It’s the third week of December. The office administrator is doing four jobs: the Christmas Eve bulletin, the poinsettia list, the volunteer schedule for two extra services, and the giving that’s arriving faster than any other time of the year.
An email comes in from the pastor’s address at 8:40 in the evening. It’s short, and it apologizes for the hour.
Sorry to do this so late — the Mercer gift needs to go out tonight so it lands before the 31st for their tax year. Wire details attached. I’m heading into the Christmas Eve rehearsal, can you handle it? Thank you for everything you do this season.
Everything in that message is calibrated. The deadline is real for donors, so it doesn’t sound invented. The pastor genuinely is unreachable tonight. The gratitude is the exact thing an exhausted administrator wants to hear in the third week of December. And the request — move money quickly, at the end of the year — is the single most normal thing happening in the building right now.
None of the attacks in this series are new in December. They just work better. That’s what this article is about, and it’s meant to be read in October, while there’s still time to do something.
Why these six weeks are different
Three things stack up at once.
The volume. Many churches and nonprofits take in a large share of the year’s gifts in the final weeks — year-end appeals, memorial gifts, stock transfers, and the last Sunday of the year. Unusual transactions stop being unusual. A five-figure gift, a wire, a new vendor, a rush payment: in July any of those would prompt a question. In December they’re Tuesday.
The people. The staff are tired and stretched. Volunteers who don’t normally touch anything are counting offering, staffing a table, running a card reader at the Christmas market. The treasurer is traveling. The bookkeeper is trying to close the year.
The cover. Everyone expects urgency in December, which means urgency stops being a warning sign. The single most reliable tell in social engineering — this must happen right now — is indistinguishable from ordinary end-of-year work.
An attacker doesn’t need a new technique to exploit that. They need a calendar.
The seasonal patterns worth knowing
Fake year-end appeals sent in your name. Your donors receive an appeal that looks like yours — your logo, your language, sometimes your pastor’s photograph — with a “give now” link that goes somewhere else entirely. The attacker doesn’t need access to your systems for this. Your appeal language is on your website, your donor names are often on your own published thank-you lists, and email addresses are widely available. The first you hear of it is a confused member calling to ask why the giving page looked different.
Hijacked or spoofed giving links. A variant aimed at your real appeal. If your email is sent through a compromised account or your website is edited by someone who shouldn’t have access, the destination of the button changes while everything else stays the same. Check the actual link in every appeal before it goes out, and check it again after it’s sent by clicking through the version that arrived in your own inbox.
A spike in gift-card and wire requests. The bookkeeper is already approving an unusual volume of unusual payments, which is exactly the noise these requests hide in. The gift-card version — “can you grab some cards for the staff, I’ll reimburse you” — is seasonal in a way that makes it especially credible in December. It isn’t credible in June.
Card testing on your giving form. This one is worth decoding, because most church leaders have never heard of it and it’s genuinely common.
Card testing is when someone with a batch of stolen card numbers uses an online form to find out which ones still work. They run a stream of very small donations — a dollar, two dollars, sometimes just an authorization — and watch which ones go through. The cards that succeed get sold or used elsewhere for real purchases.
Church giving forms are attractive for this because they take any amount, they’re open to the public, they often don’t require an account, and nobody notices small gifts arriving. The cost to you is real: a processing fee on every attempt, chargebacks when the real cardholders dispute the charges, and — if the volume is high enough — trouble with your payment processor. You may also have to explain to a stranger why your church charged their card.
The signs: a run of small donations in quick succession, often overnight, often with mismatched names and email addresses, frequently from the same or sequential card numbers.
Fake vendor invoices timed for the rush. Year-end is when legitimate invoices pile up — the audiovisual contractor, the snow removal service, the printer who did the Christmas mailing. An invoice arriving in that stack from a plausible-sounding company, or a real vendor’s invoice with altered bank details, is unusually likely to be paid without a second look.
And then January: the receipt phishing. After the season ends, donors expect an email from you about their giving statement — a donor claiming a deduction of $250 or more has to obtain and keep a written acknowledgment from you, so this is a genuinely predictable message. Attackers know it too. Your members receive a message that appears to come from the church, with a link to “download your 2026 giving statement,” which leads to a fake login page or a document that installs something. The congregation is the target here, not you, but your name is on it.
What this costs when it works
The FBI logged 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558 — an average of about $123,005 per report. For most churches, that average is a staff position, or a roof.
