Church Defense · General guidance for leadership discussion
Why the Request Deserves a Pause
A familiar name in an email does not establish who is asking. A request to change a vendor’s bank details, reroute payroll, or send an urgent payment should receive a separate check.
Make independent verification part of the process so the person handling the request does not have to decide whether to be suspicious.
Use a Contact You Already Trust
Call the person using a number already on file or obtained through an established independent channel. Do not rely on the phone number or link supplied in the change request.
Document who confirmed the change and which approver authorized it. Keep the record in the appropriate finance system without copying unnecessary account information into email.
Walk Through a Fictional Request
Ask your finance team how it would handle a pretend urgent request from the senior pastor or a familiar vendor. Use fictional details and do not move money.
Identify where the process depends on memory, personal confidence, or a single person. A clear backup approver helps the process continue during absences.
Further reading: CISA guidance on recognizing and reporting phishing.
Apply these questions with the people responsible for your systems. An assessment can help turn them into a prioritized plan for your church.