Churches, mosques, synagogues, temples, gurdwaras and other places of worship run on trust, volunteers and small budgets, and fraudsters exploit all three: they impersonate clergy to extract gift cards, hijack live stream and social accounts, and target the membership lists, giving records and safeguarding files that congregations hold. This guide covers the risks that are specific to worship communities rather than charities in general: special category data about religious belief, Gift Aid and donation records, volunteer-run rotas and AV desks, live streaming of services, and building systems such as cameras and door entry. It is written for clergy and faith leaders, trustees, parish or congregation administrators, treasurers and the volunteers who look after the website, the stream and the office computer. For the general charity baseline (regulators, priority controls, high-risk advocacy organisations), see the Cybersecurity for Charities and Non-Profits Guide.
Key takeaways
- Membership data is special category data. A list of members of a religious body reveals religious belief, so UK GDPR Article 9 applies, and the not-for-profit condition only covers members, former members and people in regular contact, with no disclosure outside the body without consent.
- Clergy impersonation is the signature scam. Fraudsters email or message congregants in a leader's name asking for urgent gift cards or transfers; the fix is a published rule that leaders never ask for money this way, plus a verified reporting route.
- The live stream is an identity, not just a camera. Channel logins, stream keys and the social pages around them are credentials that outlast the volunteer who set them up, and a hijacked channel reaches every follower at once.
- Donations create three separate data sets. Card readers and online giving fall under payment card rules, Gift Aid declarations must be kept for years with a full audit trail, and envelope or standing order records link names to giving.
- Safeguarding records need the tightest access. Concerns, referrals and vetting records about children and adults at risk should never sit in the shared office drive or a volunteer's personal email.
Why worship communities face a distinct risk
A place of worship looks like a small charity, but its data and people change which controls matter most.
| Feature | Why it matters for security | What it changes |
|---|---|---|
| Religious affiliation in every record | Membership rolls, electoral rolls, attendance and pastoral lists reveal belief, which is special category data under UK and EU GDPR Article 9 | Tighter access, data minimisation, care before sharing lists with other bodies or suppliers |
| Public, trusted leaders | Names and photographs of clergy are on the website and noticeboards, and congregants respond quickly to a request that appears to come from them | Impersonation scams succeed; a standing "we will never ask" message is the main defence |
| Volunteer operations | Treasurers, safeguarding officers, AV teams, rota coordinators and website editors change often and use personal devices and email | Named accounts, joiner and leaver steps tied to the rota, shared credentials kept in a password manager |
In the US, CISA treats houses of worship mainly as a physical security problem (a security self-assessment, "Protecting Places of Worship: Six Steps" and Physical Security Performance Goals for Faith-Based Communities) and points communities to the Faith-Based Information Sharing and Analysis Organization (FB-ISAO), which shares information on cyber issues. The 2024 civil society guidance from CISA, the FBI, the UK NCSC and partners lists faith-based organisations among groups targeted by state-sponsored actors; communities with a diaspora, refugee or campaigning profile should read it.
Threat picture
Recurring threats, mapped to ATT&CK v20 and the control that does most to break each.
| Threat | How it plays out | ATT&CK | Primary control |
|---|---|---|---|
| Clergy impersonation | Email from a free webmail address or lookalike domain in the leader's name asks a congregant for gift cards for "someone in need" | T1583.001 Domains; T1657 Financial Theft | Published "never by email" rule, DMARC on the real domain, verified reporting address |
| Office mailbox takeover | Administrator's account phished, then used to message the whole congregation or to change supplier bank details | T1566.002 Spearphishing Link; T1078 Valid Accounts; T1534 Internal Spearphishing | MFA on every mailbox, alerts on new forwarding or hiding rules (T1114.003, T1564.008) |
| Live stream or social page hijack | Channel or page taken over through a phished volunteer login or leaked stream key, then used for scam broadcasts or deleted | T1586.001 Social Media Accounts | Organisation-owned accounts, MFA, at least two administrators, stream key rotation |
| Ransomware on the office computer | Single shared PC holding the membership database, Gift Aid records and minutes is encrypted | T1486 Data Encrypted for Impact | Cloud storage with version history, separate backup, no daily admin use |
The impersonation pattern is well documented. In 2018 the Georgia Attorney General's Consumer Protection Division warned that parishioners of several Catholic churches had received emails using their pastor's name but a fake address, asking for emergency donations in the form of iTunes gift cards to be mailed elsewhere. The FTC's guidance is direct: anyone who tells you to buy a gift card and give them the numbers is a scammer, and anyone who has already done so should contact the card company at once, ask for a refund, keep the card and receipt and report it. See the Impersonation Scams Guide and the Charity and Disaster Scams Guide.
