Cybersecurity for small nonprofits: A volunteer-friendly guide

A small nonprofit often runs on a handful of staff, a rotating group of volunteers and a few logins everyone knows. The board treasurer checks the bank account from home. Last year's newsletter volunteer still has the password, and three people have downloaded the donor spreadsheet.

None of that makes you careless. It's how small organizations get work done. This guide shows how to keep that flexibility while closing the gaps scammers look for, mostly with tools you already have or can get free.

What do scammers want from a small nonprofit?

Three things: your donors' information, your money and your name.

Donor records hold names, addresses, emails, giving history and sometimes payment details, which makes them useful for fraud and for targeted phishing. Your bank and payment accounts are targets for fake invoices and for emails that appear to come from the executive director asking the treasurer to send a payment. And your name is worth something on its own, because people already trust it with their money.

CISA's High-Risk Communities page covers civil society organizations and says many such groups "operate on lean budgets and cannot significantly invest in cybersecurity," which makes them "a uniquely attractive target." That's written with advocacy and human rights groups in mind, but the budget problem will sound familiar to most small nonprofits.

Start by writing down where each of those three things lives: which systems hold donor data, who can move money, and who controls your website, email and social accounts. The FTC's guide to protecting personal information calls this step "Take stock."

How do fake fundraisers and donation phishing work?

Scammers borrow a real cause to collect money. The FTC warns donors that "Some scammers use names that sound a lot like the names of real charities," and that some "try to trick you into paying them by thanking you for a donation that you never made."

Crowdfunding makes impersonation easy. The FTC's crowdfunding guidance notes that "Scammers often use stolen photos and copy and paste other people's stories." A fake campaign can reuse your photos and your mission statement. Phishing emails and texts do the same thing by pointing supporters to a donation page that looks like yours.

You can't stop someone from copying your story, but you can make the real thing easy to find and check:

• Keep one official donation page on your own domain, such as yourbusiness.com/donate, and link to it from every email, post and flyer.
• Tell supporters how you ask for money, and say you will never ask for gift cards, wire transfers or payment details by email.
• Search your organization's name plus "donate" every month or so, including on the major crowdfunding sites.
• Report fake campaigns to the platform first, then to ReportFraud.ftc.gov and your state charity regulator.

The same FTC page tells donors to refuse requests for cash, gift cards or wires. Matching your own requests to that advice makes a scam stand out. Add a line about your official donation page to your email footer this month.

How should volunteers share passwords and accounts?

Give each person their own login wherever you can. Most email systems, donor databases, mailing tools and social media management tools let you add people with limited roles. When everyone signs in as themselves, you can see who did what and remove one person without changing the password for everyone else.

CISA's Cyber Essentials recommends unique passwords for all user accounts and says to "Grant access and admin permissions based on need-to-know and least privilege." A volunteer who posts events doesn't need admin rights to your donor database.

Some logins can't be split, like an older bank portal or a vendor account with a single user. For those:

• Store the password in a password manager with a shared vault, not in a document, email or sticky note.
• Put the account on an organization email address like info@yourbusiness.com, never a volunteer's personal one.
• Set up multi-factor authentication with an organization phone or a shared authenticator in the password manager, so the second step doesn't depend on one volunteer's phone.

Multi-factor authentication (MFA) matters most on email, the donor database, payment and bank accounts, and your domain registrar. Google's 2-Step Verification guide recommends enforcing it for administrators and for users who handle sensitive data such as financial records.

Pick your three most-shared logins and move them into a password manager this week.

How do you offboard a volunteer without losing access?

Plan for people to leave, because they will. CISA's Cyber Essentials asks organizations to develop policies "addressing changes in user status (transfers, termination, etc.)" and to keep an inventory of user accounts. For a small nonprofit, that can be a single shared spreadsheet listing each person, the systems they can use, their role and the date they were added.

When someone leaves, work through the same short routine:

1. Remove or disable their accounts in email, the donor database, social media tools and shared drives.
2. Change any shared passwords they knew, starting with bank and payment accounts.
3. Transfer ownership of documents, folders and calendars they created before you delete their account.
4. Remove their phone number and personal email from recovery settings on organization accounts.
5. Collect keys, laptops and any donor records they kept at home.

The harder case is the account only one person controls. If your domain, website host or Facebook page is tied to a founder's personal email, a falling-out or an illness can lock the whole organization out. Make sure at least two trusted people have admin access to each critical account, and that the login uses an organization address.

Start the access spreadsheet today, even if it only has five rows.

Check your donation site and email from the outside

Run a free scan of your nonprofit's website and email records, including HTTPS, your certificate and DMARC, and get plain-English fixes.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

What free security tools can nonprofits get?

If you qualify, Google and Microsoft both offer email and document tools free or at a discount, and CISA offers free training and volunteer help.

Google for Nonprofits gives eligible organizations Google Workspace for Nonprofits at no charge, plus discounts on higher Workspace editions. You must be a registered charitable organization and be verified by Goodstack, Google's validation partner. Government entities, hospitals and schools aren't eligible, though their charitable arms can be. Google says most requests are reviewed in 2 to 14 working days.

Microsoft's nonprofit offers include Microsoft 365 Business Basic free for up to 300 users, and discounted pricing on Business Premium and other plans. Microsoft has its own eligibility review.

Either suite gives you organization-owned email on your domain, shared drives you control and admin settings to require MFA. For setup, see the Google Workspace security guide or the Microsoft 365 security checklist.

CISA's High-Risk Communities page links to Project Upskill, a series of "how-to" labs with "simple, non-technical guidance," and a Cyber Volunteer Resource Center for finding a local cybersecurity volunteer clinic. Cyber Essentials has a free starter kit for small organizations as well.

Eligibility rules and offers change, so confirm the details on the official pages before you apply. Then set aside one afternoon after approval to turn on MFA for every account.

How do you keep donor data safe?

Keep less of it. The FTC's guide says "If you don't have a legitimate business need for sensitive personally identifying information, don't keep it. In fact, don't even collect it." For a nonprofit, that means letting your payment processor store card numbers instead of writing them on paper forms, and deleting old event spreadsheets once the data is in your donor database.

Then limit who can see and export what's left. Restrict downloads of the full donor list to the one or two people whose role requires it, and have them use an encrypted laptop and delete the file when they're done. The FTC's last step is "Plan ahead," so decide now who you would call if donor data were exposed.

Protect your email domain too, because donors trust messages that appear to come from you. The FTC explains that without email authentication, "scammers can use your domain name to send phishing emails that look like they're from your business." Three DNS records, SPF, DKIM and DMARC, let email providers check whether a message really came from you. Your mailing tool and donation platform probably send as your domain, so add them to SPF and DKIM before you move DMARC from p=none to p=quarantine.

What should you do next?

Start with the steps that protect donors and keep your accounts in the organization's hands.

1. Run the free website security scan on your donation site to check HTTPS, your certificate and your email records.
2. Start the access spreadsheet and turn on MFA for your email and donor database.
3. Read up on phishing with your volunteers, and agree on how you'll confirm any request involving money.
4. Work through the small business cybersecurity checklist for Wi-Fi, backups and device basics.