# Email security for nonprofits: the risks and a practical setup

URL: https://iblockspam.com/blog/email-security-for-nonprofits
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Phishing & threats
Author: iBlockSpam Team

> Email security for nonprofits: donation and BEC scams, volunteer and shared accounts, Microsoft and Google nonprofit programs, and a practical setup checklist.

## Short answer

Nonprofits face the same phishing as businesses, plus donor impersonation, fake grant and vendor payment requests, and sprawling volunteer accounts. Start with multifactor authentication, one account per person, quick removal of departing volunteers, DMARC on your domain, and a phone check for any payment change. Microsoft and Google both offer nonprofit discounts to help.

Nonprofits run on trust, small budgets and a lot of goodwill, and attackers exploit all three. A fake email from your executive director can trick a volunteer into buying gift cards. A spoofed appeal can take money from your donors. This guide covers the email risks that hit nonprofits hardest, the Microsoft and Google nonprofit programs as they stand today, and a practical setup you can complete without a dedicated IT team.

## What email threats do nonprofits face?

Nonprofits see the same phishing as everyone else, plus a few risks that come from how they work.

- **Executive and vendor impersonation (BEC).** An email that looks like it's from your director, treasurer or a regular supplier asks for a payment, a bank detail change or gift cards. The FBI's IC3 recorded 24,768 business email compromise complaints and $3,046,598,558 in reported losses in 2025, across all types of victims ([FBI IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)).
- **Gift card requests.** Fortra data in APWG's Q2 2026 report found gift cards were the most popular BEC cash-out method that quarter ([APWG](https://docs.apwg.org/reports/apwg_trends_report_q2_2026.pdf)). Volunteers who want to help quickly are an easy target.
- **Donor-facing fraud.** Criminals impersonate charities to collect donations. The IC3's 2025 report lists charity fraud as its own crime type, with 662 complaints and $7,907,609 in losses; its three-year table shows the category wasn't captured in 2023 or 2024. It defines it as "using deception to get money from individuals believing they are making donations to legitimate charities."
- **Grant and payment redirection.** A fake email from a funder, grantee or vendor changes where money goes. See [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection).
- **Account takeover.** A volunteer's reused password lets an attacker read donor data and send phishing from a trusted address.
- **Targeted attacks on advocacy groups.** CISA and international partners treat many civil society organizations, including nonprofit, advocacy and faith-based groups, as "high-risk communities" that are often targeted by state-sponsored actors ([CISA and partners](https://www.cisa.gov/resources-tools/resources/mitigating-cyber-threats-limited-resources-guidance-civil-society)).

## Why are volunteer and shared accounts a risk?

Volunteer-heavy organizations tend to collect accounts: a shared events@ login, a former board member's mailbox, a volunteer who left two years ago but can still sign in. Each one is a way in that nobody watches.

Shared logins also break multifactor authentication, because the code goes to one person's phone, and they leave no record of who sent what. The civil society guidance from CISA and partners lists these among its priority actions ([CISA and partners](https://www.cisa.gov/resources-tools/resources/mitigating-cyber-threats-limited-resources-guidance-civil-society)):

- Implement phishing-resistant multifactor authentication.
- Audit accounts and disable unused and unnecessary ones.
- Disable accounts and access for departing staff.
- Apply least privilege, and avoid using admin accounts for daily tasks.
- Train staff on phishing, including attacks on their personal email and devices.

A practical model for nonprofits:

| Who | Account type | Notes |
| --- | --- | --- |
| Staff | Personal licensed account with MFA | One per person |
| Regular volunteers handling data or money | Personal account with MFA | Disable when they step back |
| Occasional volunteers | No account, or limited access through shared files | Avoid giving mailbox access |
| Team addresses (info@, donations@) | Shared mailbox | Accessed through personal accounts, not a shared password |
| Board members | Personal account, or personal address for non-sensitive mail | Keep finance approvals in a verified channel |

## What do Microsoft and Google offer nonprofits?

Both major platforms have nonprofit programs. Check current terms on the official pages before you plan around them, because they change.

