MissionDefend Blog

Home Articles Get your free assessmentComing soon

Tag: reporting

  • Give Everyone a “This Looks Wrong” Button

    Give Everyone a “This Looks Wrong” Button

    The nursery coordinator gets an email on a Sunday evening.

    Your mailbox has exceeded its storage limit. 3 messages are being held for delivery. Sign in within 24 hours to release them, or they will be deleted.

    Something about it feels off. The wording is slightly stiff. She’s never had a quota problem before. She looks at it for a few seconds, decides it’s probably nothing, and deletes it.

    That’s the end of it, as far as anyone in the church ever knows.

    What she doesn’t know is that the same message went to eleven other people that evening, and that one of them — the volunteer bookkeeper, checking email between services — clicked it and typed in her password.

    Nobody in this story behaved badly. The coordinator’s instinct was excellent. She just had nowhere to put it. There was no address to send it to, no button to press, and a small, entirely reasonable fear of being the person who bothered the pastor about an email that turned out to be fine.

    The gap between someone noticed and anyone acted is where most of these attacks live. Closing that gap is one of the highest-value things a small organization can do, and it costs nothing.

    Your people are already the detection system

    Small churches and nonprofits do not have a security team watching the mail flow. What they have is eight or twelve people who know how things normally sound around here.

    That knowledge is genuinely good. The office administrator knows the pastor doesn’t send one-line emails asking for a favor while he’s “in a meeting.” The treasurer knows the roofing contractor has never changed bank details mid-project.

    Filters catch a great deal, and you should certainly have them turned on. But phishing is designed to survive filters — a well-crafted message from a newly registered domain, with no attachment and no malicious link on any list yet, sails through into the inbox looking ordinary. The last line of detection is a human being noticing that something feels wrong.

    Right now, in most small organizations, that noticing produces nothing at all. Not because people don’t care — because there’s nowhere for it to go.

    The mechanics: build somewhere to send it

    This is the easy half, and it takes about twenty minutes.

    Option one: an address everyone knows. Create a shared mailbox or a group address — security@, checkthis@, isthisreal@, whatever your people will actually remember. Point it at two or three people: whoever handles IT things, the office administrator, and one other person so it’s never one person’s holiday that stalls it. Both Microsoft 365 and Google Workspace let you create a shared mailbox or group at no extra cost.

    The name matters more than it should. Security sounds formal, and formality makes people hesitate. Checkthis@ sounds like asking a colleague, which is exactly the behavior you want.

    Option two: the button that’s already there. Microsoft 365 and Google Workspace both include a report function in the mail app itself.

    In Microsoft 365, there’s a built-in Report button in Outlook that lets people flag a message as phishing or junk. An administrator can configure where those reports go — to Microsoft for analysis, to a mailbox you nominate inside the organization, or to both. Choosing “both” is the right answer for most churches: Microsoft’s systems learn from it, and a person in your building sees it too.

    In Gmail, opening a message and choosing the report-phishing option under the message’s more menu sends a copy to Google and moves the message out of the inbox.

    Use both. The button is one click and gets used; the address is where the awkward cases go — a text message someone got, a phone call, a letter, a QR code on a poster in the lobby. The button only handles email. Real life doesn’t.

    Say the same thing on every path. Put the address in the email signature block for staff, on the sheet taped by the office phone, and on the volunteer welcome page. The failure mode isn’t people refusing to report. It’s people not remembering how.

    Forward it the right way. One small technical detail makes a real difference to whoever reviews the report. When you forward an email normally, the mail app makes a new message and pastes the old text inside it. What gets lost is the hidden header information — the record of which servers actually handled the message and where it really came from. That’s often the fastest way to tell a genuine message from a convincing forgery, and an ordinary forward destroys it.

    Forwarding as an attachment preserves the original message intact, headers and all. Both Gmail and Outlook can do it; in Gmail it’s an option in the message’s menu, and in Outlook you can drag a message into a new one or choose the attachment-forwarding option. The built-in report buttons do this automatically, which is another argument for using them.

