Churches now depend on email, online giving, livestreaming, accounting software, child check-in systems, and membership databases. These tools help the church to operate, but they also create new ways for criminals to steal money or access private information.
The $80,000 Phishing Fraud in Plano
A vibrant congregation in Plano, Texas, was in the middle of a fundraising campaign to repair their youth facility. The church administrator received an email that appeared to come directly from the general contractor handling the repairs. In the email, the contractor requested a progress payment of $80,000. They sent a new wire transfer link for the church to comply with the payment.
Trusting the email, the administrator wired the funds. Two weeks later, the real contractor called asking for payment. The church had fallen victim to a phishing and social engineering attack. The email was a spoofed account run by hackers. Because the money was wired voluntarily, the bank could not recover it. Without a cyber liability policy featuring social engineering coverage, that $80,000 of donor money was gone forever, halting the youth building project entirely.
Why Cybercriminals Target Churches
Many church leaders believe their congregation is too small to attract hackers. In reality, criminals often target smaller organizations because they may have fewer security controls and limited technology staff.
Church systems can contain names, addresses, giving records, background checks, prayer requests, and information about children and volunteers. Criminals also take advantage of the church’s culture of trust by pretending to be pastors, vendors, staff members, or ministry partners.
Sometimes one convincing email and one rushed employee are all it takes.
What Cyber Liability Insurance Covers
Cyber coverage commonly provides two types of protection.
First-Party Coverage
First-party coverage helps pay the church’s direct recovery costs after an attack. Depending on the policy, this may include:
- Computer investigations
- Data restoration
- Ransomware response
- Business interruption
- Legal guidance
- Member notification
- Credit monitoring
- Crisis management
Third-Party Coverage
Third-party coverage responds when another person claims the church failed to protect private information.
It may help pay legal defense costs, settlements, judgments, and certain regulatory expenses after a covered data breach.
Online Giving Does Not Remove Cyber Risk
Using a third-party giving platform does not mean the church has transferred every cyber risk to the vendor.
The church may still store names, email addresses, phone numbers, giving histories, volunteer records, and information about children. Hackers may also enter through the church’s email, website, accounting software, cloud storage, or management system.
The church should understand what information each vendor holds and what happens if that provider experiences a breach.
Social Engineering Coverage Matters
Cybercriminals often manipulate people instead of attacking computer systems directly. They may impersonate a pastor, contractor, bank, or trusted vendor and ask an employee to send money or change payment information.
Some policies exclude money the church voluntarily transfers. Others provide only a small sublimit.
Church staff should confirm payment changes by phone or in person using trusted contact information. They should never rely only on the email requesting the change.
Protecting Your Church’s Digital Ministry
Insurance can help after an attack, but it should be supported by strong security practices.
Churches should use multifactor authentication, train employees to recognize suspicious messages, limit access to sensitive systems, update software, back up important records, and remove access when staff members or volunteers leave.
Leadership should also create a written response plan so everyone knows what to do when an account is hacked or private information is exposed.
Is Your Church Protected?
Cyber risk includes every email account, database, computer, cloud service, giving platform, and ministry system your church uses.
Church leaders should know whether their policy covers ransomware, data restoration, stolen funds, business interruption, legal defense, and notification costs. They should also understand the limits and sublimits for each type of loss.
True Texas Church Insurance helps churches review how they use technology, store information, and transfer money. We identify possible gaps and help leadership choose Cyber Liability coverage that protects the church’s finances, private information, and reputation.