Fake donation emails: how to protect your organization's name from email spoofing

Email spoofing lets criminals forge your organization's name to trick donors into sending money or clicking malicious links. Email authentication (SPF, DKIM and DMARC) lets receiving servers tell your real messages from fakes, and WILDCARD's Email Security stops spoofed messages before they reach your team's inboxes. Here's how fake donation emails work, and what you can do this week to protect your name.

Key takeaways

• Email spoofing forges the sender so fraudulent donation requests appear to come from your charity.
• A DMARC policy tells receiving servers to quarantine or reject messages that fail authentication.
• Spoofed messages can erode donor trust that took years to build.
• Telling donors how you really ask for gifts helps them spot fakes faster.

What is email spoofing and why does it matter?

Email spoofing forges a sender's address so a message looks like it comes from someone you trust. The attacker changes the email's "From" details so the name looks right while the real source is hidden. Email was never designed to check where a message really came from, which is why authentication records exist.

For a non-profit, the risk is personal. Imagine a criminal posing as your Executive Director and asking a major supporter to "re-send" their credit card details. That donor loses confidence, and may mention it to their own board. A fraudulent fundraising appeal that appears under your name and logo can do real damage to your reputation.

How do attackers make a spoofed email look real?

They put a familiar name in the "From" field, or register a domain that is one letter off from yours. The recipient sees a name they recognize, while the actual sending address is somewhere else entirely. Most people take the sender name at face value and never look further.

Can email spoofing affect our donor relationships?

Yes. A single convincing fake can undo trust that took years to build, and rebuilding it takes time. Donors who feel deceived may hold back on future gifts, even though your organization did nothing wrong.

How do scammers target your non-profit's donors?

Scammers copy what makes your real appeals trustworthy, then use it against you. When donors recognize your name, they lower their guard, and that's when they click a link, open an attachment or send money.

Fake donation emails tend to follow the same patterns:

• They mimic urgent giving appeals during busy fundraising seasons, like the run-up to Giving Tuesday.
• They copy your branding, logo and email signatures.
• They invent deadlines or "matching gift" offers.
• They link to payment pages that look almost identical to yours.

What happens after donors get tricked?

The damage goes beyond one lost gift. Money meant for your programs goes to criminals, and donors who were fooled may become wary of your real appeals. Your next legitimate campaign has to work harder to be trusted.

What is DMARC and how does it stop spoofing?

DMARC is an email authentication record that tells receiving servers what to do with messages that claim to be from your domain but fail authentication checks. Without it, anyone can send email that looks like it's from you, and receiving servers have no instructions to stop it.

How does DMARC protect your email reputation?

A DMARC policy has three levels: monitor only, quarantine suspicious emails, or reject them entirely. Most organizations start by monitoring, check that all their real sending services (email, newsletter platform, donation software) pass, then move up step by step. Each level tightens your protection without blocking your genuine messages.

CORE includes Domain Security, which covers DNS security, registration and administration, so the records that make DMARC work are managed for you. Learn more about our domain security approach.

What happens when DMARC rejects a spoofed message?

The receiving server checks the email against your published DMARC policy. If authentication fails, it follows your instructions: a reject policy blocks the message, and a quarantine policy sends it to spam. Your legitimate emails keep flowing, and the forged ones stop reaching inboxes.

How can you communicate with donors about spoofing?

Clear communication with donors prevents fraud and protects trust. Tell supporters exactly how your organization sends appeals: which email addresses are official and which platforms you use for online giving. When donors know what real messages look like, they spot fakes faster.

What should a donor notice include?

A short, friendly notice works best. Cover three points:

• We will never ask for passwords, gift cards or card details by email.
• Our appeals always come from our own domain, never a free webmail address.
• If a request seems unusual, call our office before you give.

Put it in your next newsletter and add a line to your donation confirmation page. Repetition builds recognition.

How do you handle a spoofed message that donors report?

Thank the donor right away and confirm whether the message came from you. If it didn't, reassure them that reporting it was the right thing to do, and encourage anyone who received it to contact your office through official channels before acting. You can also report the fraud to the Canadian Anti-Fraud Centre.

Your team matters here too. Security awareness training, available for fully managed clients, helps staff recognize forged sender addresses before they forward or act on them.

What steps can you take to protect your non-profit today?

Start by knowing where you stand. The free Domain Security Scan shows your email and website security in about two minutes. Enter a domain or email address: no card, nothing to install. You get a plain-language report card on your email and website security.

CORE's Email Security blocks spam, phishing and malicious attachments before they reach an inbox, which means fewer fake invoices and fewer moments where a staff member has to decide whether an email is real. CORE's Identity Monitor watches your identity, website, domain and the dark web for threats 24/7.

Here's what we recommend, in order:

1. Run the free Domain Security Scan this week.
2. Review the report with your team.
3. Add CORE ($23 per user + $26 per device = $49 per seat per month, before applicable taxes) to close the gaps the scan reveals. Our Fair Play™ pricing means no minimums, no long-term contracts and no hidden fees.

That's what we mean by Make IT Disappear: the protection runs quietly in the background so your team can focus on the mission.

FAQ

How does email spoofing work against a non-profit?

Attackers forge the sender details so a fraudulent message appears to come from your organization, often asking donors for money or personal information.

What stops fake donation emails from reaching donors?

SPF and DKIM let receiving servers verify your real messages, and a DMARC policy tells them to quarantine or reject messages that fail those checks.

How does a spoofed email affect donor relationships?

It can erode trust that took years to build, and rebuilding that trust takes time. Telling donors how you really ask for gifts helps limit the damage.

Conclusion

Fake donation emails trade on the trust your supporters place in your name. Email authentication, a DMARC policy and a clear note to donors about how you really ask for gifts make that trust much harder to abuse.

Run the free Domain Security Scan to see where your domain stands, or call us at 1-888-274-3530 to talk it through.