Email security for
nonprofits on a budget.

Why nonprofits are targeted

Attackers follow value, and nonprofits hold more of it than they realize: donation and grant flows to redirect, donor and beneficiary records to steal, and payroll to divert. What they typically lack is a dedicated security team, so defenses rest on a few busy people and a rotating set of volunteers. That gap between what's at stake and what's protecting it is precisely the opening. None of this requires a big budget to close — it requires the right few habits.

The free and low-cost essentials

• Multi-factor authentication on every account. Free with Google Workspace and Microsoft 365, and the single biggest barrier to account takeover. Make it mandatory, including for volunteers and board members with access.
• A written payment-verification rule. Any new or changed bank detail — for a vendor, a grant, or payroll — is confirmed by phone using a number you already had. This one rule stops most donation- and invoice-fraud losses, and it costs nothing.
• Use your provider's nonprofit program. Google for Nonprofits and Microsoft's nonprofit offers include security features at no or low cost. Take the upgrade and turn the protections on.
• Least-privilege access. Give each person — especially volunteers — only the access their role needs, and remove access promptly when someone leaves or a term ends.
• Publish SPF, DKIM, and DMARC on your domain so criminals can't easily impersonate your organization to your own donors.

Protecting donor and beneficiary data

• Keep sensitive data out of ordinary email. Don't send full payment details, Social Security numbers, or large donor lists as attachments; use your CRM or a secure portal.
• Limit who can see donor records, and log or review access where you can.
• Separate the donor CRM and finance systems from general staff email. A phished email account should not automatically open your donor database or accounting — keep those behind their own logins and MFA, granted only to the people who need them.
• Have a plan for a data incident. A breach of donor information can carry legal obligations and real reputational damage; knowing in advance who to call shortens the harm.

The scams that hit nonprofits hardest

• Donation-page and invoice fraud — redirected payment details, or fake invoices for services the organization uses.
• Grant scams — fake grant “awards” that ask for a fee or bank details up front, or impersonation of a real funder to redirect a legitimate payment. Confirm any award or payment change directly with the funder.
• Grant-application phishing — a fake “grant provider” requesting your EIN, banking details, or documents to “unlock” funding. A real funder does not need your bank login to send money.
• Board-member and executive impersonation — a “director” or board chair emailing a request for gift cards or an urgent transfer, often timed around a board meeting or travel. See our impersonation and invoice-fraud guide.
• The fake-donor overpayment — a “major donor” overpays by check and asks for the difference refunded, or promises a big gift contingent on a processing fee. The check bounces after you've sent real money. Never refund against an uncleared deposit.
• Volunteer-account phishing — a compromised volunteer login used as a way into the organization. Volunteers need MFA and a moment of training too.

Train the people, simply

You don't need a formal program. A short, plain briefing — here are the scams aimed at us, here is our one payment rule, here is who to ask if something feels off, and no one will ever be blamed for double-checking — does most of the work. Repeat it when volunteers turn over.

Sources & further reading: CISA resources for under-resourced organizations · TechSoup and Microsoft/Google nonprofit programs · NTEN cybersecurity resources · U.S. FTC business guidance (ftc.gov). Sector threat figures per Abnormal Security research (2025). Educational only; not a substitute for advice tailored to your organization.

Common questions