doing four jobs: the Christmas Eve bulletin, the poinsettia list, the volunteer schedule for two extra services, and the giving that’s arriving faster than any other time of the year.

    An email comes in from the pastor’s address at 8:40 in the evening. It’s short, and it apologizes for the hour.

    Sorry to do this so late — the Mercer gift needs to go out tonight so it lands before the 31st for their tax year. Wire details attached. I’m heading into the Christmas Eve rehearsal, can you handle it? Thank you for everything you do this season.

    Everything in that message is calibrated. The deadline is real for donors, so it doesn’t sound invented. The pastor genuinely is unreachable tonight. The gratitude is the exact thing an exhausted administrator wants to hear in the third week of December. And the request — move money quickly, at the end of the year — is the single most normal thing happening in the building right now.

    None of the attacks in this series are new in December. They just work better. That’s what this article is about, and it’s meant to be read in October, while there’s still time to do something.

    Why these six weeks are different

    Three things stack up at once.

    The volume. Many churches and nonprofits take in a large share of the year’s gifts in the final weeks — year-end appeals, memorial gifts, stock transfers, and the last Sunday of the year. Unusual transactions stop being unusual. A five-figure gift, a wire, a new vendor, a rush payment: in July any of those would prompt a question. In December they’re Tuesday.

    The people. The staff are tired and stretched. Volunteers who don’t normally touch anything are counting offering, staffing a table, running a card reader at the Christmas market. The treasurer is traveling. The bookkeeper is trying to close the year.

    The cover. Everyone expects urgency in December, which means urgency stops being a warning sign. The single most reliable tell in social engineering — this must happen right now — is indistinguishable from ordinary end-of-year work.

    An attacker doesn’t need a new technique to exploit that. They need a calendar.

    The seasonal patterns worth knowing

    Fake year-end appeals sent in your name. Your donors receive an appeal that looks like yours — your logo, your language, sometimes your pastor’s photograph — with a “give now” link that goes somewhere else entirely. The attacker doesn’t need access to your systems for this. Your appeal language is on your website, your donor names are often on your own published thank-you lists, and email addresses are widely available. The first you hear of it is a confused member calling to ask why the giving page looked different.

    Hijacked or spoofed giving links. A variant aimed at your real appeal. If your email is sent through a compromised account or your website is edited by someone who shouldn’t have access, the destination of the button changes while everything else stays the same. Check the actual link in every appeal before it goes out, and check it again after it’s sent by clicking through the version that arrived in your own inbox.

    A spike in gift-card and wire requests. The bookkeeper is already approving an unusual volume of unusual payments, which is exactly the noise these requests hide in. The gift-card version — “can you grab some cards for the staff, I’ll reimburse you” — is seasonal in a way that makes it especially credible in December. It isn’t credible in June.

    Card testing on your giving form. This one is worth decoding, because most church leaders have never heard of it and it’s genuinely common.

    Card testing is when someone with a batch of stolen card numbers uses an online form to find out which ones still work. They run a stream of very small donations — a dollar, two dollars, sometimes just an authorization — and watch which ones go through. The cards that succeed get sold or used elsewhere for real purchases.

    Church giving forms are attractive for this because they take any amount, they’re open to the public, they often don’t require an account, and nobody notices small gifts arriving. The cost to you is real: a processing fee on every attempt, chargebacks when the real cardholders dispute the charges, and — if the volume is high enough — trouble with your payment processor. You may also have to explain to a stranger why your church charged their card.

    The signs: a run of small donations in quick succession, often overnight, often with mismatched names and email addresses, frequently from the same or sequential card numbers.

    Fake vendor invoices timed for the rush. Year-end is when legitimate invoices pile up — the audiovisual contractor, the snow removal service, the printer who did the Christmas mailing. An invoice arriving in that stack from a plausible-sounding company, or a real vendor’s invoice with altered bank details, is unusually likely to be paid without a second look.

    And then January: the receipt phishing. After the season ends, donors expect an email from you about their giving statement — a donor claiming a deduction of $250 or more has to obtain and keep a written acknowledgment from you, so this is a genuinely predictable message. Attackers know it too. Your members receive a message that appears to come from the church, with a link to “download your 2026 giving statement,” which leads to a fake login page or a document that installs something. The congregation is the target here, not you, but your name is on it.

    What this costs when it works

    The FBI logged 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558 — an average of about $123,005 per report. For most churches, that average is a staff position, or a roof.

    The recovery picture is genuinely hopeful, but only if you’re fast. The Bureau’s Recovery Asset Team ran 3,574 domestic incidents in 2025 and froze $507,042,623, and that process works far better inside the first 24 to 72 hours. Which is precisely the problem with December 27 — the day a fraudulent wire is most likely to go out is also the day nobody is checking anything.

    The checklist to run in October

    None of these takes long. All of them are much harder to do in December.

    Confirm who can authorize a payment, and write the money rule down. One page: who may approve a payment, above what amount a second person is required, and the rule that any change to payment details is verified by voice, on a phone number you already had, before the payment goes out. Not the number in the email. Not a number in the new invoice. The number you already had. Give the page to everyone who touches money, including the volunteer treasurer who only comes in on Thursdays.

    Add one seasonal line: no payment is made because it must happen tonight. If the deadline is genuinely real, tomorrow morning with a phone call still works.

    Check the giving platform’s fraud controls. Log in and look at what’s available — most platforms have more than churches turn on. You’re looking for: a minimum donation amount if your form allows any figure; rate limiting or velocity controls, which cap how many attempts can come from the same source in a short window; a CAPTCHA or similar bot check on the form; address verification and security-code checks on cards; and alerts when transaction volume spikes. If you can’t find these, email your platform’s support and ask them directly what protections against card testing are enabled on your account. That email takes four minutes and it’s the single most useful thing in this list.

    Verify your giving links everywhere they appear. The website, the bulletin, the QR code on the poster, the app, the text-to-give number, the link in the email footer, the social media profiles. Click every one and confirm where it lands. Do this yourself rather than asking whether someone else did.

    Brief the seasonal volunteers. The people who count offering at Christmas, staff the giving table, or handle the card reader at the market often serve only in this season and receive no orientation at all. Fifteen minutes covers it: two people count, nobody photographs a card, the giving links are these exact ones, and here’s who to call if something looks odd.

    Turn on multi-factor authentication before the season, not during it. Multi-factor authentication is the extra code or tap after your password. Microsoft’s own research finds it blocks more than 99.2% of account compromise attacks. Enable it on email, the giving platform, the church management system, and the bank — in October, when a hiccup is an inconvenience rather than an emergency.

    Decide now who gets called on December 27. Write down two names and two mobile numbers, and tell the office who they are. The most valuable thing on the whole list is a person who is genuinely willing to be phoned during the holidays about a payment that looks wrong. Say out loud that calling them is welcome, and that nobody will ever be criticized for calling about something that turns out to be fine.

    Watch the giving reports in real time. Assign one person to look at the day’s online gifts each morning through the season — not for reconciliation, just to see the shape of it. A screen of one-dollar donations at 3 a.m. is obvious the moment somebody looks, and invisible if nobody does until January.

    If something happens mid-season

    If a payment went out wrongly: call your bank’s fraud line first, then report to the FBI at ic3.gov using the words business email compromise. Do it the same day, not after the holiday. That’s what the recovery numbers above depend on.

    If your giving form is being used for card testing: contact your payment processor immediately and ask them to help you throttle or pause the form. Turning the form off for a few hours is far cheaper than the fees and chargebacks.

    If a fake appeal is circulating in your name: tell your congregation quickly and plainly through the channels you control, and say exactly what your real giving link is. Then report it. The FTC’s guidance for donors — check the organization before you give, and be wary of pressure and unusual payment methods — is worth passing along in your own words.

    In every case, tell someone the same day. The pattern that turns a contained mistake into a serious loss is a good person who is embarrassed and waits until after the holidays.

    What to do this week

    Send one email to your giving platform’s support team asking what fraud controls are enabled on your account and what they recommend for card testing and rate limiting. Then, while you’re at it, click every giving link you publish and confirm where each one lands.

    That’s half an hour in October, and it closes the two gaps that are hardest to close once the season starts.

    Then write two mobile numbers on the sheet by the office phone under a heading everyone will understand: call one of these before sending money, any time, including Christmas week.

    October is also a reasonable month to take stock more broadly. MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts, then returns a baseline score and a ranked list of what to fix first — which is a useful thing to have in hand before the giving season, not after.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Internal Revenue Service, Charitable contributions: Written acknowledgments and Substantiating charitable contributions; Federal Trade Commission, Before Giving to a Charity; Microsoft, mandatory multifactor authentication guidance.

  • Business Email Compromise: How One Fake Invoice Drains an Account

    Business Email Compromise: How One Fake Invoice Drains an Account

    Your church is six months into a roof replacement. The contractor has invoiced twice already, both paid without incident. On a Thursday morning, the third invoice arrives from the same email address you’ve been corresponding with all spring.

    The invoice looks right. Same logo, same layout, same project reference, correct amount. There’s one difference, and it’s mentioned in a single line of the email body:

    Please note we’ve changed banks — updated remittance details are on the invoice. Sorry for the inconvenience.

    Your bookkeeper updates the payee, sends $47,000, and files the confirmation.

    Eleven days later the contractor calls to ask when they’re getting paid.

    This is business email compromise. It is the most expensive attack aimed at organizations your size, and it almost never looks like an attack while it’s happening.

    What BEC actually means

    Business email compromise — you’ll see it shortened to BEC everywhere — is the category of fraud where someone uses email to impersonate a person you trust in order to redirect a payment.

    The name is slightly misleading, and the confusion matters, because the two versions call for different responses.

    Version one: nothing was compromised. The attacker registered a domain that looks like your contractor’s and sent mail from it. Your vendor is `midlandroofing.com`; the attacker owns `midiandroofing.com` — an l swapped for an i, invisible in most fonts at normal size. Or `midland-roofing.com` with a hyphen. Or `midlandroofing.co` dropping the m. Everything else in the email is copied from real correspondence. Nobody’s account was ever accessed.

    Version two: an account really was taken over. The attacker got into a mailbox — usually through a phished password — and is sending from the genuine address. This version is far more dangerous, because there is nothing to spot in the sender line. It’s genuinely the right address. Worse, the attacker can read the entire history first: they know your project, your invoice format, your payment cycle, who approves what, and how your bookkeeper writes. They often set up a quiet mail rule that moves the real vendor’s messages into an unread folder, so the two of you stop seeing each other’s emails while the attacker relays between you.

    The second version is why “just look at the sender address” is necessary advice but not sufficient advice.

    The scale of it

    The FBI’s Internet Crime Complaint Center recorded 24,768 BEC complaints in 2025, totalling $3,046,598,558 in losses. That works out to an average reported loss of about $123,005 per complaint.

    Sit with that figure against a church budget. For most congregations, one successful BEC is larger than a quarter of total giving. For a small nonprofit, it can be existential.

    And BEC is a rounding error away from being invisible. There’s no ransom note, no locked screen, no alarm. The first sign is almost always a vendor politely asking about an overdue payment.

    The five shapes it takes in a ministry

    The vendor bank change. The scenario above. Most common and most costly, and it spikes during building projects, capital campaigns, and any period when large payments to unfamiliar contractors are normal.

    The leadership wire request. An email that appears to come from your pastor or executive director, asking the bookkeeper to send a payment urgently, usually with a reason it can’t be discussed by phone.

    The payroll redirect. A staff member appears to email HR asking to update their direct deposit details. We’re covering this one in full tomorrow, because it works differently enough to deserve its own post.

    The invoice that was never real. A plausible bill for something a church actually buys — copier maintenance, website hosting, denominational dues, a directory listing — from a company you can’t quite remember but probably use. Small enough to approve without scrutiny. Often repeated monthly until someone notices.

    The data request. No money at all. Someone asks for the staff list, W-2 information, or the donor database. That data becomes the ammunition for the next attack, aimed at a different organization.

    Why churches are good targets for this specifically

    Three things, none of them a failing.

    Approval is informal. In a five-person office, the person who receives the invoice is often the person who pays it. There’s no purchasing department, and adding one would be absurd. But it means a single deceived person completes the whole transaction.

