Learn how to detect identity-spoofing emails and texts and protect against them. (Photo Courtesy of General Council on Finance and Administration)
General Council on Finance and Administration | Feb. 18, 2026
Across the country, churches and ministries are seeing a troubling rise in identity spoofing scams—particularly those that impersonate pastors or other trusted church leaders. These scams often arrive as emails or text messages that appear to come directly from a pastor and urgently request gift cards, financial assistance, or sensitive information. In many cases, congregants and staff come dangerously close to falling victim before realizing the message is fraudulent.¹
This is not an isolated issue affecting only a few congregations. Reports from faith-based publications, church accountability organizations, and news outlets show that pastor impersonation and phishing scams are a common challenge facing churches, ministries, and faith-based organizations nationwide. Cybersecurity experts note that churches are frequently targeted because of their culture of trust, publicly available contact information, and limited technical safeguards.² ³
How Pastor Impersonation Scams Work
Cybercriminals often:
- Spoof a pastor’s name or email address
- Use urgent or emotional language (“I need your help right now”)
- Request gift cards, wire transfers, or confidential information
- Target staff and trusted congregants who want to respond quickly and helpfully
- Because these messages appear to come from familiar leaders, they can be especially convincing.
Practical Steps Churches Can Take Right Now
Church leaders can significantly reduce risk by putting a few clear safeguards in place:
Use Official Church Email Accounts Only. Pastors and staff should communicate using official church email addresses (for example, pastor@yourchurch.org), rather than personal Gmail or other consumer accounts.
Set Clear Communication Expectations. Educate staff and congregants on how pastors and leaders will—and will not—communicate. Make it clear that pastors will never request gift cards, money transfers, or sensitive information via email or text.
Enable Multi-Factor Authentication (MFA). All church email accounts, especially those of pastors and administrators, should use multi-factor authentication to prevent unauthorized access.
Strengthen Email Security. Advanced email filtering tools can help block spoofed and malicious messages before they ever reach inboxes.
Encourage Cyber Awareness. Remind staff and members to:
- Scrutinize unexpected emails or texts
- Avoid clicking suspicious links or attachments
- Use strong, unique passwords
- Disable unused Bluetooth and Wi-Fi connections on mobile devices
Mobile Devices Matter, Too. Guidance from Church Mutual, a valued partner of the United Methodist Insurance Program, highlights how unsecured mobile devices can enable email compromise and impersonation—making mobile security a critical part of church cybersecurity efforts.⁴
Training and Support for Churches. Churches do not have to navigate these challenges alone. GCFA/UMC Support provides resources as part of ongoing efforts to support local ministries:
- Security Awareness Training: A recent webinar, Digital Stewardship: Protecting Your Church Online, offers practical guidance tailored specifically for churches.
- Managed IT Services: Through the General Council on Finance and Administration, local churches can access technology managed services designed for ministry settings.
- Technology Value Pack: The UMC Support Tech Value Pack provides three levels of cybersecurity protection—affordable, scalable, and built with churches in mind. Learn more at gcfa.org/tech-value-pack.
Faithful Stewardship in a Digital World
Protecting your church’s digital identity is not just a technical issue—it is a matter of trust, stewardship, and care for your congregation. By setting clear communication practices, strengthening security tools, and using trusted partners and resources, churches can reduce risk and respond confidently to a growing threat.
Footnotes / References
Christianity Today reporting on the rise of pastor text and email impersonation scams, including fraudulent gift card requests sent to congregants and church staff across multiple denominations and regions.
MinistryWatch analysis documenting an increase in phishing and impersonation attacks targeting churches and faith-based nonprofits, noting that clergy impersonation is a common tactic due to trust-based church environments.
Regional and national news coverage documenting clergy impersonation and gift card scams affecting churches in multiple U.S. states, demonstrating that these incidents are not isolated or localized.
Church Mutual, Are Your Mobile Devices Secure Enough to Protect Client Health Information? Guidance outlining how unsecured mobile devices can expose churches and ministries to cyber risks, including unauthorized email access, spoofing, and data compromise.
Sharon Asmus is Chief Information Officer and Rob Jett is Technology Services Manager for the General Council on Finance and Administration. This article is republished with permission from GCFA's website.