Guides · About 60 minutes · Updated draft Oct 2026

The first hour after a pastor-impersonation gift-card scam

Someone is texting or emailing your congregation as the pastor, asking for gift cards or “urgent help.” Most of the time this is spoofing (faked caller ID or look‑alike email), not a hack of your church network. Still: move calmly, warn people fast, and rule out a real mailbox compromise.

Goal of hour one: stop further loss, tell the congregation clearly, decide if email is merely spoofed or actually compromised, and write down what you saw.

0–10 minutes: stabilize

Call the real pastor (voice call) and confirm they did not send the messages.
Ask whoever reported it for: screenshots, the exact phone number or email address shown, times, and whether anyone already bought cards or sent money.
If money or cards were already sent: preserve receipts and screenshots; do not send more; help them contact their bank/card issuer and file reports (steps below).
Do not reply to the scammer, click links they sent, or argue in the thread.

10–25 minutes: warn the congregation

Send one clear message on every channel you already use (email list, Church Management System text blast, Facebook page, group chat). Pastors often reuse this wording:

SECURITY NOTICE FROM [CHURCH NAME]

Someone is impersonating Pastor [Name] by text/email and asking for gift cards or money. Pastor [Name] did NOT send those messages.

We will NEVER ask you to buy gift cards, send cash, or share codes by text or email.

If you got a message like this:
1) Do not reply or click links.
2) Do not buy cards or transfer money.
3) Tell [volunteer/staff email or phone].

If you already sent money or cards, contact your bank right away and tell us so we can help with reports.

— [Your name], church tech volunteer

Have the pastor say the same line from the platform on Sunday if the timing fits.

25–45 minutes: spoofed vs compromised

Use this fork. It changes what you do next.

A) Looks like spoofing (most common)

Texts show the pastor’s number but the pastor’s phone has no sent messages.
Emails come from a look‑alike address (pastor.name1@gmail.com, extra letters, wrong domain) or a free webmail account.
Your church Microsoft 365 / Google Workspace sign‑ins look normal.

Actions: congregation warning is the main fix. Remove staff emails from the public website where you can (use a contact form). Add a standing footer to church email: “We will never ask for gift cards.” Review whether the pastor’s personal cell is published widely.

B) Looks like a real mailbox compromise

Messages come from the pastor’s real church address and show in Sent Items.
New inbox rules, forwarding, or weird delegates appeared.
Unusual sign‑ins in Microsoft Entra / Microsoft 365.

Actions (Microsoft 365):

Have the user sign out everywhere you can; reset the password from another admin account.
In the Microsoft 365 admin center, review the user’s sign‑in activity and revoke sessions if available.
Check Outlook inbox rules and forwarding (delete unknown rules; remove external forwarding).
Turn on / confirm Security Defaults or MFA so the attacker cannot stay in. See our companion guide: Lock down Microsoft 365 nonprofit in 90 minutes.
Review recent Sent mail for other victims; warn them.

Official MFA overview: Multifactor authentication for Microsoft 365.

45–60 minutes: report and leave a paper trail

Anyone who lost money: report at reportfraud.ftc.gov and consider an IC3 report at ic3.gov (complaint choice: IC3 complaint).
Save a folder: screenshots, warning email you sent, times, who was affected, whether M365 was clean or compromised.
Tell church leadership (elder board / finance) in one short written summary the same day.

Phishing refresher for volunteers: CISA’s plain guidance on recognizing phishing is here: Recognize and report phishing and Avoiding social engineering and phishing attacks.

Copy-paste: Sunday bulletin / newsletter blurb

Reminder: Scammers sometimes pretend to be our pastor by text or email and ask for gift cards.
Pastor [Name] will never ask you for money, gift cards, or codes that way.
If something feels urgent and secret, call the church office to verify.

Done checklist

Pastor confirmed messages were not theirs (voice call) Congregation warned on primary channels Spoof vs compromise decided; M365 checked if needed Victims pointed to bank + FTC/IC3 reporting Evidence folder + leadership note saved Standing “we never ask for gift cards” notice planned for ongoing newsletters

This guide is educational, not legal advice. If minors’ data, counseling notes, or significant funds are involved, loop in church leadership and counsel promptly.