It usually looks completely ordinary. A short message from the executive director, sent to whoever can move money:
“Are you at your desk? I need you to take care of something before this afternoon’s meeting. Don’t loop in the team yet.”
There is nothing alarming in it. That is the point.
Four things that show up together
Read that message again and four things are at work. They appear together in almost every version of this scam.
- Urgency. A deadline that leaves no time to check.
- Authority. It comes from someone you don’t usually question.
- Secrecy. A reason not to involve anyone else.
- An unusual channel. A personal email address, a text, or a phone number you don’t recognize.
Any one of these on its own is normal. Executive directors are busy and send short, urgent notes all the time. The combination is what gives it away. When all four turn up in the same message, treat it as an attack until you have confirmed otherwise.
Why nonprofits are especially exposed
The things that make small nonprofits work well are the same things this scam relies on. Teams are small. Hierarchies are flat, so the person who processes payments may report straight to the ED. Executive directors really do make urgent requests. And staff are hired, in part, for being helpful.
None of that is a weakness to fix. It just means the protection has to come from a rule rather than from people’s instincts, because people’s instincts are pointed the wrong way here.
Where the money actually goes
Gift cards are the version people joke about. “Can you pick up six $200 gift cards for a donor thank-you? I’ll explain later.”
The version that does real damage is quieter. A vendor emails to say their bank details have changed. An employee asks HR to update their direct deposit. Each looks like routine admin, and each can send a payment, or every payment after it, to the wrong account.
The control
One rule covers it: any new or changed payment destination gets confirmed by voice, using a phone number you already have on file. Never the number in the message, and never by replying to the email, which simply reaches whoever sent it.
That rule needs writing down, with named people and a backup, and we come back to it in the next post. But the rule only works if one more thing is true.
The part that makes it work
The executive director has to say it, out loud, to the whole organization: “Verify me too. I won’t be annoyed.”
Without that, the rule quietly fails. A junior staff member who gets an urgent message from the ED is not going to risk looking difficult by calling to check, unless they have heard the ED say plainly that checking is expected. The permission has to come from the person being impersonated.
And when someone does call to verify a real request, thank them. That is the rule working.
This week’s action
Agree on a verification rule for payment changes, and have the executive director be the one who announces it.
Next in this section: bad grammar was never the real tell.