Wire Fraud and Gift Card Scams Targeting Nonprofit Finance Staff
Nonprofits make attractive targets for fraud, and not because anyone in the sector is careless. Small finance teams, public staff directories, tight deadlines, and a strong culture of helpfulness combine to create exactly the conditions criminals look for. A bookkeeper who wants to be useful, an executive director who travels often, and a board that meets monthly rather than daily leave gaps that scammers know how to exploit. The most common attacks are surprisingly low-tech.
Someone sends an email that looks like it came from the boss, asks for an urgent payment or a stack of gift cards, and applies just enough pressure to stop the recipient from checking. A single successful nonprofit wire fraud scam can drain restricted funds, blow a programme budget, and force painful conversations with funders and auditors. The encouraging part is that most of these attacks fail against organisations with a few simple habits in place.
Why Do Scammers Target Nonprofit Finance Staff?
Criminals choose targets based on opportunity, and nonprofits offer several. Staff names, titles, and email addresses are often published on websites, annual reports, and grant applications, which makes it easy to work out who authorises payments and who processes them. Form 990 filings are public, showing revenue, key personnel, and compensation details that help a scammer sound convincing. Many organisations run lean finance operations where one person handles banking, payables, and payroll, so there is nobody to double-check unusual requests. Cultural factors play a part too.
Nonprofit staff are generally trained to be responsive and accommodating, and hierarchy can discourage junior employees from questioning a message that appears to come from the executive director or board chair. Add seasonal pressure around grant deadlines, campaign launches, and year-end giving, and you have moments when people are rushing. Scammers time their attacks for exactly those periods, and their messages often arrive on a Friday afternoon or just before a holiday.
What Is Business Email Compromise?
Business email compromise, usually shortened to BEC, is the umbrella term for attacks where criminals use email impersonation to trick someone into sending money or sensitive information. The FBI’s Internet Crime Complaint Center has repeatedly ranked BEC among the costliest categories of cybercrime, with reported losses running into billions of dollars each year across all sectors. There are two main approaches.
In spoofing, the attacker creates an email address that looks almost identical to a real one, perhaps swapping a letter or using a similar domain, so a quick glance does not reveal anything wrong. In account compromise, the attacker actually gains access to a genuine mailbox, often through a stolen password, and sends messages from the real address. Account compromise is far more dangerous because the email is authentic, the writing style matches, and the attacker can read past conversations to make their request fit perfectly. Many nonprofits only discover the breach weeks later, when a vendor asks why an invoice was never paid.
Why Do Gift Card Scams Work So Often?
Gift card requests seem almost too simple to succeed, yet they remain one of the most common attacks on nonprofits. They work because the amounts feel small, the reason sounds plausible, and the request comes from someone staff want to help. A typical message says the executive director is stuck in a meeting, needs cards for a volunteer thank-you or a staff appreciation gift, and asks the employee to buy them and send photos of the codes, promising reimbursement later.
The scam is built around three pressures: urgency, authority, and privacy. Staff are told it is time-sensitive, that it comes from a senior person, and that it should be kept quiet as a surprise. Because gift cards are effectively untraceable once the codes are shared, the money is usually gone within minutes. Losses often land between a few hundred and several thousand dollars, and employees frequently pay from their own accounts first, which makes the experience personally distressing as well as costly for the organisation.
How Can Staff Recognise a Fraudulent Request?
Most scam messages share a handful of tells, and training staff to notice them is the cheapest protection available. Watch for these signals:
- Urgency and pressure, such as “I need this done in the next hour” or “this cannot wait.”
- Requests for secrecy, especially phrases like “do not mention this to anyone yet.”
- Changes to payment details, including new bank accounts, wire instructions, or deposit information.
- Email-only contact, where the sender avoids phone calls or meetings.
- Slightly wrong addresses, with extra letters, swapped characters, or unusual domains.
- Unusual tone or phrasing that does not match how the person normally writes.
- Requests sent at odd times, such as late Friday or during a holiday period.
- Reply-to mismatches, where the reply address differs from the sender address.
None of these signs alone proves fraud, but two or three together should stop the process immediately. Staff should feel completely comfortable pausing a payment to check, and leadership needs to say so clearly and often.
What Controls Prevent Nonprofit Wire Fraud?
