Common attack patterns and emerging AI risks, translated into ministry scenarios and concrete defensive practices. Use this guide to start a leadership discussion—and an assessment to understand your actual exposure.
AI can help criminals produce persuasive messages and imitate voices. Other attacks exploit account settings, software weaknesses, or ordinary process gaps. The right response combines secure configuration with staff who know how to verify, report, and escalate.
These are illustrative church scenarios, not a ranking of incident frequency or claims about attacks against a particular congregation. Controls must be configured for your actual systems; no single setting prevents every technique.
A polished message imitates a pastor, colleague, or trusted vendor and creates urgency around a payment, document, or account request.
Verify unusual requests through a known independent channel. Use a clear reporting process, safer email settings, and phishing-resistant sign-in methods where supported.
What is at stake: Misuse of staff trust, stolen sign-ins, or diverted church funds.
A convincing voice or video appears to come from someone in authority and asks staff to bypass a normal process.
Treat a familiar voice as insufficient verification. Call back using an established number and require an independent approver for sensitive changes.
What is at stake: Fraudulent transfers or disclosure of confidential information.
A deceptive sign-in, unexpected approval prompt, or malicious connected app can grant access to email and shared information. Device-code lures and other techniques can target authentication tokens rather than passwords.
Prefer phishing-resistant MFA; limit app consent and administrative privileges; review sign-in evidence; and prepare procedures to revoke access and investigate suspicious sessions.
What is at stake: A real church account becomes a platform for further fraud.
An intruder disrupts access to files or systems and may threaten to expose stolen information to pressure the church.
Maintain supported systems and endpoint protection, restrict privileges, separate critical networks, protect backups, and test recovery with an approved sample.
What is at stake: Interrupted ministry, recovery costs, and exposure of sensitive records.
A false bank-change request, compromised mailbox, or substituted giving link redirects money while appearing routine.
Use dual approval, independent callbacks, verified giving destinations, and review of administrator changes. Require the same controls even for senior leaders.
What is at stake: Loss of donations, payroll, or vendor payments.
Weak administrator access or neglected software gives an attacker control of ministry pages, messages, or donation destinations.
Secure and inventory administrators; keep software supported; document domain and account recovery; and restrict vendor access to what the work requires.
What is at stake: Fraudulent content, damaged credibility, and interrupted communications.
Excessive vendor access or an exposed connected system becomes an entry point into systems it should not be able to reach.
Inventory third parties and devices, separate guest and operational networks, use time-bounded access, and name owners for updates and recovery.
What is at stake: One weak connection creates a wider ministry problem.
Sensitive information can leave approved systems through a prompt or connected app. Untrusted content may also try to influence an AI assistant’s actions.
Approve tools and data use, minimize connector permissions, keep confidential records out of unapproved services, and require human approval for sensitive actions.
What is at stake: Unintended disclosure or unauthorized changes made through automation.
Do not let urgency override the normal approval or sign-in process.
Use a known number or established channel, and involve the required approver.
Contact your designated church or IT lead. If you already clicked or approved something, report that too.
Start with a clear view of your risks, a practical plan, and the right preparation for your people.