**Microsoft.** Microsoft says it provides eligible nonprofits "up to 300 granted licenses of Microsoft 365 Business Basic, along with discounts of up to 75 percent on many Microsoft 365 nonprofit offers" ([Microsoft Learn](https://learn.microsoft.com/en-us/industry/nonprofit/microsoft-for-nonprofits/updates)). It discontinued the Microsoft 365 Business Premium grant and the Office 365 E1 grant in 2025; those licenses expire at the next renewal. Business Premium is still offered at a nonprofit discount. If you were on the old grant, move users to another nonprofit offer before your subscription ends, to avoid service disruption or data loss. Eligibility generally requires recognized nonprofit status, equal to 501(c)(3) in the US, checked through a validation process; government bodies, schools and most healthcare organizations aren't eligible ([Microsoft Learn](https://learn.microsoft.com/en-us/industry/nonprofit/microsoft-for-nonprofits/eligibility)).

**Google.** Google Workspace for Nonprofits is listed at $0 per user, with discounted Business Standard, Business Plus and Enterprise editions ([Google for Nonprofits](https://www.google.com/nonprofits/offerings/workspace/)). In the US, organizations must be registered with the IRS as exempt under section 501(c)(3) and verified by Google's validation partner, Goodstack. Government entities, hospitals and healthcare organizations, and schools aren't eligible, though their charitable or philanthropic arms can be ([Google for Nonprofits Help](https://support.google.com/nonprofits/answer/3215869)).

Whatever plan you're on, the core protections in this guide, such as MFA, DMARC and account hygiene, are available in the basic editions.

## How do you stop people impersonating your nonprofit?

Your domain is part of your brand. Protect it so donors and partners can trust mail that claims to come from you.

1. **Publish SPF and DKIM** for every service that sends as your domain: your mailbox platform, your donation platform, your newsletter tool. Our [SPF vs DKIM vs DMARC guide](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc) explains how they fit together.
2. **Publish DMARC and move to enforcement.** CISA's joint phishing guidance asks organizations to ensure DMARC "is set to 'reject' for sent emails" ([CISA](https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one)). Start at monitoring, fix your legitimate senders, then step up, as described in [DMARC from none to reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business).
3. **Protect domains you don't send from**, such as an old campaign domain. See [protecting parked domains](https://iblockspam.com/blog/protect-parked-domains-from-spoofing).
4. **Watch for lookalikes**, such as your name with a hyphen or a different ending. Our [lookalike domain guide](https://iblockspam.com/blog/lookalike-domain-phishing) explains what to do.
5. **Tell donors your rules**: you'll never ask for gift cards, and you'll never change bank details by email.

## How do you protect donations and payments?

Most nonprofit email losses come from money moving to the wrong place. Simple rules work best:

- Confirm any new or changed bank details by phone, using a number you already have.
- Require two people to approve payments above a set amount.
- Never buy gift cards because of an email or text, whoever it appears to come from.
- Treat urgency and secrecy ("I'm in a meeting, just get it done") as warning signs.

Protect the accounts behind your donation platform and payment processor too. Turn on MFA there, limit who can change payout bank details, and make sure change notifications go to a monitored shared mailbox rather than one person's inbox. Our [business email compromise prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention) covers more controls.

## What about board members and personal email addresses?

Board members and long-standing volunteers often use personal Gmail or Outlook.com addresses for nonprofit business. That's convenient, but it creates gaps: you can't enforce MFA on those accounts, you can't recover messages when someone leaves, and an impostor using a similar free-mail address is hard to tell apart.

Reduce the risk without making life hard for volunteers:

- Keep financial approvals and donor data inside your organization's accounts, not personal ones.
- Ask board members who approve payments to use an organization account, even if they use it rarely.
- Agree that any request to move money is confirmed by phone, whichever address it comes from.
- Encourage everyone to turn on two-step verification on personal accounts they use for your work. CISA's civil society guidance specifically asks organizations to train staff about attacks on their personal email and devices.

