This summer we have become aware of a “payroll scam” targeting ministry personnel and other staff members of churches.
How the Payroll Scam works:
- Scammers review websites of churches and learn the positions of each staff member to understand the staff structure in an attempt to steal staff’s salary.
- After they get to know who the staff members are and what their role is within the church, they target a particular staff member(s) and create an email address that is very similar to the person’s real email address ie minister@butterflyuc.com to minister1@butterflyuc.com and then use that email to contact the treasurer or bookkeeper to have their payroll auto-deposit banking information changed.
- Another way a scammer can get access to staff email address is by hacking into the churches email server and gain control over staff emails. Once they have this control they can send an email directly from the staff members real account to community members or other staff. These emails will only be detected if the staff member check their “sent” emails.
- The outcome of the payroll scam is the targeted staff member is only alerted on pay day when their payroll is not deposited into their account and then contacts the church payroll administrator to find out a false request has been made to alter their payroll information. The payroll is deposited into the scammers account and will be a financial loss to the church.
How to avoid the Payroll Scam:
- Ensure that the payroll administrator on your staff team whether they are the treasurer, bookkeeper or church administrator use extra precautions when processing changes to payroll details for staff members.
- The best precaution is to respond in person or by telephone to verify any payroll information change requests.
- Have the staff member fill out a payroll change form in the office with a witness.
- Develop basic security protocols within the staff team and church council as an example, two staff members must approve financial transactions on behalf of the church ie cheque signing, payroll changes etc.
- Install trustworthy web security systems on all church devices.
Stay alert and be safe online and on the phone.
[Photo: John Schnobrich via Unsplash]
