From time to time, churches hear from congregants who’ve received emails that look like they’re from a pastor or church leader—but aren’t. These messages are often designed to create urgency or pressure, hoping the recipient won’t stop to double-check.
While we don’t have direct control over individual email accounts, there are clear steps you can take to protect yourself and your church community.
Start by trusting your instincts. If something feels off, it probably is to don’t second-guess yourself.
Take a close look at the sender’s email address. Does it look slightly unusual? Check the “reply-to” address as well. If the reply-to doesn’t match the sender, or if it’s a personal email address you don’t recognize (and you didn’t submit a form on the church website), that’s a red flag. Instead of replying, contact the pastor or leader directly using a phone number or email address you already trust and ask whether they actually sent the message.
Next, compare the email address and any links in the message with your church’s official website. Even small differences—extra letters, missing dots, or odd domains—are worth questioning.
When in doubt, pause and verify. Email or call your pastor, staff member, or the church office directly and ask if the message is legitimate. A quick check can prevent a big problem.
If the email mentions money, gift cards, bank details, or financial urgency, take extra care. Double-check with your financial institution and make sure two-step verification is enabled on your accounts so no one else can access them easily.
If you’ve already clicked a link, shared information, or sent money, act quickly. Contact your bank immediately and change your passwords for any financial accounts. Let your church know what happened, and consider notifying local authorities. And most importantly—don’t feel embarrassed. This happens to people every day, and it’s okay.
If you believe your email account has been directly compromised, change your password immediately.
Contact your IT support (or whoever manages your technology) right away so they can help secure accounts and look for any further issues.
Then, start gathering information. Make a list of people who’ve contacted you about suspicious emails. Search their email addresses online to see if they appear anywhere on your church website especially in PDFs. Outdated or publicly visible email addresses are a common source for spoofing.
If you find an email address listed on a webpage, remove it and replace it with a contact form instead. Using a Staff plugin can make this easy and it’s useful not just for staff, but also for volunteers, leaders, and deacons.
Be aware that even if an email address isn’t visibly written out, it may still be embedded in the page code if a name is linked to an email. In those cases, the safest option is to link to a staff profile or a contact form instead.
If the issue involves a PDF such as a member directory take these steps:
If you discover that many files need protection, reach out to us about setting up a member-only system for your website.
For pastors and staff using generic email addresses like @gmail.com or @yahoo.com, consider switching to email addresses that match your church’s domain. Both Microsoft 365 and Google Workspace offer free nonprofit plans, and domain emails are harder to spoof convincingly.
If someone is impersonating you using a Gmail address, report it directly to Google at https://support.google.com/mail/contact/abuse.
Finally, if an email seems especially harmful or malicious, contact your local authorities. They can escalate the issue to agencies that track large-scale spoofing and spam activity.
Staying cautious, communicating openly, and acting quickly make a huge difference. You’re not alone in this—and taking these steps helps protect the whole church community.
Copyright © 2008 - 2026. Worship Times. All rights reserved.