    Two rules to say out loud alongside it: don’t click anything in the message before you report it, and don’t delete it after — leave it in a folder for a week in case someone needs to look.

    The half that actually decides whether this works

    Here’s the uncomfortable part. The technical setup is twenty minutes. Whether anyone uses it depends entirely on how the first few reports are received.

    People do not report because they are afraid of looking foolish. That’s the whole thing. Not laziness, not indifference — a completely ordinary human reluctance to raise a hand and be wrong in front of colleagues. If a report is met with a delay, a sigh, or a technical explanation of why it was obviously fine, that person will not report again, and neither will anyone they mention it to.

    Three commitments, and they need to be said publicly, not just believed privately.

    Thank people for every report, including the false alarms — especially the false alarms. The reply to a report about a perfectly legitimate email should be warm and short: “Checked it — this one’s genuine, it’s from the insurance broker. Thanks for flagging it, that was exactly the right call.” Never “that was fine.” The thing you’re reinforcing is not accuracy; it’s the act of asking.

    Nobody is ever in trouble for reporting — including reporting their own mistake. This one has to be stated in words, at a staff meeting, by whoever is in charge. “If you click something and then think ‘oh no,’ tell me immediately. You will not be in trouble. The only thing that turns a bad click into a bad month is waiting.” Without that sentence spoken aloud, a scared volunteer will spend four hours hoping it was nothing, and four hours is the difference between a password reset and a wire transfer.

    Answer fast. Not necessarily with an answer — with an acknowledgment. “Got it, looking now” within the hour. A report that vanishes into a mailbox teaches everyone that reporting is pointless, and that lesson sticks harder than any training.

    What to do when one arrives

    You need a short routine, not a procedure manual. Five steps:

    1. Acknowledge it. One line, straight away.

    2. Look at the sender’s actual address, not the display name. The display name is the friendly label your mail app shows — it’s free text and anyone can set it to anything, including your pastor’s name. The real address is what matters, and on a phone it’s usually hidden until you tap it.

    3. Ask whether it wants a credential or wants money. Almost every phishing message wants one of two things: for you to sign in somewhere (a fake login page harvesting your password), or for you to move money, buy gift cards, or change payment details. Naming which one tells you what to do next.

    4. If it’s real, contain it. Ask your mail administrator to search for the same message across all mailboxes and remove it. Whether they can depends on your subscription: in Microsoft 365 it’s done through eDiscovery or Defender for Office 365, and in Google Workspace only the higher editions include the security investigation tool that deletes mail from other people’s inboxes. If your plan can’t, the fallback is telling everyone to delete it — which is step five anyway. If anyone entered a password, that account’s password changes immediately from a different device, active sessions are signed out, multi-factor authentication is checked, and mail rules are reviewed — attackers routinely add a rule to hide their tracks.

    5. Tell everyone. This is the step people skip, and it’s the most valuable one. If a message reached one mailbox, it almost certainly reached several. A two-line note to all staff — “A fake DocuSign email is going around this morning; it’s not from us; delete it” — protects the people who hadn’t opened their email yet.

    That last step is also what makes the next report more likely. People who see that their report produced a visible, useful outcome will report again.

    Speed is the whole game with money

    If a report involves money that has already moved, the clock is the only thing that matters.

    The FBI’s Recovery Asset Team exists to freeze fraudulent transfers, and in 2025 it ran 3,574 domestic incidents and froze $507,042,623. That process works dramatically better inside the first 24 to 72 hours. After that, the money has usually been moved onward and the odds fall off a cliff.

    Which means the value of a reporting culture is not really about email hygiene. It’s that when the bookkeeper realizes at 4:40 on a Friday that the payment she sent this morning went to the wrong account, she picks up the phone immediately instead of sitting with it over the weekend. Everything you do to make reporting comfortable is, in the end, buying hours on that clock.

