Take a breath. If you’re reading this because something feels off with one of your ministry’s accounts, the most useful thing you can do right now is stay calm and move in order. Most of the damage from a compromised account is done \u2014 or prevented \u2014 in the first hour, and you have more control than it feels like you do. Let’s walk through it together.<\/p>\n\n\n\n
Sometimes it’s obvious: you go to sign in and your password no longer works, or you get a message that your account has been locked. Other times it’s quieter, and quieter is often more dangerous. A volunteer mentions they got a strange email or text “from you” asking for gift cards or a quick favor. People on your contact list start replying to messages you never sent. You notice password-reset emails arriving that you didn’t request, or sign-in alerts from a city or device you don’t recognize.<\/p>\n\n\n\n
Watch especially for the sneaky signs inside the account itself. An attacker who gets into email will often set up a quiet forwarding rule or a filter so that copies of your incoming mail get sent to them \u2014 or so that certain messages skip your inbox entirely and land in the trash where you’ll never see them. You might also notice that money has moved, that your giving platform’s payout or bank details have changed, or that a login you use for donations suddenly behaves differently. Any one of these is worth taking seriously.<\/p>\n\n\n\n
If you can still get into the account, act quickly and in sequence. First, change the password \u2014 and make it a strong, unique one you’ve never used anywhere else. Don’t recycle an old favorite. Once the new password is set, look for the option to sign out of all other sessions and devices. Most email and account providers offer this, and it’s the step that actually kicks the intruder out; changing the password alone doesn’t always end a session they already have open.<\/p>\n\n\n\n
Next, turn on the second sign-in step \u2014 often called multi-factor authentication, or MFA \u2014 if it wasn’t already on. This is the single most effective thing you can do to keep them from walking back in, because even if they somehow learn your new password, they can’t get past that second check without your phone. The Cybersecurity and Infrastructure Security Agency (CISA) has been blunt about this: turning on multi-factor authentication makes you significantly less likely to get hacked. It’s worth the two minutes.<\/p>\n\n\n\n
Once that’s done, go hunting for what the attacker may have left behind. Open your email settings and check the forwarding and filter rules. If you find a rule you didn’t create \u2014 anything quietly copying your mail elsewhere or auto-deleting messages \u2014 remove it. This is the step people miss most often, and it’s the one that lets an attacker keep reading your mail long after you’ve changed the password. While you’re in the settings, review the list of connected apps that have access to your account and revoke anything unfamiliar, and check your recovery information \u2014 the backup email address and phone number \u2014 to make sure they still point to you and not to a stranger.<\/p>\n\n\n\n
If this is an account that touches your ministry’s money or holds people’s personal information \u2014 your email, your giving platform, your accounting login \u2014 pause and tell your designated person right away. That might be your treasurer, your bookkeeper, or whoever you’ve agreed handles this. Two calm heads are better than one anxious one. Then check the accounts that matter: log in to your bank and your giving or payment platform directly (type the address yourself rather than clicking a link in any email), and look for changes to payout details, new payees, or transactions you don’t recognize. If something’s wrong, call the bank or platform’s support line and tell them the account may be compromised.<\/p>\n\n\n\n
If your password no longer works and you can’t get in at all, don’t keep guessing \u2014 go to the provider’s official account-recovery process. Every major provider, Google and Microsoft included, has a “forgot password” or “I can’t sign in” path built for exactly this moment. It will walk you through verifying that you’re the real owner. If the attacker changed your recovery phone or email, the recovery flow usually has a way to prove ownership anyway, so be patient and follow the prompts. Resist the urge to create a brand-new account and abandon the old one; recovering the original is almost always the cleaner path.<\/p>\n\n\n\n
If there’s any chance someone else’s information was exposed \u2014 donors, staff, the people in your directory \u2014 tell them plainly and soon. A short, honest note saying “our email was compromised, please ignore any odd messages from us, and never send money or gift cards based on a message you weren’t expecting” does enormous good. People understand that these things happen. What they remember is whether you were straight with them. The Federal Trade Commission’s guidance on hacked accounts makes the same point: alerting your contacts quickly helps stop the scam from spreading through the people who trust you.<\/p>\n\n\n\n
Here’s what to hold on to. Acting fast in that first hour contains most of the damage, and none of the steps above require you to be technical \u2014 they require you to be calm and to go in order. The best gift you can give your future self is to decide, today, before anything goes wrong, who you’d call and what you’d check first. Write it down. Tape it inside a drawer if you have to. A plan you made on a quiet afternoon is worth ten frantic guesses at midnight.<\/p>\n\n\n\n