Membership, pastoral and safeguarding data
The ICO explains that Article 9(2)(d) lets a not-for-profit body with a religious aim (the ICO names churches) process special category data in its legitimate activities with appropriate safeguards, provided the data relates solely to members, former members or people in regular contact with it, and is not disclosed outside the body without consent. It does not cover employees or prospective members. There is no necessity test, but the ICO suggests safeguards such as restricted access, shorter retention and an opt-out.
- Know which list is which: keep the membership roll, pastoral list (often with health details), giving records, safeguarding file and mailing list separate; each has its own audience and retention.
- Do not share lists casually: sending the membership list to another body or a neighbouring congregation is a disclosure outside the body; confirm consent or another basis first, and use data processing agreements with suppliers such as printers and mailing platforms.
- Safeguarding records: keep concerns, referrals and vetting results in a restricted location that only the safeguarding lead and named deputies can open, never in personal email or a shared folder. Follow the safeguarding policy of your denomination or umbrella body on retention.
- Retention: the data protection principle is that information is kept only as long as necessary. Write a retention schedule that covers lapsed members, closed pastoral cases, old rotas and recordings, then delete on schedule. See the Data Retention and Disposal Policy Template.
Donations, Gift Aid and payment security
Giving now spans card readers, QR codes, online pages, standing orders and text giving, each with its own exposure.
| Channel | Data and risk | Control |
|---|---|---|
| Contactless card reader at the door | Card data handled by the reader and its provider; lost or tampered devices | Use a reputable payment provider, keep the device registered to an organisation account, store it securely between services, never write down card numbers |
| Online giving page or QR code | Fake QR stickers or cloned pages redirect donors to fraudsters | Hosted payment page from the provider, check printed QR codes before each service, publish the giving address on the official website only |
| Gift Aid declarations (UK) | Donor full name and home address, linked to every gift, kept for years | Access limited to the treasurer and Gift Aid secretary, backed up, retained and then deleted on schedule |
| Supplier and payroll payments | Invoice redirection by email from a "builder", "organist" or "diocese" | Verify any bank detail change by phone using a number already on file, two signatories for payments |
HMRC's charity guidance (Chapter 3, Gift Aid) sets the records that make Gift Aid data sensitive and long lived. A declaration needs the donor's name, a full home address (for UK addresses, a house number or name plus postcode is acceptable), the charity's name, the gifts covered, confirmation they are Gift Aid donations and an explanation of the donor's tax position. The charity must keep an audit trail linking each donation to an identifiable donor with a valid declaration, and an auditable record that the donor actually made the declaration. Charitable companies keep records until six years after the end of the accounting period they relate to, trusts until the later of six years after the tax year or 12 months after the claim, and enduring declarations are kept while donations continue. The Gift Aid file is therefore one of the longest held data sets in a congregation. Card payments bring PCI DSS obligations; using a provider's hosted page and certified readers keeps scope small. See the PCI DSS SAQ Types and the Business Email Compromise Awareness for Finance Teams Guide.
Live streaming and recorded services
Streaming often runs on a setup one volunteer built quickly. It raises two issues: the people on camera and the accounts that publish the stream.
People on camera
The Church of Scotland's live streaming guidance treats images of attendees sent to third parties as sensitive personal data. It recommends publishing filming dates in advance so people can opt out, a standing note in the service sheet on which areas cameras cover, a spoken welcome to those online, signage at entrances and covered areas, and consent from parents or carers before children and adults at risk appear, with cameras angled away otherwise. The Diocese of Oxford adds: avoid close-ups of the congregation, consider fading to an image during communion or prayer, agree recording of funerals with the family, and say how long recordings are kept and where.
Accounts, keys and equipment
- Organisation ownership: the channel and social pages should belong to an organisation account, not a volunteer's personal profile, with at least two trusted administrators so access survives a departure.
- MFA on every administrator: use an authenticator app or security key rather than SMS where the platform supports it, and record recovery codes in the password manager.
- Stream keys are secrets: a stream key lets anyone broadcast to your channel. Keep it in the password manager, not on a sticky note at the AV desk, and regenerate it when an AV volunteer leaves or a laptop is lost.
- The AV laptop: a dedicated device with a standard user, automatic updates and no personal browsing; moderate live chat and block links from unknown users.
- Recordings: set the platform's default visibility deliberately, set an expiry for recordings that show identifiable congregants, and delete funeral and wedding recordings when the agreed period ends.
