Email security for churches and religious organizations: the risks and a simple setup

A church's email works on trust. Members open messages from their pastor without a second thought, staff pay contractors and musicians by email, and volunteers come and go through ministries that each have their own address. Criminals know that too. This guide covers the email threats specific to churches and other religious organizations, what the FTC and CISA say about them, and a setup a small church office can actually maintain.

Why are churches targeted by email scams?

Churches are targeted because the names and roles of their leaders are public, their members are trusting and generous, and many run email on a mix of personal accounts and shared volunteer logins. That combination makes impersonation easy and hard to spot.

• Public leadership. Websites and bulletins list the pastor, staff and elders, often with email addresses. See protect public email addresses from spam.
• Trust and generosity. A request "from the pastor" to help someone in need gets a quick yes.
• Personal accounts. When leaders already use Gmail or other free addresses for church business, a scammer's new free account looks normal.
• Volunteer turnover. Ministry leaders change, and passwords for youth@ or office@ get passed along rather than reset.
• Real money. Building funds, renovation contractors, payroll and benevolence payments move by email.

CISA treats houses of worship as needing protection from both physical attacks and "less visible cyberattacks", and advises them to "implement cybersecurity best practices to safeguard important information" (CISA). CISA and international partners also list "faith-based" groups among civil society organizations at heightened risk of targeted cyber threats (CISA and partners).

What is the fake pastor gift card scam?

The fake pastor gift card scam is an email, text or call in which a criminal pretends to be a religious leader and asks members to buy gift cards for a good cause, then send the card numbers and PINs. The FTC says "scammers are pretending to be a pastor, rabbi, priest, imam, or bishop", and that "appeals are often made by email", though texts and calls are used too (FTC).

The FTC lists the warning signs:

• an email address the leader doesn't normally use, often from a different email provider
• a generic greeting with no name
• spelling mistakes, including in the leader's own name
• a request for popular cards such as iTunes, Google Play or Amazon, followed by a request for the card number and PIN. As the FTC puts it, "those numbers let the scammer immediately get the money you loaded onto the card."

Here's an example of the kind of message members receive:

Example: "From: Pastor David Miller pastor.dmiller.office@gmail.com. Hi, are you available? I need a quick favor. I'm in a meeting and can't talk, but I need to get gift cards for a member who is in the hospital. Can you get four $100 Google Play cards? I'll reimburse you after Sunday's service."

The scam works mainly on your members, from addresses you don't control, so your filter can't stop most of it. What stops it is a clear rule, announced often. Our gift card scam emails guide covers the workplace version of the same trick, and display name spoofing explains why the "Pastor David Miller" name proves nothing.

What other email threats do churches face?

Beyond gift card scams, churches see vendor and contractor payment fraud, account takeover of staff mailboxes, fake donation requests and general phishing.

Building fund and vendor payment fraud

Business email compromise (BEC) is fraud where a criminal impersonates, or takes over, a trusted email account to redirect a payment. The FBI's IC3 recorded 24,768 BEC complaints in 2025, with $3,046,598,558 in reported losses across all victims (IC3 2025 report). A renovation or building project is a natural target: large, scheduled payments to a contractor whose email address the treasurer may only have used a few times.

The FBI advises using "secondary channels and/or two-factor authentication to verify requests for changes in account information" (IC3 PSA I-091124-PSA). For a church, that means a phone call to the contractor on the number in the signed contract before any bank change. See vendor invoice fraud and payroll diversion scam emails.

How do you protect your congregation from impersonation?

Protect your congregation by making real church email easy to recognize and fake requests easy to reject. Most of this costs nothing.

1. Adopt a "we never ask" rule. Leaders and staff will never ask members for gift cards, wire transfers or payment app transfers by email or text.
2. Announce it regularly from the pulpit, in the bulletin, in newsletters and on your website, and again whenever a scam is reported.
3. Move every leader to the church domain. Give the pastor, staff and key volunteers addresses like pastor@example-church.org, and stop using personal accounts for church business.
4. Publish one official giving page and tell members that the church never collects donations through links in unexpected emails.
5. Tell members how to check: call the church office on the number on your website before acting on any unusual request.
6. Warn quickly. When one member reports a fake message, send a short alert to everyone that day.

How should a church set up its email?

Set up church email so that every person has their own account on the church domain, with multi-factor authentication (MFA), a second check at sign-in beyond the password. CISA's joint phishing guidance says to prioritize phishing-resistant MFA for administrator and privileged accounts, such as those with "broad access to customer or financial data" (CISA). Give your treasurer, bookkeeper and anyone with member records the same priority.

• One account per person, shared mailboxes for ministries. Keep office@ or youth@ as shared mailboxes opened by named people, so you can remove a departing volunteer without changing a password for everyone. Our nonprofit email security guide covers volunteer accounts in more depth.
• Look at nonprofit programs. Microsoft and Google both run nonprofit programs. At the time of writing (October 2026), Microsoft requires "recognized legal status" equal to US 501(c)(3) status (Microsoft Learn), and its country eligibility document asks US organizations to be recognized by the IRS as exempt under Section 501(c)(3). Neither says anything specific about churches, so ask the validation partner what documentation it accepts. Check each provider's current terms before applying.
• Publish SPF, DKIM and DMARC so criminals can't send email from your exact domain. DMARC is a DNS record that tells receivers what to do with mail that claims to be from your domain but fails authentication. CISA asks organizations to "ensure DMARC is set to 'reject' for sent emails". A record at enforcement (example domain):

_dmarc.example-church.org  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-church.org"

Start at p=none, check your reports, then move up, as described in DMARC from none to reject. Remember to include your newsletter, giving and church management platforms; see authenticating third-party senders.

DMARC protects your exact domain only. It can't stop a scammer using Gmail or a lookalike such as example-church-office.org, which is why the "we never ask" rule matters most.

Does a church need a separate spam filter?

Many small churches don't. If you use Microsoft 365 or Google Workspace, the built-in filtering plus MFA, DMARC and the rules above covers the basics, and a church office with a handful of accounts may never need more.

A separate MX-level filter helps when:

• Staff miss real mail or see too much junk. Each user gets a personal quarantine with scheduled digest emails, so a volunteer can check what was held without admin rights.
• You run several domains, such as a church, a school and a camp. Per-domain pricing with unlimited mailboxes (mailbox count, not message volume) keeps volunteer accounts from adding cost.
• You want stricter attachment rules, such as blocking macro-enabled Office files and risky file types before they reach anyone.

Our pricing page shows what that costs per domain. No filter can stop scam messages sent to members' personal inboxes, so start with the steps above either way.

Church email security checklist

1. Agree and publish the "we never ask for gift cards or transfers" rule.
2. Move every leader and staff member to an address on the church domain.
3. Turn on MFA for every account, starting with the treasurer, bookkeeper and pastor.
4. Replace shared ministry logins with shared mailboxes opened by named people.
5. Remove access the day a staff member or volunteer leaves. See employee offboarding email security.
6. Confirm every contractor or payroll bank change by phone on a known number.
7. Publish SPF, DKIM and DMARC, and move DMARC to enforcement.
8. Give staff and members one way to report a suspicious email. See how to report phishing email.

Next steps

• Check your church domain's SPF, DKIM and DMARC with the free Email Health Check, and build a starting record with the DMARC Generator.
• Put the "we never ask" rule in this Sunday's bulletin.
• Share the how to spot a phishing email guide with staff and ministry leaders.
• If you want a filtering layer, iBlockSpam's per-domain pricing covers unlimited staff and volunteer mailboxes.

More threat guides are in our phishing and threats topic.