Security awareness training for churches and religious organisations is a lightweight program that trains staff and key volunteers to recognise and report scams and phishing, with the aim of protecting donations, member records and the organisation's bank account. What makes the segment different: most of the work is done by volunteers who rotate, money moves on trust and verbal authority, and the treasurer is often the only person who touches the bank account — which makes a single convincing email a whole-of-organisation risk.
TL;DR
- Churches run on volunteers and trust; scammers exploit both with fake supplier invoices and urgent payment requests.
- The treasurer and office administrator are the highest-risk roles — payment redirection targets them directly.
- Priority topics: fake invoice fraud, payment redirection, donation-page phishing, and fake minister or elder requests.
- Train a small core group monthly for 5 minutes each rather than the whole congregation annually.
- Keep completion and simulation evidence for insurers; church insurers increasingly ask about cyber controls.
Why churches and religious organisations are targeted
Churches hold a combination attackers look for: money that moves on verbal authority, a lean administrative team, and volunteers who may not know each other's email habits. The pattern that recurs in Australia is payment fraud — a fake invoice for building maintenance, or an email that appears to come from the minister asking the treasurer to pay a supplier urgently. Scamwatch statistics show payment redirection and false-billing scams rank among the costliest categories reported by Australian businesses and community organisations. Member and donor records add a privacy duty: an organisation covered by the Privacy Act must report notifiable breaches, and many states' privacy laws reach religious organisations that hold sensitive personal information.
The four roles that carry the risk
- The treasurer. Moves money, approves payments, and is the direct target of fake supplier invoices and urgent payment requests.
- The office administrator. Holds the member database, the email account scammers impersonate, and the calendar everyone trusts.
- The minister or senior leader. Their name carries authority; attackers imitate it. Leaders also need training on what their impersonation looks like from the inside.
- Rotating volunteers. They handle money counting, catering invoices and communications rosters, and they change every few months — which is why an annual training day misses them.
The five training topics that matter most
- Fake invoices and false billing. Building maintenance, AVL equipment, cleaning services. The rule: any new or changed bank details get a phone call to a number already on file, not the number in the email.
- Payment redirection. An urgent email that looks like it came from the minister or an elder. The rule: verbal confirmation for anything urgent, and no payment moves on one email alone.
- Donation and giving-platform phishing. Fake emails about failed donations or updated giving details. The rule: navigate to the giving page yourself, never through the email link.
- Credential hygiene on shared accounts. Many churches share an office@ or info@ mailbox. Train whoever uses it on reporting and on why shared accounts need MFA.
- Vishing and cold calls. Callers claiming to be from the bank, the diocese or an IT provider. The rule: hang up and call back on a known number.
A monthly 5-minute cadence for a small team
A church does not need an enterprise program; it needs a habit. The cadence that holds:
| Month | Activity | Who |
|---|---|---|
| 1 | Micro-course: fake invoices and false billing | Treasurer, admin |
| 2 | Phishing simulation: fake supplier invoice | Treasurer, admin, leaders |
| 3 | Micro-course: payment redirection and urgent requests | Treasurer, admin, leaders |
| 4 | Micro-course: donation phishing and giving platforms | Admin, comms volunteers |
| 5 | Phishing simulation: urgent request from the minister | Treasurer, admin |
| 6 | Micro-course: shared mailbox and password hygiene | All mailbox users |
| 7-12 | Repeat the rotation with new examples; keep it to 5 minutes each | Same groups |
Two practical rules keep this alive: volunteer turnover means enrolment must be automatic whenever someone takes a roster role, and every session ends with the same question — who would you call to check?
Getting the whole organisation on board
The training lands when the senior leader does it first. A minister or senior pastor who completes the same modules and mentions a scam example in a team meeting changes the culture more than any policy document. Two more levers: put the callback rule on a printed card next to the office phone, and add one line to the bulletin or newsletter each quarter about a current scam — it reaches the congregation, and it reminds staff that reporting is expected, not embarrassing.
Evidence for insurers and the board
Church insurers increasingly ask about cyber controls when pricing policies, and a board or elders' meeting will ask what the organisation actually does about scams. Keep three artefacts: a simple written policy (who approves payments, when a second check is required), monthly completion records for the trained group, and any simulation results. A platform that auto-enrols new volunteers and keeps the evidence trail removes the admin burden from whoever is already doing three jobs. See how security awareness training scales down to small teams and what human risk reporting gives a board.
Common mistakes
- One training day a year. Volunteer turnover outruns it; half the current roster was not there.
- Training only staff, never the treasurer's backup. The person who covers leave is often the one who has never seen the callback rule.
- Assuming the congregation is not a risk surface. Fake giving emails and event-scam pages reach members through the church's own channels.
- Shared mailboxes without MFA. One compromised shared account exposes years of correspondence and payment histories.
- No written payment policy. The callback rule only works when it is written down and applied to everyone, including the minister.
FAQ
Why would scammers target a church? For the same reasons they target any small organisation that moves money on trust: a lean admin team, verbal authority, and bank details that change without much scrutiny. Payment fraud, not data theft, is the most common loss.
What is the most important training topic for a church treasurer? Payment redirection and fake invoices: any new or changed bank detail is verified by phone on a number already on file, and no urgent email request is paid without verbal confirmation.
How often should church staff and volunteers train? A 5-minute monthly session for the small core group — treasurer, administrator, leaders and key volunteers — with new volunteers auto-enrolled when they take a roster role.
How do you train volunteers who rotate? Automatic enrolment at onboarding and short mobile-friendly modules. An annual training day cannot keep up with volunteer turnover.
Do churches need to comply with the Privacy Act? Organisations covered by the Privacy Act that hold personal information must assess and report notifiable data breaches; states have their own regimes for some entities. Member and donor records make this a real exposure regardless of size.
What evidence should a church keep for insurers? A written payment policy, monthly completion records for the trained group, and any simulation results. Insurers and boards ask what is done, not what is intended.
One last thing
The single cheapest control for a church is the callback card: a printed instruction next to the office phone that says any change to bank details, or any urgent payment request, gets a phone call to a number already on file. It takes ten minutes to make, costs nothing, and defeats the scam pattern that costs community organisations the most money.