Keeping Watch Over Your Flock
In this digital age, staying connected is simultaneously easy and complicated. There are endless opportunities to connect, but that opens the door for those who look to exploit those opportunities. Your church website plays a critical role in connection: It fosters community, disseminates information, and connects to the world just outside your building. These things are especially important during the holidays, when digital communication increases. The Christmas season is one of great anticipation and joy. However, it’s also a time of heightened risk, both of email spam and online threats. In this blog post, let’s explore some practical best practices to fortify your church against these dangers.
1. Understand Common Spam and Hacking Techniques
Educating yourself and your team about common spam and hacking techniques is crucial in the battle against online threats. The holiday season is a time when cybercriminals look to take advantage of the goodwill and generosity of the people in our churches. Awareness is the first line of defense.
a. Email Spoofing
Email spoofing involves sending messages with a forged sender address, making it appear as if they come from a trustworthy source. Be cautious of emails requesting sensitive information or financial transactions, even if they seem legitimate.
Often these emails are designed to look like a Pastor or leader of the Church is requesting emergency funding through gift cards or other financial means. If you receive an email like this, it is recommended to not open it. Do not click on or follow any links, do not download anything, and do not send any money. Contact the person that the email is purporting to be from and let them know that you received a spam email that seemed to be from them.
b. Phishing Attacks
Phishing attacks often involve deceptive emails that mimic trusted entities to trick recipients into revealing sensitive information. Train your congregation to verify the legitimacy of emails, especially those requesting personal or financial details. No legitimate business or group should request personal or financial information over email. Always call directly or visit the website of an organization to provide them with information they may need.
c. Data Exposure on Social Media
Encourage your congregation to review and tighten their privacy settings on social media platforms. Scammers can exploit personal information shared on these platforms. Most people have little understanding of the level of personal information they make accessible through social media. Spam email targets can be selected by combing through a church’s Facebook page or other sources of publicly available data online.
Because there are many places online where people give their email addresses or other personally identifying information today, it is virtually impossible to stop the spammers. The best practice is to minimize your exposure and be aware of the common scams as they come.
2. Practical Steps for Email Security
Email is a primary mode of communication for churches; unfortunately, it’s also a target for spammers and hackers. To protect against online threats and to keep your congregation’s data secure, follow these practical steps:
a. Use Strong Passwords and Two Factor Authentication
Ensure that all email accounts associated with your ChurchSpring site have strong, unique passwords. Avoid easily guessable passwords like “123456” or “password.” Your ChurchSpring site is secure and the ChurchSpring servers are protected by some of the best security in the world. Access to your individual site, as well as the people in your church directory, should be kept secure by your admins with strong and unique passwords.
Personal Email
Your personal email or email service should also be secured with a strong password. It is not uncommon for spammers and hackers to try and gain access to an email account with a weak password and then send spam emails directly from the legitimate account. If you suspect that your own email has been compromised, the best practice is to immediately change your password and inform your contacts not to respond to strange emails they may have received from your account.
Two Factor Authentication
Two-Factor Authentication (2FA) is an additional layer of security designed to ensure that access to an account or system requires more than just a password. With 2FA, users need to provide two different authentication factors—typically something they know (like a password) and something they have (like a smartphone). 2FA is widely used across various platforms, from email accounts to banking services, to provide users with an extra level of protection for their sensitive information.
Implementing robust passwords and enabling Two Factor Authentication (2FA) adds an extra layer of protection against unauthorized access.
c. Minimize Visible Email Addresses
As the Church, we want to make it easy for people to get ahold of us! A common practice is to provide an email address on our website. However, it’s important to keep in mind that any contact information found on the public-facing part of a website is vulnerable; a scammer can quickly grab it to send spoof emails or to utilize in an attempt to login to your website and gain access to your site and directory.
One method to minimize this risk is to provide a contact form, rather than an email address, through which the general population can reach out to you. The use of a contact form hides the associated email addresses from public view but still permits your church to receive communications from your website visitors and congregation.
Learn more on how to utilize contact forms in your ChurchSpring site here: How To Use the Contact Form Template
d. Regularly Update Software
Keep your software products up-to-date. Developers frequently release security patches to address vulnerabilities, and timely updates are crucial safeguards against potential online threats. You don’t need to worry about updating the software for your ChurchSpring site as it is automatically updated and maintained on our servers, but any other software you use, even internet browsers, should be regularly updated to patch any security issues that develop over time.
e. Control Access to your Directory
The admins of your ChurchSpring website can control the access people have to your directory. The best practice is to verify everyone who requests access to your site and your directory. Do not allow access to anyone you do not know! If you can not verify the name and email address for someone it’s best to deny them access. Read more about the directory here: How Can Members Access the Directory?
We have seen this method used many times by spammers: A website admin approves an account request in their people area and lets in a scammer, believing them to be a church member. You are in control of your church directory and the people who have access to it. Again, the best practice is to verify everyone who wants access to your site and deny anybody you don’t know or can’t verify.
If you have unknowingly let in a scammer, follow these steps:
-
- Delete the scammer’s account in the people area: How Can Members Access the Directory?
-
- Let your congregation know to not respond to any emails requesting money or gift cards from your staff
-
- Contact us at support@churchspring.com and let us know the email address and name of the scammer and we will add them to our block list
-
- Update your login passwords as a precautionary measure
5. Empowering Your Congregation
Equip your congregation with the knowledge and tools to navigate the digital landscape safely. Share resources designed to educate them about online threats and how to recognize and report suspicious activities. The best way to protect your flock from the inevitable attempts of scammers is to provide the information and awareness they need to recognize the red flags of an online threat.
6. ChurchSpring: Your Trusted Partner
Security is a big deal: You want your members’ info to be safe. ChurchSpring has developed our website platform with security as a priority and you can have the confidence that your site is protected by some of the most advanced security in the world. We live in a broken world and there will continue to be attempts to take advantage of the goodwill and generous hearts of believers. Let us be wise, and not afraid—security is both a group and an individual effort. Partner with us to help make our churches better prepared and, ultimately, more secure. Make sure your platform has got your back with top-notch security. And if you get stuck, there should be real people ready to help you out. ChurchSpring is here for your church!
Not a ChurchSpring member yet? You can be! To learn more about how our team can serve your ministry, watch our demo webinar at churchspring.com/demo.