    Large, irregular payments are normal. A church might make three $40,000 payments a year and hundreds of $200 payments. The big ones don’t recur often enough for anyone to develop an instinct about them, and they cluster in exactly the periods — building projects, campaigns — when everyone is busy and moving fast.

    Your relationships are public. Your bulletin thanks the contractor. Your newsletter names the architect. Your board minutes list the vendors. An attacker doesn’t have to guess who you’re paying.

    The one control that stops it

    There is a single procedure that defeats every version of this attack, and it costs nothing:

    Any change to payment details is verified by voice, using a phone number you already had, before the payment goes out.

    Every word in that sentence is load-bearing.

    Any change — not just large ones. The threshold approach fails, because attackers learn thresholds.

    By voice — not by email. If the attacker controls the email thread, every confirmation you receive is written by them. This is the part people get wrong most often: replying to the message and getting a reassuring answer feels like verification, and it is the opposite of verification.

    A number you already had — from a signed contract, a previous invoice, or your own contacts. Never the number in the email or on the new invoice. Attackers put their own number on the document precisely so you’ll “verify.”

    Before the payment goes out — because after is a recovery problem, not a prevention one.

    Two additions make it stronger. Require two people for any payment over a threshold your board sets — one to initiate, a different one to release. And read the bank details aloud during the verification call, digit by digit, rather than asking “did you change banks?” A yes-or-no question invites a yes.

    Write the rule down. Give it to everyone who touches a payment. And state plainly that no one will ever be criticized for making the call, including when the request appears to come from the senior pastor. In a small church, the person most likely to be defrauded is the one who feels least entitled to question leadership.

    Hardening the email side

    The procedure is the main defense. Three technical measures reduce how often you’re tested.

    Multi-factor authentication on every mailbox. This is the extra step after your password — a code from an app, or a tap on your phone. It’s what prevents version two of this attack, where an account is genuinely taken over. Microsoft’s research finds MFA blocks more than 99.2% of account compromise attacks. It’s free on Microsoft 365 and Google Workspace.

    External sender warnings. Ask whoever manages your email to enable the banner reading “This message came from outside your organization.” When a message claiming to be from your executive director carries that banner, the contradiction is visible immediately.

    Check for mail rules you didn’t create. After any suspected compromise — and once a quarter regardless — look in each mailbox’s settings for forwarding rules and filters. Attackers routinely add a rule that forwards everything to an outside address, or that files messages containing “invoice” or “payment” into an obscure folder. It’s the most common thing left behind, and it’s the thing people forget to check after changing a password.

    If it already happened

    Speed is nearly everything. The recall window on a fraudulent transfer is measured in hours.

    Call your bank’s fraud line first. Before you investigate, before you email anyone, before you’re certain. Ask them to attempt a recall. If you have the number ready in advance rather than searching for it, that alone can be the difference.

    Report to the FBI at ic3.gov immediately, and say the words business email compromise and fraudulent wire transfer. This is not a formality. The FBI’s Recovery Asset Team can initiate what’s called the Financial Fraud Kill Chain — a process to freeze funds before they’re moved onward. In 2025 it ran 3,574 domestic cases and froze $507,042,623. It works far better within the first 24–72 hours.

    Don’t reply to the fraudulent thread, and don’t delete anything. The mailbox is evidence.

    Change passwords from a different device and revoke active sessions — in Microsoft 365 and Google Workspace there’s a “sign out everywhere” option. Changing a password alone doesn’t kick out someone who’s already signed in.

    Then check the mail rules, as above.

    And tell your insurer. Many cyber liability policies cover funds transfer fraud, and most impose short notification deadlines.

    What to do this week

    Write down the verification rule and circulate it to everyone who can initiate or approve a payment. One paragraph. Then find your bank’s fraud number and put it somewhere that doesn’t require logging into a computer — taped inside a cabinet door is fine.

    That’s an afternoon’s work against the single most expensive attack aimed at organizations your size.

    When you’re ready to see where else you stand, MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts, then gives you a baseline score and a ranked list of priorities.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Microsoft, mandatory multifactor authentication guidance.