See the CCTV and Video Surveillance Privacy Guide for the wider data protection rules on cameras.
Volunteers and where identity fits
Almost everyone with access is a volunteer, so access should follow the role on the rota, not whoever set something up years ago.
| Role | Typical access | Minimum identity control |
|---|---|---|
| Clergy and faith leader | Mailbox, pastoral notes, membership system | Organisation mailbox with phishing-resistant MFA; no use of personal email for congregational business |
| Treasurer and Gift Aid secretary | Bank, giving platform, Gift Aid records | Named bank logins, dual authorisation, MFA, access reviewed at each annual meeting |
| Safeguarding lead | Safeguarding file, vetting records | Restricted folder, MFA, named deputy with documented access |
| Administrator or office volunteer | Shared office mailbox, rotas, newsletter | Individual accounts with delegated access to the shared mailbox rather than a shared password |
| AV and streaming team | Streaming platform, social pages, AV laptop | Role based admin rights, stream key in password manager, removal when leaving the rota |
- Tie leavers to the rota: when someone steps down from a role, the same meeting that appoints the replacement removes the old access and rotates any shared secret.
- Shared credentials: unavoidable shared logins (an old door panel, an alarm app) go in an organisational password manager vault and change when a holder leaves.
- Integrations: giving platforms, membership databases, mailing tools and calendar systems are often connected by API keys or OAuth grants created by a volunteer. List them and revoke grants made by former volunteers.
See the Volunteer and Seasonal Workforce Access guide and the Non-Profit Identity Security Guide.
Building systems: cameras, door entry and Wi-Fi
Physical security investment often brings internet connected cameras, video doorbells, access panels and alarm apps into a building with no IT staff. Change default passwords at installation and record who holds each administrator login; put guest Wi-Fi for visitors and hall hirers on its own network away from the office computer, cameras and card readers; use the vendor's cloud viewing with MFA instead of opening router ports; apply firmware updates and replace unsupported devices. Footage is personal data, so set retention and restrict who can view and export it. See the IP Camera and CCTV Security Guide.
Incidents and reporting
Write a one page plan first: who decides, who calls the bank, who warns the congregation, who reports.
| Event | Report to | Basis and timing |
|---|---|---|
| Personal data breach likely to risk individuals' rights (UK or EU) | ICO or the lead supervisory authority; affected people where risk is high | UK and EU GDPR Articles 33 and 34, within 72 hours of becoming aware |
| Significant data breach, cyber crime or fraud in a registered charity (England and Wales) | Charity Commission serious incident report | Trustees responsible; as soon as reasonably possible; cyber crime "will usually be reportable" |
| Fraud or cyber crime (UK) | Report Fraud, stating you represent a charity, and get a crime reference | Charity Commission guidance; a Report Fraud report does not replace the Commission report |
| Gift card or impersonation fraud (US) | Gift card company, then ReportFraud.ftc.gov | FTC guidance; contact the card company immediately |
Congregations that are excepted or exempt from charity registration, or that sit under a separate regulator in Scotland or Northern Ireland, should confirm their reporting route with their regulator and umbrella body. The Charity Commission's guidance says that, as good practice, all charities should report serious incidents promptly regardless of size or income. See the Business Email Compromise Response Playbook.
Implementation roadmap
- Month 1, ownership and inventory: name a trustee or council member responsible for cyber and data, and list every account, device and data set: mailboxes, bank, giving platform, membership system, Gift Aid file, safeguarding file, website, stream and social accounts, cameras.
- Month 1, the "never" message: publish in the newsletter, website, service sheet and from the front that leaders will never ask for gift cards, transfers or giving by email, text or chat, and give one verified address and phone number for reporting.
- Month 2, lock the accounts: MFA on every mailbox, bank login, giving platform, stream and social administrator; move shared passwords into a password manager; give each volunteer a named account.
- Month 2, email authentication: publish SPF and DKIM for the congregation's domain and a DMARC record, starting at p=none to collect reports, then moving to quarantine and reject. See the DMARC, SPF and DKIM Guide.
- Month 3, data: separate the safeguarding file and Gift Aid records into restricted locations, write a retention schedule and delete what is past it. Test a restore of the membership and Gift Aid data.
- Month 3, streaming: transfer channel ownership to an organisation account with two administrators, rotate the stream key, put up signage and agree camera-free areas.
- Month 4, building systems and review: change default passwords on cameras and panels, separate guest Wi-Fi, and add an access review to every annual meeting. If MFA locks out a volunteer, use the recorded recovery codes rather than disabling MFA.
