# Charity and disaster relief scam emails: how to give safely

URL: https://iblockspam.com/blog/charity-disaster-relief-scam-emails
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> How fake charity and disaster relief emails exploit tragedies, the FBI and FTC warning signs, how to verify a charity with the IRS, and safer workplace giving.

## Short answer

After a disaster, scammers send emails posing as charities, relief agencies or victims, asking for fast donations by wire, gift card or crypto. Don't give through links in unsolicited email. Look the charity up yourself, check it with the IRS Tax Exempt Organization Search and your state charity regulator, then donate by credit card on its own website.

Within hours of a hurricane, wildfire, earthquake or mass shooting, donation requests start to arrive. Most are genuine. Some are not: fake charities with names close to real ones, "victims" asking for help, and relief agencies that don't exist. This guide explains how charity scam emails work, how to check a charity in a few minutes, and how to run workplace giving without handing scammers an opening.

## How big is the charity scam problem?

In a [January 2025 public service announcement](https://www.ic3.gov/PSA/2025/PSA250116), the FBI said that "In 2024, the FBI Internet Crime Complaint Center (IC3) received more than 4,500 complaints reporting approximately $96 million in losses" to fraudulent charities, crowdfunding accounts and disaster relief campaigns.

The FBI's annual report uses a narrower category. The [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) lists 662 complaints and $7,907,609 in losses under "Charity," which it defines as "using deception to get money from individuals believing they are making donations to legitimate charities and/or charities representing victims of natural disasters shortly after the incident occurs." Charity is a new crime type in the report, which marks it as not captured in earlier years. The two figures cover different years and definitions, so don't compare them directly. Either way, they only count what victims reported.

## How do charity and disaster scam emails work?

The FBI's January 2025 announcement warned that scammers exploit mass casualty events and disasters, may pose as relief agencies, and may use AI to make their appeals look more legitimate.

| Scam type | What arrives | The catch |
|---|---|---|
| Lookalike charity | An appeal from a name close to a well-known charity | The FTC warns some scammers use names that sound a lot like real charities |
| Brand-new "relief fund" | A group that appeared the day after the disaster | No track record, no registration, vague promises |
| Fake victim | A personal plea from someone "affected" | The FBI says to be suspicious of messages "claiming to be from individuals affected by the events" |
| Crowdfunding copy | A link to a fundraiser with stolen photos and story | The money goes to the scammer, not the family |
| Agency impersonation | An email from "disaster relief" asking for personal details | Identity theft, or fraud against assistance programs |
| Phishing "donate" link | A link to a copy of a real charity's donation page | Your card details are stolen |

Charity emails also make good phishing lures inside businesses. A "Donate to the relief fund" button that opens a fake sign-in page works whether or not anyone pays.

## What are the warning signs?

Both the FBI and the FTC publish the same core signs.

- **Pressure to give now.** The FBI: "Recognize that pressure to 'act fast' might be a sign of a scam." The FTC: "Don't let anyone rush you into making a donation. That's something scammers do."
- **Unusual payment methods.** The FTC says: "If someone wants donations in cash, by gift card, or by wiring money, don't do it," and adds cryptocurrency to the list after disasters. The FBI says: "Do not use debit, gift, or prepaid cards for payment."
- **Vague claims.** The FTC warns that scammers "make lots of vague and sentimental claims but give no specifics about how your donation will be used."
- **A free webmail sender.** The FBI says: "Emails from official organizations almost never will come from free email services."
- **Prizes for donations.** The FTC says guaranteeing sweepstakes winnings in exchange for a donation "is not only a scam, it's illegal."
- **Requests for personal details.** The FBI says: "If an unknown individual contacts you, do not release any financial or personal identifying information (PII), and do not send any money."
- **A lookalike name or domain.** One extra word or letter can turn a famous charity into a fake. See our guide to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).

The FBI also suggests reviewing "email headers and domain information to evaluate legitimacy." The [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) shows which server really sent a message and whether it passed SPF, DKIM and DMARC. The FBI adds that domain registration details "may be available through the registry at lookup.ICANN.org," unless the owner has restricted them. A "relief fund" whose domain was registered the day after the disaster deserves extra suspicion.

## How do you check a charity before you give?

This takes about ten minutes, and you only need to do it once per charity.

1. **Go around the email.** Type the charity's web address yourself or use a search engine. Don't click the link you were sent. The FBI says not to open "texts, posts, emails, attachments, or links from unknown individuals posing as entities soliciting charitable donations or humanitarian aid."
2. **Search for complaints.** The FTC suggests searching the charity's name with words like "complaint," "review," "rating" or "scam."
3. **Check the IRS.** The [IRS Tax Exempt Organization Search](https://www.irs.gov/charities-non-profits/tax-exempt-organization-search) shows whether an organization is eligible to receive tax-deductible contributions. The FTC notes it tells you "if your donation would be tax deductible." Some eligible organizations, such as churches, may not be listed, so a missing entry isn't proof of fraud.
4. **Check your state charity regulator.** The FBI recommends "checking to see if the charity is registered with your state's charity regulator, if available." The [National Association of State Charity Officials](https://www.nasconet.org/) is an association of the state offices that oversee charities, and its resources point to each state's regulator.
5. **Look for a track record.** The FTC advises giving to charities "you know and trust" with a proven record of dealing with disasters, and suggests rating organizations such as the BBB Wise Giving Alliance and CharityWatch.
6. **Ask how the money is used.** A real charity can tell you specifically. The FTC warns that scammers "give no specifics about how your donation will be used."
7. **Pay safely.** Use a credit card on the charity's own website. Keep a record and check your statement afterward for unexpected recurring charges, as the FTC advises.

### Crowdfunding and text-to-give

The FTC says to be cautious about giving to individuals on crowdfunding sites, and that crowdfunding donations aren't tax deductible. The FBI suggests "reverse searching images and stories associated with the request, as scammers will often copy and paste material stolen from others." For text-to-give, the FTC says to confirm the number by calling the charity at the number on its official website.

## What if you already donated to a scam?

1. **Call your card issuer or bank** and explain that the payment was fraudulent.
2. **Report it** to the FBI at [ic3.gov](https://www.ic3.gov) and the FTC at ReportFraud.ftc.gov. The FTC also suggests reporting to your state charity regulator. The FBI asks for the charity's identifying information, transaction details and a description of your contact with them.
3. **Watch for recovery scams.** The FBI warns: "do not pay additional fees or taxes to obtain a refund of your money," and "Do not pay for any services that claim they can recover lost funds."
4. **If you typed a password** into a donation page or a fake sign-in page, follow [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).

## How should businesses handle workplace giving?

After a major disaster, staff want to help, and many companies run a collection or match donations. Scammers know this and send emails that look like they come from HR, the CEO or a "corporate giving partner."

### Run campaigns from one trusted place

- **Choose the charity first, and verify it.** Use the IRS search and your state regulator before you promote anything.
- **Announce it on your intranet or HR system,** not just by email. Link to the charity's own donation page, and tell staff that's the only link.
- **Never collect by gift card, wire or crypto.** Say so in the announcement, so a request for any of these stands out as fake.
- **Verify matching requests.** A "please confirm your matching gift" email from outside the company should be checked with HR through a known channel.

### Protect staff from charity-themed phishing

- Tag external email so a message "from HR" that arrived from outside is obvious.
- Warn staff after major disasters that fake appeals will follow, and remind them how to report suspicious mail. Our [awareness training guide](https://iblockspam.com/blog/email-security-awareness-training-small-business) has practical tips.
- Apply the same call-back rule you use for payments. A request from the "CEO" to buy gift cards for disaster victims is the [boss gift card scam](https://iblockspam.com/blog/gift-card-scam-emails) with a new story.

### If you're a nonprofit

Scammers may impersonate you. Publish DMARC at enforcement so criminals can't send mail from your exact domain, and tell donors how you'll contact them. Our guide to [email security for nonprofits](https://iblockspam.com/blog/email-security-for-nonprofits) covers donor impersonation and volunteer accounts. Check your current record with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).

## Next steps

- Choose the charities you support before the next disaster, so you aren't deciding under pressure.
- Bookmark the IRS Tax Exempt Organization Search and your state regulator's site.
- Set a workplace rule: giving campaigns are announced on the intranet and never paid by gift card, wire or crypto.
- Run an [Email Health Check](https://iblockspam.com/tools/email-health-check) on your domain so scammers can't easily send mail as you.
- iBlockSpam filters phishing and impersonation emails before they reach every mailbox on your domain. See [how it works](https://iblockspam.com/how-it-works).

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### How can I check if a charity is real before donating?

Search for the charity's name yourself, with words like complaint, review or scam. Then check it in the IRS Tax Exempt Organization Search, which shows whether it can receive tax-deductible gifts, and with your state charity regulator, which you can find through NASCO at nasconet.org. Donate through the charity's own website, not an email link.

### Why do charity scams spike after disasters?

People want to help quickly, and scammers use that urgency. The FBI's January 2025 alert warned that scammers exploit mass casualty events and disasters with fake charity appeals, impersonation of relief agencies and false pleas from 'victims'. New disasters give them fresh, emotional stories and little time for donors to check.

### Is it safe to donate by clicking a link in a charity email?

It's safer not to. A link can lead to a convincing copy of a real charity's site. Type the charity's address yourself or use a bookmark, and pay by credit card. The FBI says not to open emails, attachments or links from unknown people posing as entities soliciting donations or humanitarian aid.

### Do real charities ask for donations by gift card or wire transfer?

No reputable charity insists on it. The FTC says not to donate to anyone who insists you pay by cash, gift card, wire transfer or cryptocurrency, because that's how scammers ask to be paid. The FBI also advises against using debit, gift or prepaid cards. A credit card gives you more protection.

### How should a company run a disaster giving campaign safely?

Pick an established charity, verify it with the IRS search and your state regulator, and publish the campaign on your intranet with a link to the charity's own website. Tell staff that HR will never ask for donations by gift card, wire or crypto, and that any matching request arriving by email should be checked first.

## Sources

- [FBI IC3 PSA: Beware of Charitable Fraud Related to Mass Casualty and Disaster Events (January 2025)](https://www.ic3.gov/PSA/2025/PSA250116)
- [FTC Consumer Advice: Donating safely and avoiding scams](https://consumer.ftc.gov/features/how-donate-wisely-and-avoid-charity-scams)
- [FTC Consumer Alert: After a disaster, make your donations count (October 2024)](https://consumer.ftc.gov/consumer-alerts/2024/10/after-disaster-make-your-donations-count)
- [IRS: Tax Exempt Organization Search](https://www.irs.gov/charities-non-profits/tax-exempt-organization-search)
- [National Association of State Charity Officials (NASCO)](https://www.nasconet.org/)
- [FBI IC3: 2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/charity-disaster-relief-scam-emails (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt