Початковий набір з кібербезпеки

Розділ 10: Як захистити вашу некомерційну організацію від шахрайства та зловживань

In this section, you’ll learn to:

Recognize common scams, fraud tactics, and social engineering techniques.
Identify suspicious requests involving money, information, or account access.
Verify unusual requests and take steps to protect your nonprofit from scams.

Protecting your nonprofit from scams and fraud

You have explored how to protect accounts, devices and information, work with providers, and prepare for incidents. This section brings those safeguards together to address another route into your organization: persuading someone to take an action that appears reasonable.

Cybercriminals can use several methods to reach your nonprofit’s information, accounts and funds.

Method	What it could look like	Safeguards that help
Exploit a technical weakness	Take advantage of outdated software or an insecure setting.	Updates, supported software, secure settings and access controls
Use stolen credentials	Sign in with a password exposed through another service or captured on a fake login page.	Unique passwords, password managers, MFA and protected recovery arrangements
Manipulate someone into taking action	Persuade a person to send information, approve access, install software or change payment details.	Verification procedures, clear approvals, practice and prompt reporting

These methods can work together. A deceptive message might capture a password, which is then used to access email. The attacker could use that account to send a believable payment request to someone else.

Where scams and hacking overlap

Scams and fraud use deception to obtain money, information, access or another benefit. People often use хакерство to describe gaining unauthorized access to accounts, devices or systems.
A scam can provide the route into an account or device. For example, someone posing as technical support might persuade a volunteer to install remote-access software. Other scams can cause harm without taking over an account, such as persuading a staff member to send client information or redirect a payment.

Both belong in cybersecurity because they can expose information, compromise access and disrupt your organization’s work.

Why verification matters

This section focuses on requests that persuade people to take actions affecting information, accounts or funds. Security professionals call this manipulation social engineering. It can happen through email, texts, phone calls, social media and video meetings.

Verizon’s 2026 Data Breach Investigations Report found that 62% of the breaches it examined involved a human element, including social engineering, stolen credentials and errors. This highlights why clear processes and support for people belong alongside technical safeguards.

A request may look ordinary: open a document, update payment details, provide a report or help resolve an account problem. The requester may claim to be a colleague, donor, client, supplier, funder or support representative.

A request does not have to look unusual to need verification. Base your checks on what you are being asked to do.

Familiar does not mean verified

A message may have correct grammar, recognizable branding and accurate project details. It may arrive within an existing conversation or from someone’s genuine account after that account has been compromised.

Caller ID and sender details can also be manipulated. A familiar name or displayed phone number does not establish who is contacting you.
Warning signs can help you pause, but their absence does not establish that a request is legitimate. Protection should not depend on noticing spelling mistakes, an unfamiliar accent or an obviously strange story.

You may hear the term фішинг for deceptive messages that try to obtain information or persuade someone to act, often through links or attachments.

Targeted phishing, also called spear phishing, is tailored to a particular person or organization.

How AI changes scams

AI gives fraudsters additional ways to make requests convincing and produce them at scale.

Polished and personalized messages

Requests can use professional language, refer to your programs and sound convincing in different languages.

Voice cloning or alteration

A caller or voice message may sound like an executive director, colleague or partner.

Deepfake images and video

Created or altered content can make someone appear to say or do something they did not.

Impersonation during live calls

A voice or video conversation may appear to involve a familiar person while being controlled by a fraudster.

The Canadian Centre for Cyber Security describes AI-assisted social engineering, including personalized messages and voice or deepfake impersonation.

You do not need to determine whether AI was used before protecting your organization. A recognizable voice or face is not sufficient authorization to release information, change access or send money.

Visual glitches or unusual speech are not dependable tests for detecting AI. Confirm the request through an independently established contact route and follow your organization’s approval rules.

Agree which actions require checks

Use the responsibilities and policies from Section 2 to establish consistent verification for consequential actions.

Requested action	What to confirm before proceeding
Send money, issue a refund or purchase something	Recipient, purpose, amount and required approvals
Change banking, payroll or payment details	The change with an authorized contact using independently established contact information
Send sensitive information or change sharing permissions	The requester’s identity, authority, need for the information and approved delivery method
Sign in through a message link	Open the service through its official app or trusted bookmark and check for the request there
Approve MFA or provide a sign-in code	Approve only a sign-in you initiated; do not give codes to someone contacting you
Grant access or change recovery details	The person’s authorization and required internal approval
Install software or allow remote control	The need and provider through your approved support process

Apply checks to requests from senior leaders as well as other people. An urgent deadline should trigger the agreed escalation process rather than remove safeguards.

Use a separate trusted route

Verification means more than replying, “Did you send this?”

If an account is compromised, the fraudster may answer your reply. Calling a number supplied in a fraudulent message may also connect you to the fraudster.

Use contact details from an established directory, a previously verified supplier record or another independently confirmed source. The Canadian Anti-Fraud Centre recommends using a trusted phone number to verify payment requests, particularly changes to banking details.

Pause the requested action.

Contact the appropriate person independently.

Confirm the specific details and authorization.

If the person cannot be reached, use the designated backup or decision-maker. Keep the action on hold until the required checks are complete.

A response you can use: “Our organization verifies requests involving payments, sensitive information or account access through our established process. I’ll contact the appropriate person using our records before proceeding.”

Leadership should support staff and volunteers in using this response, including when a request appears to come from leadership itself.

Practice applying the kit

Use one scenario at a time during a staff meeting or volunteer orientation

Запитай:

What information, account or funds could be affected?
What must be verified, and through which trusted route?
Which safeguards from this kit apply?
What would we do if someone had already acted?

Scenario 1:

A supplier changes banking details

An invoice arrives from your usual supplier. The amount and project details are correct. The message explains that the supplier has changed banks and provides new payment instructions.
Response to practice: Hold the payment change. Contact the supplier’s authorized representative using existing records, confirm the details and follow your internal approval process.
Connection to the kit: Clear responsibilities and payment approvals protect the decision. Accurate invoice details do not establish that a change is authorized.

Scenario 2:

A caller sounds like your executive director

A caller who sounds like the executive director asks you to make a time-sensitive payment. They say they are in a meeting and need you to handle it immediately.
Response to practice: Explain that the payment requires the usual checks. End the call and contact the executive director through your established route. If unavailable, contact the backup decision-maker.
Connection to the kit: Verification and backup responsibility let you respond without deciding whether the voice is cloned.

Scenario 3:

A partner sends a document link

A project partner sends a message from their usual email account. The link opens a page asking you to sign in to view a shared file.
Response to practice: Open the approved sharing service directly. If the document cannot be confirmed there, contact the partner independently.
Connection to the kit: A unique password limits exposure across accounts, and MFA adds protection. Neither makes every linked sign-in page safe. If credentials were entered, report promptly and begin the account response process.

Scenario 4:

A video call requests client information

Someone appearing to be a colleague on a video call asks you to send a client list to a new email address for a report.
Response to practice: Confirm the request independently, establish the recipient’s authorization and determine what information is actually needed. Use the approved delivery method.
Connection to the kit: Information-handling rules apply even to genuine requests. Seeing someone on video does not replace those checks.

Make practice supportive

Short, open exercises can build confidence without simulation software. Practice the actual steps: locating trusted contact details, obtaining approval and reporting a mistake.

Look for process gaps. Can people reach the backup contact? Do they know how to report? Can they verify a request without being pressured to bypass the rules?

Avoid public rankings or exercises designed to embarrass someone. If using simulated phishing messages, establish authorization, scope and privacy safeguards first. Do not collect real passwords or sign-in codes, and debrief participants afterwards.

If someone has already acted

Use the response arrangements developed in Section 9:

Stop further interaction and report promptly.
Preserve relevant messages and record what happened.
Contact the financial institution immediately if money was sent.
Obtain trusted help to secure affected accounts or devices.
Assess any disclosure of personal information and notification requirements.

Do not wait to prove that a request was fraudulent before reporting a possible exposure. A prompt report gives the organization more opportunity to limit harm.

A suggested policy rule

Requests involving payments, changes to financial details, sensitive information or account access must follow established verification and approval procedures. Verification must use independently established contact routes. Urgency, seniority and familiarity do not remove these requirements. Possible fraud or mistaken actions must be reported promptly.

Before adopting this rule, identify the actions covered, contact routes, approvals and backup arrangements.

Activity

Test your verification process

Choose three requests your nonprofit regularly receives.

Practice one scenario using the completed process. Assign someone to resolve any gaps you discover.

Download worksheet here

Your takeaway

By the end of this section, you should have:

Identified actions that require verification.
Established trusted contact routes and approvals.
Practised responding to believable requests, including AI-assisted impersonation.
Connected prevention with prompt reporting and incident response.

You are now ready to choose your next improvements, assign responsibility and put this kit into practice.

Wrap-Up Section

CyberCatalyst: Cybersecurity Fundamentals for Non-Profits is KnowledgeFlow’s free, self-paced course for organizations with limited budgets and little or no dedicated IT support.

This kit helps you identify what needs attention. CyberCatalyst is a natural next step for developing the understanding and practical skills to carry out improvements. Staff, leaders and volunteers can work through the course at their own pace and bring their learning back to your organization.

Explore cyberCatalyst

Know when professional help would be useful

Many everyday improvements can begin within your team. Professional support becomes useful when you need specialist knowledge, an independent assessment or help putting several safeguards together.
Consider getting help when:

The consequences of disclosure may call for a more detailed security and privacy assessment.

You may need help identifying gaps, configuring protections or planning a safe transition.

Privacy, contractual, funding or sector-specific obligations may require appropriate professional advice.

An assessment can help establish what is in place and what still needs work.

A professional can help assess your current practices and build a realistic improvement plan.

Seek timely incident-response assistance rather than waiting to complete a training course.

Moving toward standards and formal assurance

Standards and frameworks give organizations a structured way to assess and improve security. This kit introduces useful safeguards, but completing it does not establish compliance with a particular standard.

You can begin by aligning your practices with recognized guidance. If you later pursue formal compliance or certification, the work may also involve defining the scope, assessing risks, documenting procedures, maintaining evidence and checking that safeguards operate consistently.

Professional support can help you:

Choose a framework or standard appropriate to your organization and obligations.
Compare current practices with its requirements.
Prioritize gaps according to risk, capacity and cost.
Develop workable policies and procedures.
Establish evidence, review routines and preparation for any required independent assessment.

Ask what outcome you actually need: a practical improvement plan, alignment with a framework, evidence for a partner, or formal certification. These are different goals and may require different levels of work.

Find support that fits your nonprofit

You can speak with KnowledgeFlow or another qualified consulting organization about your needs and the support available. Begin with your inventory, priorities and unresolved questions so the discussion leads to a clear scope.

Ask prospective providers to explain:

Their experience with nonprofits of your size and capacity.
What they will assess or implement.
Which standard or framework they propose and why.
What deliverables, costs and ongoing responsibilities are involved.
Whether formal certification requires a separate assessment body.

Choose support that helps your team understand and maintain the improvements. Clear explanations and realistic recommendations matter alongside technical expertise.

Keep building

Cybersecurity is an ongoing part of caring for your organization and the people who trust it. Keep responsibilities current, revisit safeguards as your work changes and make questions and reporting welcome.

Start with your next three improvements. Build your knowledge through CyberCatalyst, and seek professional support when your needs call for it.