Decision guidance by size
| Community | Typical setup | Priorities |
|---|---|---|
| Small congregation, all volunteers | Personal email, one treasurer, free social page, phone-based stream | Move congregational business to organisation mailboxes, MFA, "never" message, password manager, organisation-owned social and stream accounts |
| Medium community with an office | Shared office PC, membership database, card readers, website, regular streaming | Everything above, plus cloud storage with version history, restricted safeguarding and Gift Aid folders, DMARC, AV laptop hardening, separated guest Wi-Fi |
| Large or multi-site community | Staff, IT provider, multiple sites, school or community centre, building access control | Everything above, plus an IT provider contract with security terms, conditional access, central logging of sign-ins, documented incident plan and annual exercise. See Choosing an IT Support Provider or MSP Securely. |
High-risk communities of any size should add the civil society guidance measures: phishing-resistant MFA, careful provider vetting and protection for leaders' personal accounts. UK congregations can then use the Cyber Essentials Guide as a benchmark.
Detection and measurement
A volunteer can check a few signals monthly: new forwarding or inbox rules, foreign sign-ins and MFA method changes on the office and clergy mailboxes; new administrators or regenerated stream keys on the channel and pages; broadcasts outside service times; payee bank detail changes; and every congregant report of an impersonation message, logged with date and sender.
| Metric | Target |
|---|---|
| Accounts with administrator or financial access protected by MFA | 100% |
| Departed volunteers whose access was removed within one week of leaving the rota | 100% |
| Shared passwords stored outside the password manager | Zero |
| Successful test restore of membership and Gift Aid data | At least once a year |
| Impersonation reports received and warnings issued to the congregation within 24 hours | All reports |
| Data sets past their retention date | Zero at the annual review |
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Named roles and trustee ownership | GV.RR-02 | PM-2 | A.5.2 Information security roles and responsibilities |
| Volunteer accounts and MFA | PR.AA-01, PR.AA-05 | AC-2, IA-2 | A.5.16 Identity management, A.5.18 Access rights |
| Awareness of impersonation scams | PR.AT-01 | AT-2 | A.6.3 Information security awareness, education and training |
| Backups and restore tests | PR.DS-11 | CP-9 | A.8.13 Information backup |
| Suppliers (giving, streaming, membership platforms) | GV.SC-05 | SA-9 | A.5.19 Information security in supplier relationships |
| Incident reporting | RS.CO-02, RS.MA-01 | IR-6 | A.5.24 Information security incident management planning and preparation |
Common failure patterns
- The channel belongs to a former volunteer. The stream or social page was created on someone's personal account; when they move away, the community cannot change settings or recover it after a hijack.
- Leaders use personal webmail. Congregants then cannot tell a fake address from the real one.
- The membership list is emailed around. Rotas and contact lists sent as attachments to whole groups spread special category data to personal inboxes with no way to recall it.
- Safeguarding notes in the shared drive. Concerns stored next to rotas and minutes are readable by every volunteer with drive access.
- Cameras still on default passwords. Security cameras installed to protect the building become an entry point and expose footage of worshippers.
Practitioner checklist
- Name a trustee or council member accountable for cyber and data protection.
- Publish the "leaders never ask for money by email, text or chat" message in every channel, with a verified reporting route.
- Give every leader and volunteer a named organisation account with MFA; remove access when they leave the rota.
- Move shared passwords and stream keys into an organisational password manager and rotate them on departures.
- Transfer stream and social accounts to organisation ownership with at least two administrators.
- Separate membership, pastoral, Gift Aid and safeguarding data, restrict access and set a retention schedule.
- Publish SPF, DKIM and DMARC for the congregation's domain.
- Back up the membership and Gift Aid data and test a restore each year.
- Put up streaming signage, agree camera-free areas and get consent for children and adults at risk.
- Change default passwords on cameras and door entry, and separate guest Wi-Fi from the office network.
Standards and references
- ICO: What are the conditions for processing special category data
- HMRC: Charities detailed guidance notes, Chapter 3 Gift Aid
- Charity Commission: How to report a serious incident in your charity
- CISA: Protecting Houses of Worship
- CISA and partners: Mitigating Cyber Threats with Limited Resources, Guidance for Civil Society
- Church of Scotland: Live streaming guidance, informing the congregation
- Diocese of Oxford: Filming in churches
- FTC: Avoiding and reporting gift card scams
Related NHI Mgmt Group resources: Cybersecurity for Charities and Non-Profits Guide, Non-Profit Identity Security Guide, Volunteer and Seasonal Workforce Access, Impersonation Scams Guide.