Good internal controls stop most attacks even when someone is fooled by the email itself. The strongest single control is out-of-band verification, which simply means confirming the request through a different channel using contact details you already hold, never the ones in the message. A quick call to a known number defeats nearly every nonprofit wire fraud scam. Around that, build a few structural safeguards. Require two authorised people to approve payments above a set threshold, and make sure the person who requests a payment is not the person who releases it.
Set a written rule that bank account changes for vendors or employees are only accepted after a verbal confirmation with a known contact, followed by a short waiting period. Keep wire transfer limits low and review them regularly. Reconcile bank accounts frequently rather than monthly, so unusual activity surfaces quickly. Finally, write these rules down and apply them to everyone, including the executive director and the board. Fraudsters rely on the idea that rules bend for senior people.
What Technical Protections Should Nonprofits Have?
Technology cannot replace good habits, but it removes a lot of easy openings. The most important step is multi-factor authentication on every email account, because stolen passwords are how most mailbox compromises begin. Beyond that, a few measures make impersonation much harder. Email authentication records such as SPF, DKIM, and DMARC help stop others from sending messages that appear to come from your domain, and most email providers offer guidance on setting them up.
External sender warnings, which add a banner to messages from outside your organisation, give staff a visual cue when a supposedly internal email actually came from elsewhere. Register similar domain names where affordable, so lookalike addresses are harder to create. Keep software and devices updated, restrict who has access to banking systems, and review those permissions when people change roles or leave. Regular password changes matter less than strong, unique passwords stored in a password manager, combined with multi-factor authentication everywhere it is available.
How Should You Train Staff and Volunteers?
Training works best when it is practical, repeated, and free of blame. Rather than a single annual presentation, use short sessions that walk through real examples, including messages your own organisation has received. Make it clear that anyone can pause a payment to verify a request, and that no one will be criticised for double-checking, even if the request turns out to be genuine. Practise the verification process so it feels normal rather than confrontational. Include volunteers and board members, since they often have access to information or influence that scammers exploit.
Simulated phishing exercises can help, provided they are used to identify training needs rather than to embarrass people. Above all, leaders should model the behaviour. When an executive director publicly says, “I will never ask you to buy gift cards or move money by email, so please call me if you ever see that,” it gives staff clear permission to challenge a message that appears to come from the top.
What Should You Do If Money Has Already Been Sent?
Speed matters enormously. Contact your bank immediately and ask them to attempt a recall or freeze on the transfer. Banks can sometimes stop or recover funds if they act within hours, which is why calling straight away beats waiting to gather every detail. In the United States, file a report with the FBI’s Internet Crime Complaint Center at IC3.gov as soon as possible, since its recovery efforts are most effective when reports arrive quickly, often within the first few days. Notify local law enforcement as well. For gift cards, contact the card issuer immediately, as some balances can occasionally be frozen. Then work through the internal steps:
- Preserve evidence, including original emails with headers, payment records, and screenshots.
- Check for account compromise and reset passwords on affected mailboxes.
- Inform leadership and the board promptly rather than trying to resolve it quietly.
- Contact your insurer, as some policies include social engineering or crime coverage.
- Review whether donor or staff data was exposed, which may trigger notification duties.
- Document the incident and update your controls to close the gap that was used.
Does Insurance Cover Fraud Losses?
Sometimes, but coverage is narrower than many organisations expect. Standard commercial crime policies often cover theft by employees or forgery, yet they may exclude losses where a staff member voluntarily transferred money after being deceived. That exact situation is what happens in most BEC attacks. Many insurers offer a separate social engineering fraud endorsement or a cyber policy that includes funds transfer fraud, usually with sub-limits well below the main policy amount.
Some policies also require specific controls, such as verifying payment instructions by phone, and may deny claims if those steps were skipped. Ask your broker three direct questions: does our policy cover losses where an employee was tricked into sending money, what is the limit for that coverage, and what verification steps must we follow to keep the claim valid. Getting those answers in writing now is far better than discovering the gap after a nonprofit wire fraud scam has already cost you a programme budget.
Building Habits That Protect the Mission
Fraud prevention in a nonprofit is less about expensive systems and more about consistent habits. Verify payment requests by phone using numbers you already have, require two people for significant transfers, never accept banking changes by email alone, and turn on multi-factor authentication across every account.
Train staff and volunteers with real examples, encourage questions without fear, and make sure leadership repeats that urgent money requests will never arrive by email alone. Check your insurance coverage, write your procedures down, and review them once a year. These steps cost very little, yet they protect donor money, staff wellbeing, and the trust that every nonprofit depends on to do its work.