For most nonprofits, the months between now and year-end decide the budget. Appeals go out, event invitations circulate, volunteer rosters swell, and donation pages see more traffic in eight weeks than the rest of the year combined. Every one of those things is also a scam opportunity — and criminals plan their calendar around yours.
The uncomfortable part is that giving-season fraud usually doesn't target your systems at all. It targets your donors, using your name, at the exact moment they're primed to give. You may not even learn about it until a supporter calls to ask why their gift never showed up on their statement — or why it did, twice.
The three that surface every fall
- The lookalike appeal. An email or social post copying your branding and language, pointing to a donation page that isn't yours. Often it goes to your public supporter list, scraped from your own newsletter or event page.
- The executive request. A message appearing to come from your executive director or board chair, asking a staff member to move money, buy gift cards for an event raffle, or share the donor list — urgently, quietly, usually late in the day.
- The vendor banking change. Your caterer, printer, or auction platform suddenly emails new remittance details right as event invoices come due. This one costs the most per incident, because nonprofit event budgets move real money fast.
The August prep list
Almost none of this is expensive, and all of it works better before the appeals go out:
- Publish one giving path and repeat it everywhere. One donation URL, printed in every appeal, on every social post, on your voicemail. When donors know the address, imitations become obvious.
- Lock down your email domain. Correct authentication records make it substantially harder for anyone to send mail that appears to come from your organization — the single highest-leverage technical fix before a fundraising push.
- Set a verbal-verification rule for money movement, in writing. Any banking change or unusual payment request gets confirmed by phone on a known number. Tell staff the ED will never be annoyed by that call.
- Require MFA on email, your donor CRM, and your payment platform — especially for the seasonal volunteers and temporary staff you're about to onboard.
- Give volunteers access by role, and set an end date. Giving season is when access sprawls fastest; it's the reason we wrote about the annual access reset.
- Brief the team on the three scams above before the busy weeks start. Ten minutes now beats a wire transfer in November.
Tell your donors what to expect
Add two sentences to your first appeal: this is the only address where we accept gifts, and we will never ask you for payment details by email or text. It costs nothing, it protects the people who fund your mission, and it quietly signals that your organization takes stewardship seriously — a message funders and insurance carriers increasingly want to hear too.
Before your first appeal goes out, settle three things: the single giving URL, the verbal-verification rule for any payment change, and MFA on every account touching donor or financial data. Our free nonprofit IT assessment includes a review of your email authentication and payment protections — findings are yours either way.
Your donors are about to be more generous and more distracted than at any other point in the year. A little clarity now — one giving page, one verification habit, one honest note to supporters — protects both the revenue and the trust your mission runs on.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →