Charities and not-for-profit organisations hold a unique position in society. They manage donations, grants, beneficiary information, volunteer records and financial data, all while operating under increasing pressure to maximise resources and deliver positive outcomes.
That combination of valuable data and tight resources makes them attractive targets for cyber criminals and fraudsters.
Unlike large commercial organisations, many charities operate with limited budgets, smaller finance teams and a greater reliance on volunteers. This can create vulnerabilities that criminals are eager to exploit. A successful cyber attack can lead to financial losses, reputational damage, regulatory action and, most importantly, a loss of trust from donors, beneficiaries and stakeholders.
As accountants, we regularly see that strong financial controls and good cyber security practices go hand in hand. Preventing fraud is not solely an IT issue. It is an organisational responsibility that requires effective governance, robust financial procedures and staff awareness.
Common Risks to Watch For
Phishing Emails
One of the most common threats remains phishing. Phishing messages are designed to look legitimate and often appear to come from banks, suppliers, trustees or government bodies. They usually arrive by email, but text messages, phone calls and QR codes are also used. Their aim is usually to steal login credentials, personal information or payment authorisations.
Be cautious of:
- Unexpected payment requests
- Urgent or pressured requests
- Changes to bank details
- Suspicious links or attachments
Business Email Compromise
Fraudsters may take over genuine email accounts, or impersonate trustees, senior staff or suppliers using spoofed or look-alike addresses, to request payments or bank detail changes. Because requests appear authentic, they can be difficult to spot.
Always verify changes to bank details or unusual payment requests using contact details you already hold on file, such as a known phone number, rather than details provided in the email.
Ransomware and Data Breaches
Cyber criminals may attempt to lock organisations out of their data, steal it, or both, and then demand payment. Donor details, employee records and beneficiary data can all be attractive targets.
Regular backups, software updates and strong access controls are essential safeguards. Backups should be kept offline or separate from your main network so that they cannot be encrypted in an attack.
Practical Steps to Reduce Risk
A few simple measures can significantly improve protection:
- Enable multi-factor authentication (MFA) on key systems.
- Use strong, unique passwords and consider a password manager.
- Provide regular cyber security awareness training for staff and volunteers.
- Review user access rights regularly.
- Keep software and security patches up to date.
- Test data backups to ensure they can be restored if needed.
Strengthening Financial Controls
Good financial governance is one of the best defences against fraud.
Consider implementing:
- Dual authorisation for payments
- Segregation of duties where possible
- Independent review of unusual transactions
- Regular bank reconciliations
- Verification procedures for supplier bank detail changes
These controls can help prevent external fraud, internal fraud and error.
The Role of Trustees
Trustees have a responsibility to safeguard the organisation’s assets, including its digital assets. Good governance includes:
- Understanding key cyber risks
- Challenging management on controls
- Reviewing incidents and near misses
- Ensuring adequate cyber security investment
- Maintaining appropriate insurance cover
- Ensuring an incident response plan is in place and tested
Cyber security should form part of regular governance discussions, with risks reviewed alongside financial and operational matters.
Reporting Incidents
Trustees should know in advance who needs to be told when something goes wrong. Serious incidents, including fraud, theft and cyber crime, should be reported to the Charity Commission (or to OSCR in Scotland or the Charity Commission for Northern Ireland). Personal data breaches that are likely to put individuals’ rights and freedoms at risk must be reported to the Information Commissioner’s Office within 72 hours of becoming aware of them.
Fraud and cyber crime should also be reported to Report Fraud, which replaced Action Fraud in December 2025. It covers England, Wales and Northern Ireland; in Scotland, contact Police Scotland on 101.
Final Thoughts
Cyber security and fraud prevention are responsibilities for the whole organisation. As threats continue to evolve, organisations must take a proactive approach to protecting their finances, data and reputation.
The good news is that many successful attacks can be prevented through a combination of staff awareness, strong governance, effective financial controls and secure technology practices.
Trust is one of a charity’s most valuable assets. By investing in cyber security and fraud prevention today, organisations can keep their focus on what matters most: serving the communities and causes they exist to support.