    For context on scale: business email compromise generated 24,768 complaints in 2025 with reported losses of $3,046,598,558 — an average of about $123,005 per report. Phishing and spoofing, with 191,561 complaints, was the most-reported crime type of the year.

    Attempted or successful fraud goes to the FBI at ic3.gov, and identity theft to identitytheft.gov.

    Measure it gently, or not at all

    If you want a number, use this one: reports per month.

    Not accuracy. Not how many were real. Just how many times somebody raised a hand. A church that goes from zero reports a month to six has built a detection capability it did not have before, and the fact that five of the six were harmless is not a problem — it’s the cost of the sixth.

    Report the number to the board once or twice a year as a positive indicator. “Staff flagged eleven suspicious messages this year; two were real, one of them was an attempted payment change.” That sentence tells a board more about the organization’s actual security posture than any policy document.

    And resist the urge to run a punitive phishing test on your volunteers. If you do simulate one, tell people in advance that it’s coming sometime this quarter, and never publish who clicked. A church is a volunteer organization held together by goodwill; embarrassing a faithful person to make a training point costs more than it teaches.

    What to do this week

    Create the address. Fifteen minutes: a shared mailbox called checkthis@ (or whatever fits your church), pointed at two people, and — if you’re on Microsoft 365 or Google Workspace — confirm the built-in report button is available and that reports land somewhere a human will see them.

    Then, at the next staff meeting, spend two minutes saying the sentence out loud: if anything looks wrong, send it to checkthis@ — you will never be in trouble for asking, and you will never be in trouble for telling me you clicked something.

    CISA’s advice to organizations comes down to the same thing: make sure people know how, and to whom, to report a suspicious message.

    MissionDefend’s free assessment covers exactly this kind of ground — how your organization handles email, donations, member data, and accounts — in plain English, and gives you a baseline score with a ranked list of what to fix first.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, Configure user reported message settings in Microsoft Defender for Office 365; Google, Avoid and report phishing emails; Cybersecurity and Infrastructure Security Agency, Teach Employees to Avoid Phishing; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

  • The Scam Your Congregation Won’t Tell You About

    The Scam Your Congregation Won’t Tell You About

    Marian has not missed a Sunday in nineteen years. She runs the prayer chain. She was married forty-one years and widowed four years ago.

    In February she stopped putting anything in the offering plate. In April she took out a home equity loan. In June she asked the treasurer, oddly, whether wire transfers to Hong Kong were normal.

    Nobody put it together, because nobody was looking, and because Marian had told no one about the man she’d spoken with every day since January — a widowed contractor working overseas, a believer, someone she prayed with most nights before bed. By August she had sent him everything she had, and she still didn’t believe he was a fraud when her son sat her down with the evidence.

    Some version of this is happening in your congregation right now, and the reason you haven’t heard about it is the most important fact in this article.

    What we’re actually talking about

    The FBI calls it confidence fraud — confidence/romance fraud in its annual crime report. Its definition covers anyone who believes they are in a relationship — romantic, friendly, or familial — and is tricked into sending money or information. Romance is only one flavor. A friendship works, and so does a fake grandchild in trouble.

    In 2025 the FBI’s Internet Crime Complaint Center logged 23,159 confidence and romance fraud complaints, with reported losses of $929,287,469 — of which 10,188 complaints and $584,032,745 came from people aged 60 and over. Those figures understate the problem badly, because most victims never report. This is the crime people are most ashamed of, and shame keeps it off the ledger.

    You may also have heard the phrase “pig butchering” — the operators’ own term for fattening a target with attention and small wins before taking everything. It’s an ugly thing to say about a member of your church; the honest description is confidence fraud with an investment ending.

    How it actually works

    The shape is remarkably consistent, and the shape is what you can hand your congregation.

    It starts sideways. Often with a text to the wrong number — “Hi David, are we still on for lunch Thursday?” — then a polite reply, a warm apology, and a conversation. The FTC lists “‘wrong number’ texts that aren’t” among the top reported text scams and describes what follows exactly: “These scammers strike up a fake friendship, often with romantic undertones.” It also begins in dating apps, Facebook groups, and comment threads under Christian pages.

    Money is not mentioned for a long time. Weeks, frequently months. This is what everyone gets wrong: they picture a stranger asking for money on day three. What happens instead is a hundred days of good-morning texts and how did the appointment go and remembering the anniversary of a spouse’s death. By the time money appears there is a real relationship, real on one side, and real relationships are where guards are down by design.

    There’s always a reason you can never meet. Working overseas, on an oil rig, in the military. Video calls don’t work, or are brief and strange, or lately synthetic — the FBI notes that scammers promise to meet and then cancel, and increasingly use deepfakes.

    The ending has two forms. Either a crisis — a medical emergency, a customs fee, a frozen account — or, increasingly, an investment. He’s done well trading cryptocurrency and offers to teach her. She puts a small amount into a platform that looks entirely professional, watches it grow, and withdraws a little successfully — the moment the trap closes. Then she puts in more, and when she tries to withdraw there are taxes to pay first. The FBI is blunt: “This is a trap.”

    Faith is used as the lever, deliberately

    This is the part that will make you angry.

    Scripts written for churchgoing targets include church. He was raised in the faith. He’s been looking for a congregation since he moved. He asks what she’s been reading and sends a verse in the morning. He prays with her on the phone — at length, and well, because someone in the operation has studied the vocabulary.

    It works for a specific reason: in a faith community, shared belief is a legitimate accelerant for trust. That is not a flaw in your people — it’s why a church can care for its members in a way a subdivision cannot. The fraud borrows that instinct, which is why the usual advice, don’t trust strangers online, lands wrong. He isn’t a stranger. He’s a brother in Christ who calls every night.

    Why they defend him

    By the time anyone notices, it isn’t about money. She is not defending an investment. She is defending a relationship — and the person telling her it isn’t real is telling her that the best thing in her life since her husband died was a fiction built by strangers. Admitting that means accepting, all at once, that the money is gone, that eight months were invented, that everyone will find out, and that she participated. The mind does not take all of that on a Tuesday afternoon in a kitchen. It resists, and resistance looks like stubbornness from outside.

    The scammer prepared the ground months ago. Operators inoculate against interference early: your children won’t understand. Your church will judge us. People will say I’m after your money. So the son arrives with his printouts having already been predicted — which makes the scammer look right and the son look like the thing foretold.

    Confrontation therefore backfires. Pressing harder, producing more evidence, gathering the family: all of it deepens the commitment, because every concession costs more than the last. What helps is slower — staying in relationship, asking questions rather than issuing verdicts, and being there when the belief cracks. It usually cracks on its own, when a withdrawal fails or the demands turn cold.

    One more fact belongs in your teaching. The person typing those messages is very often not a criminal in any sense your church would recognize. The FBI has warned that fake job advertisements lure people to Southeast Asia, where they are “held against their will, intimidated, and forced to commit international cryptocurrency investment fraud schemes” — passports taken, violence threatened, debts manufactured and raised each time they’re moved between compounds. The man praying with Marian at eleven at night may be someone who answered an ad for a customer service job and is beaten if he misses his numbers. That reduces the harm to Marian by nothing, but it moves the anger away from a caricature and toward an industry destroying people at both ends.

    What a leader can actually do

    Talk about it from the front, before it happens to anyone. Five minutes on a Sunday, and the highest-value thing on this page. Say plainly that this happens to church people, that it is not a stupidity problem, and that anyone caught in it can say so without being ashamed. Silence is the environment the fraud requires.

    Name the patterns out loud. Vague warnings don’t help. These do:

    • Someone you have never met in person who talks about faith early and often.
    • A “wrong number” text that turns into a friendship.
    • Moving quickly from a dating app or Facebook to WhatsApp, Telegram, or private texting.
    • Video calls that never quite happen.
    • Any investment introduced by a romantic interest — no exceptions, however well it’s going.
    • Being told your family and your church will not understand.
    • Any request to receive money and pass it along — that is money laundering.