The recovery picture is genuinely hopeful, but only if you’re fast. The Bureau’s Recovery Asset Team ran 3,574 domestic incidents in 2025 and froze $507,042,623, and that process works far better inside the first 24 to 72 hours. Which is precisely the problem with December 27 — the day a fraudulent wire is most likely to go out is also the day nobody is checking anything.
The checklist to run in October
None of these takes long. All of them are much harder to do in December.
Confirm who can authorize a payment, and write the money rule down. One page: who may approve a payment, above what amount a second person is required, and the rule that any change to payment details is verified by voice, on a phone number you already had, before the payment goes out. Not the number in the email. Not a number in the new invoice. The number you already had. Give the page to everyone who touches money, including the volunteer treasurer who only comes in on Thursdays.
Add one seasonal line: no payment is made because it must happen tonight. If the deadline is genuinely real, tomorrow morning with a phone call still works.
Check the giving platform’s fraud controls. Log in and look at what’s available — most platforms have more than churches turn on. You’re looking for: a minimum donation amount if your form allows any figure; rate limiting or velocity controls, which cap how many attempts can come from the same source in a short window; a CAPTCHA or similar bot check on the form; address verification and security-code checks on cards; and alerts when transaction volume spikes. If you can’t find these, email your platform’s support and ask them directly what protections against card testing are enabled on your account. That email takes four minutes and it’s the single most useful thing in this list.
Verify your giving links everywhere they appear. The website, the bulletin, the QR code on the poster, the app, the text-to-give number, the link in the email footer, the social media profiles. Click every one and confirm where it lands. Do this yourself rather than asking whether someone else did.
Brief the seasonal volunteers. The people who count offering at Christmas, staff the giving table, or handle the card reader at the market often serve only in this season and receive no orientation at all. Fifteen minutes covers it: two people count, nobody photographs a card, the giving links are these exact ones, and here’s who to call if something looks odd.
Turn on multi-factor authentication before the season, not during it. Multi-factor authentication is the extra code or tap after your password. Microsoft’s own research finds it blocks more than 99.2% of account compromise attacks. Enable it on email, the giving platform, the church management system, and the bank — in October, when a hiccup is an inconvenience rather than an emergency.
Decide now who gets called on December 27. Write down two names and two mobile numbers, and tell the office who they are. The most valuable thing on the whole list is a person who is genuinely willing to be phoned during the holidays about a payment that looks wrong. Say out loud that calling them is welcome, and that nobody will ever be criticized for calling about something that turns out to be fine.
Watch the giving reports in real time. Assign one person to look at the day’s online gifts each morning through the season — not for reconciliation, just to see the shape of it. A screen of one-dollar donations at 3 a.m. is obvious the moment somebody looks, and invisible if nobody does until January.
If something happens mid-season
If a payment went out wrongly: call your bank’s fraud line first, then report to the FBI at ic3.gov using the words business email compromise. Do it the same day, not after the holiday. That’s what the recovery numbers above depend on.
If your giving form is being used for card testing: contact your payment processor immediately and ask them to help you throttle or pause the form. Turning the form off for a few hours is far cheaper than the fees and chargebacks.
If a fake appeal is circulating in your name: tell your congregation quickly and plainly through the channels you control, and say exactly what your real giving link is. Then report it. The FTC’s guidance for donors — check the organization before you give, and be wary of pressure and unusual payment methods — is worth passing along in your own words.
In every case, tell someone the same day. The pattern that turns a contained mistake into a serious loss is a good person who is embarrassed and waits until after the holidays.
What to do this week
Send one email to your giving platform’s support team asking what fraud controls are enabled on your account and what they recommend for card testing and rate limiting. Then, while you’re at it, click every giving link you publish and confirm where each one lands.
That’s half an hour in October, and it closes the two gaps that are hardest to close once the season starts.
Then write two mobile numbers on the sheet by the office phone under a heading everyone will understand: call one of these before sending money, any time, including Christmas week.
October is also a reasonable month to take stock more broadly. MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts, then returns a baseline score and a ranked list of what to fix first — which is a useful thing to have in hand before the giving season, not after.
No spam and no sales calls — just one email when it’s live.
Related reading
- the payment redirection scam that peaks in December
- fake giving pages that appear alongside your real one
- how a sudden appeal exploits the same generosity
MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.
Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Internal Revenue Service, Charitable contributions: Written acknowledgments and Substantiating charitable contributions; Federal Trade Commission, Before Giving to a Charity; Microsoft, mandatory multifactor authentication guidance.