Volunteer-run charities handle donor bank details, beneficiary records and grant funds through committees that turn over every year or two — which is why cyber security awareness programs for volunteer-run charities in 2026 need a different shape than a corporate compliance course nobody on the committee has time for.
TL;DR
- Cyber Aware is the Buy for cyber security awareness programs for volunteer-run charities in 2026.
- Business email compromise is one of the top three self-reported cybercrime types for Australian organisations, per Aryon's analysis of ACCC Scamwatch data.
- From 1 July 2026, Privacy Act Tranche 2 reforms remove the small-business exemption, pulling roughly 100,000 businesses — including many charities under $3 million turnover — into full Australian Privacy Principle coverage.
- Train the treasurer and committee on donor-refund and bank-detail-change pretexts, not generic phishing templates.
- Skip enterprise suites priced for paid, permanent headcount.
Why this matters
Charities are a soft target because they run lean. A small or no finance team, a volunteer treasurer doing the books on weekends, and a committee that rotates every AGM — that combination is exactly what business email compromise (BEC) scams exploit. Aryon's analysis of Scamwatch data found BEC represents 33% of all reported incidents for Australian organisations, with 13% resulting in an actual financial loss.
The regulatory ground is shifting too. The ACNC has named cyber security a 2025-26 compliance priority, and its previously optional Governance Toolkit on cyber security is now treated as a baseline expectation, not a nice-to-have. Separately, Privacy Act Tranche 2 reforms take effect from 1 July 2026, removing the small-business exemption and bringing roughly 100,000 organisations — including many charities under $3 million turnover — into full Australian Privacy Principle obligations.
A charity does not need a sophisticated attacker to lose money. It needs one committee member to approve an "updated bank details" email from a "regular supplier" during a busy fundraising week.
Who this is for
This guide is for charity CEOs, treasurers, office managers and the boards overseeing organisations that run on a mix of paid staff and volunteers — typically fewer than 50 people, holding donor payment data, beneficiary records and grant funding, with no dedicated IT or security function.
What to look for in cyber security awareness for volunteer-run charities
Donor-refund and bank-detail-change pretexts
A fake donor asking for a "refund" or a fake supplier updating bank details is the actual pattern showing up in charity BEC losses. Generic phishing templates built for corporate retail lures do not prepare a treasurer for this. Phishing simulations should mirror the real pretext.
Volunteer-friendly enrolment without a corporate email requirement
Many committee members use personal email for charity business. A platform that only works with a corporate domain locks out exactly the volunteers handling money.
Short modules for people with a day job elsewhere
Committee members and volunteer treasurers do charity work in evenings and weekends. Story-driven security awareness training under about ten minutes per module is the only format that gets finished.
Board-readable reporting for AGM season
A volunteer board wants three numbers — completion rate, click rate, repeat-clicker count — not a security operations dashboard. Human risk reporting needs to fit one slide for the annual report.
A hard rule for bank-detail changes
No software replaces a simple policy: never change a supplier or donor's bank details on the strength of an email alone. Call a number already on file. Pair the policy with simulations that actually test whether staff follow it.
Pricing that survives a fluctuating volunteer roster
Committees change every AGM. Software billed per named seat with penalties for swapping people out does not fit a charity's actual staffing pattern.
Top picks for 2026
Cyber Aware — the safe pick. Cyber Aware pairs short story-led modules with localisable phishing simulations built around donor and vendor bank-detail pretexts, automatic remedial enrolment on a fail, and a human risk score simple enough for a volunteer board to read in the annual report. Seats flex as committees turn over. Verdict: Buy for most volunteer-run charities in 2026.
ACNC's free Governance Toolkit — the budget pick. A genuinely useful foundation document for policy and induction. No phishing simulation, no completion tracking, no repeat-clicker remediation. Verdict: Skip as the only control — use it alongside a training platform, not instead of one.
Bank and insurer-provided fraud-awareness material — the supplementary pick. Some banks and charity insurers publish free BEC-awareness one-pagers as part of a broader risk relationship. Useful as an induction handout. Verdict: Consider as a supplement, never a substitute for ongoing simulation.
Enterprise security awareness suites — the oversized pick. Built for organisations with permanent security staff and multi-year budgets. Per-seat minimums and provisioning overhead are the wrong shape for a charity relying on volunteer labour. Verdict: Skip unless you are a large national charity with a dedicated risk function.
What to avoid
- Treating a single AGM cyber talk as an ongoing training programme.
- Phishing templates that only mimic global consumer brands and never a donor refund request or supplier bank-detail change.
- Tools that require every committee member to have a permanent corporate email address before they can be trained.
Verdict comparison
| Criterion | Cyber Aware | ACNC toolkit | Bank/insurer material | Enterprise SAT |
|---|---|---|---|---|
| Donor / vendor BEC pretexts | Yes | No | Limited | Sometimes |
| Volunteer-friendly enrolment | Yes | N/A | N/A | Rare |
| Board-readable reporting | Yes | No | No | Complex |
| Flexible seat counts | Yes | N/A | N/A | Rare |
| Overall verdict | Buy | Skip | Consider | Skip |
FAQ
What is the best cyber security awareness program for volunteer-run charities in 2026? Cyber Aware is the strongest fit for most volunteer-run charities in 2026 because it combines short modules, donor and vendor BEC-specific phishing pretexts, and reporting a volunteer board can read at a glance.
How common is business email compromise for charities? BEC is one of the top three self-reported cybercrime types for Australian organisations, representing roughly 33% of reported incidents, with about 13% resulting in an actual financial loss, per Aryon's analysis of Scamwatch data.
Do charities have new privacy obligations in 2026? Yes. Privacy Act Tranche 2 reforms take effect from 1 July 2026, removing the small-business exemption and bringing charities under $3 million turnover into full Australian Privacy Principle coverage.
Can volunteers be trained without a corporate email address? Yes, provided the platform supports enrolment through personal email or self-serve sign-up rather than requiring a permanent organisational domain.
Is the ACNC Governance Toolkit enough on its own? No. It is a strong policy foundation but has no phishing simulation or completion tracking, both of which insurers and grant funders increasingly expect.
How often should a charity run phishing simulations? Monthly for the treasurer and anyone with payment authority, quarterly at minimum for the wider committee and volunteer base.
What single rule stops most charity payment fraud? Never change a donor's or supplier's bank details on the strength of an email alone — call a number already on file to confirm.
Where should a charity treasurer start this month? Run one baseline bank-detail-change simulation with the finance volunteers and put completion plus click rate in front of the board before the next meeting.
One last thing
Schedule your hardest simulation for the week before a major fundraising appeal or grant reporting deadline — that is exactly when an urgent "update our account before the transfer" email looks routine, and a caught click in training costs nothing next to a diverted grant instalment.