    Give your people one rule to hold onto: before you send money to someone you have never met, tell one other human being. Not for permission — just say it out loud. Isolation is the load-bearing wall of the scheme.

    Tell your finance volunteers what to watch for. A long-standing giver who stops abruptly. Unusual questions about wire transfers, cryptocurrency, or gift cards. A member who suddenly needs benevolence help and won’t say why. None is proof; each is worth a gentle conversation.

    Build your older-adult ministry with this in mind. In 2025 the FBI logged 201,266 complaints from people aged 60 and over, totalling $7.748 billion — complaints up 37% and losses up 59% in a single year, average loss $38,500. Loneliness is the underlying vulnerability, and it is the one thing a church is unusually equipped to address.

    When someone tells you

    Assume it took weeks to work up to it, and that they arrived braced for your disappointment.

    Believe them and don’t flinch. The first thirty seconds set everything. Thank you for telling me. You’re not the first person I’ve talked to about this.

    Never ask how they could have fallen for it — not once, not as a joke, not months later. That question closes the door for good. And don’t demand they accept it’s fake all at once. Ask questions instead: has he ever been able to video call? What happened when you tried to take money out? Let the contradictions do their own work.

    Move to practical steps quickly, because action helps a person in shock more than reassurance does. Stop sending money today. Report it at ic3.gov with dates, amounts, account numbers, wallet addresses, and transaction IDs. Call the bank or platform that sent it and ask about a recall. If personal information was shared, go to identitytheft.gov. Keep everything — the messages, the photos, the app.

    Be honest that recovery is rare. Where money is still in transit the FBI’s Recovery Asset Team can act — 3,574 domestic incidents and $507,042,623 frozen in 2025 — but that depends on speed, and this is usually found months late.

    Then warn them about the second scam, by name. Victims get re-targeted, often within weeks, by “recovery services” offering to retrieve the stolen funds for an upfront fee. The FBI has repeatedly warned about fictitious law firms contacting cryptocurrency fraud victims with exactly this offer, and about criminals impersonating the IC3 itself. Say it plainly: nobody who contacts you first can get your money back.

    Then the part that is actually your work. When you sit with someone in the weeks afterward, you’ll find the money — even a devastating amount of it — is not what they cry about. They cry because he’s gone. Because the person who texted good morning every day for eleven months, who prayed with them, who knew their late husband’s birthday, did not exist.

    That is a bereavement and deserves to be treated as one. They lost a relationship and are expected to feel foolish for having had it, which is exactly why so many never tell anyone.

    Your job is not to explain how the fraud worked; they’ll learn that. Your job is to make sure they aren’t alone in the kitchen, and to say more than once that the love they gave was real even though the person receiving it wasn’t. Both are true. Only one of them is a crime.

    What to do this week

    Say it from the front on Sunday. Two minutes: This is happening to church people. It starts as a friendship, often with someone who talks about faith. It takes months. If you’re in it, come talk to me and nobody will make you feel foolish.

    Then four lines in the newsletter: never send money to someone you have never met; never invest on the advice of a romantic interest; tell one other person before you send anything; report it at ic3.gov.

    Two minutes on a Sunday and one call to your communications volunteer, and you’ve removed the shame that keeps this crime invisible.

    MissionDefend’s free assessment covers the organization’s own posture — email, donations, member data, and accounts — and returns a baseline score with a ranked list of what to fix first. A good companion to the work of protecting the people in the pews.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; FBI, Cryptocurrency Investment Fraud; FBI Internet Crime Complaint Center, The FBI Warns of False Job Advertisements Linked to Labor Trafficking at Scam Compounds; FBI Internet Crime Complaint Center, Fictitious Law Firms Targeting Cryptocurrency Scam Victims Combine Multiple Exploitation Tactics While Offering to Recover Funds; FBI Internet Crime Complaint Center, FBI Warns of Scammers Impersonating the IC3; Federal Trade Commission, Top text scams of 2024.