## What is a practical setup for a small nonprofit?

A checklist you can work through in a few sessions:

1. Turn on multifactor authentication for every account, starting with admins and anyone who approves payments.
2. List every account, including volunteers and former staff. Disable the ones nobody uses.
3. Replace shared passwords with shared mailboxes accessed through personal accounts.
4. Check your domain with the [Email Health Check](https://iblockspam.com/tools/email-health-check), and fix SPF, DKIM and DMARC.
5. Write down your payment verification rules and share them with staff, volunteers and the board.
6. Give everyone one way to report suspicious email, and thank people who use it.
7. Review your inbound filtering. Built-in filtering in Microsoft 365 or Google Workspace is a reasonable start; some organizations add a gateway for per-user quarantine digests or mail held during outages.
8. Write a one-page incident plan: who to call, how to reset accounts, and how to tell donors if your address is abused.

## Next steps

1. Check your domain's DMARC policy with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), and create one with the [DMARC Generator](https://iblockspam.com/tools/dmarc-generator) if it's missing.
2. Confirm your Microsoft or Google nonprofit plan is current, especially if you were on a discontinued grant.
3. Brief volunteers on gift card and payment scams this month.
4. If you're comparing filters, our [buying checklist](https://iblockspam.com/blog/how-to-choose-a-spam-filter-small-business) is vendor-neutral. iBlockSpam uses [per-domain pricing](https://iblockspam.com/pricing) with unlimited mailboxes (the mailbox count, not message volume: 100,000 inbound messages per domain per month are included), which can suit organizations with many volunteer accounts.

More threat guides are in our [phishing and threats topic](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Why do scammers target nonprofits by email?

Nonprofits handle donations, grants and vendor payments, often with small teams, many volunteers and public staff directories. That makes it easy to research targets and impersonate a director or a known supplier. Donor trust is also valuable: a spoofed appeal from your domain can take money from supporters who believe they're giving to you.

### Can nonprofits get Microsoft 365 for free?

Eligible nonprofits can get up to 300 granted licenses of Microsoft 365 Business Basic, plus discounts of up to 75% on many other Microsoft 365 nonprofit offers. Microsoft discontinued its Microsoft 365 Business Premium grant in 2025, so Business Premium is now a discounted paid offer. Eligibility is checked through a validation process.

### Is Google Workspace free for nonprofits?

Google Workspace for Nonprofits is offered at no cost to eligible organizations, with discounted Business and Enterprise editions for more features. In the US, organizations need 501(c)(3) status and verification by Google's validation partner, Goodstack. Government bodies, hospitals and schools aren't eligible under the nonprofit program.

### Should volunteers get their own email accounts?

Yes, where they handle donor data, payments or sign-ins to your systems. Shared logins can't use per-person multifactor authentication and leave no record of who did what. Give each volunteer their own account, use shared mailboxes for team addresses, and disable accounts as soon as someone stops volunteering.

### How can donors tell a real email from our nonprofit?

Publish DMARC at an enforcing policy so mail faking your exact domain is rejected, and send from one consistent domain. Tell donors how you will and won't contact them, for example that you'll never ask for gift cards or change your bank details by email, and give them a way to check.

## Sources

- [FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (PDF)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [CISA and partners: Mitigating Cyber Threats with Limited Resources: Guidance for Civil Society](https://www.cisa.gov/resources-tools/resources/mitigating-cyber-threats-limited-resources-guidance-civil-society)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One](https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one)
- [Microsoft Learn: Microsoft for Nonprofits updates](https://learn.microsoft.com/en-us/industry/nonprofit/microsoft-for-nonprofits/updates)
- [Microsoft Learn: Microsoft for Nonprofits eligibility](https://learn.microsoft.com/en-us/industry/nonprofit/microsoft-for-nonprofits/eligibility)
- [Google for Nonprofits Help: Eligibility guidelines](https://support.google.com/nonprofits/answer/3215869)
- [Google for Nonprofits: Google Workspace for Nonprofits](https://www.google.com/nonprofits/offerings/workspace/)
- [APWG: Phishing Activity Trends Report, 2nd Quarter 2026 (PDF)](https://docs.apwg.org/reports/apwg_trends_report_q2_2026.pdf)

## Free tools for this guide

- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator): Build a DMARC record with the right policy, reporting and alignment settings.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-nonprofits (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt