.png)
.png)
.png)
The most common phishing red flags are urgent pressure, a sender address that doesn't match the name, lookalike domains, unexpected links or attachments, and requests for passwords, gift cards or new banking details. Non-profit teams are frequent targets because they handle donations and donor data with small teams and tight budgets. The fix is a simple habit: pause, verify the sender another way, and report anything that feels off. Here are the 8 red flags every staff member and volunteer should know.
A phishing email is a fake message designed to trick you into sharing information, sending money or opening something harmful. The sender pretends to be someone you trust: a board member, a funder, a supplier or a familiar software company. The goal is usually a password, a payment or a file download.
Non-profits combine valuable data with lean operations. Staff and volunteers wear many hats, contact details are often public, and there's rarely a dedicated IT person checking suspicious messages. That makes the inbox a natural target.
Learning how to spot a phishing email comes down to a handful of patterns. One red flag is enough reason to pause.
"This must be paid today" or "your account will be closed in two hours." Scammers create urgency so you act before you think. Example: an email warns that your grant application will be withdrawn unless you confirm your banking details by end of day.
The name says "Executive Director," but the address behind it is a free webmail account. Example: a message from "Sarah, Executive Director" that comes from [email protected] instead of your organization's domain.
Attackers register domains that differ by one character. Example: an invoice from yourcharity.co instead of yourcharity.ca, or "rn" standing in for "m." Read the address character by character.
A shared document, voicemail or invoice you weren't expecting deserves suspicion. Hover over links to see where they really lead before you click. Example: a "Board minutes – please review" link that opens a site you've never heard of.
A link opens what looks like a Microsoft 365 or Google sign-in page and asks for your password. Legitimate services don't ask you to confirm credentials by email. Example: "Your mailbox is full. Sign in to keep receiving messages."
Gift card requests are almost always scams. So is a supplier "updating" their banking details by email. Example: your event venue appears to email the board treasurer with a new account number just before a payment is due. Call the supplier on a number you already have.
Scammers mimic the messages non-profits expect. Example: a "grant approval" asking for a processing fee, a donation receipt with an attachment you didn't issue, or a notice claiming your charity registration needs urgent renewal through a link.
"I'm in a meeting, don't mention this to anyone yet." Any instruction to skip normal approvals or keep a request confidential is a warning sign. Example: the "board chair" asks the office manager to buy gift cards for volunteer appreciation and send the card numbers by reply.
Mistakes happen, even to careful people. What matters is acting quickly and calmly.
For fully managed clients, our managed SOC (security operations centre) handles the investigation and recovery.
Phishing awareness for nonprofits works best as a simple, repeated routine rather than a one-time lecture. Share the 8 red flags at your next staff meeting, add them to volunteer onboarding, and agree on one rule: any request for money or credentials gets verified by phone.
Training helps the habit stick. Our security awareness training, available for fully managed clients, walks teams through realistic examples so the red flags become second nature.
Filtering catches much of the phishing before anyone has to make a judgment call. WILDCARD's CORE package includes Email Security, which stops spam, phishing and malicious attachments before they reach your inbox. Setting up email authentication (SPF, DKIM and DMARC) also makes it much harder for scammers to send email in your organization's name. CORE costs $23 per user + $26 per device = $49 per seat per month, before applicable taxes, with no minimums and no long-term contracts. That's how we Make IT Disappear: fewer dangerous messages, fewer tough calls for your team.
Urgent pressure, a sender address that doesn't match the display name, lookalike domains, unexpected links or attachments, and requests for passwords, gift cards or new banking details.
Report fraud and phishing to the Canadian Anti-Fraud Centre. If money or banking details were involved, contact your bank right away too.
CORE includes Email Security, which stops spam, phishing and malicious attachments before they reach your inbox. Security awareness training is available for fully managed clients.
Phishing works when people are rushed. Share these 8 red flags with your staff and volunteers, build the habit of verifying requests another way, and make reporting easy and blame-free. One pause can protect your donors, your funds and your reputation.
See how well your email is protected: run the free Domain Security Scan, or call us at 1-888-274-3530.
WILDCARD is the unpredictable competitive advantage changing the game for small businesses bold enough to evolve. Make IT Invisible.
enterprise expertise without minimums; managed services delivered with character
🦄 🦅 🐺 🦫 🐝 🐿️ 🐘 🦚🦜 🐟 🦇 🦡 🦉 🐢