The one call your church bookkeeper should make before buying any gift cards

An email arrives in the office — from the pastor, the executive director, or someone in leadership — asking staff to purchase gift cards right away and send the numbers by text. Most of these emails are fraud. Gift cards are now the most common cash-out method in business email scams, used in 54 percent of cases in the first half of 2026.

Church and nonprofit staff have heard plenty about wire-transfer fraud. The training usually goes: if someone emails asking for a wire transfer to a new account, call and verify first. That training is correct — and still valuable. But the criminals have noticed, and they have shifted.

Wire transfers draw scrutiny. Banks are trained to ask about large outgoing wires, and fraud departments will sometimes delay or reverse them. Gift cards carry none of that friction. They can be bought at any grocery store, the codes delivered by email or text in seconds, and the funds converted or sold before anyone looks twice. According to Fortra's Q2 2026 BEC Global Insights Report, gift cards now account for 54 percent of all business email compromise cash-out requests — far ahead of wire transfers, which have fallen to around 12 percent. A church bookkeeper who was only warned about wire transfers has a gap in their training, and scammers know it.

What the email looks like

The email goes to whoever handles purchasing — a treasurer, an office administrator, an executive assistant. It appears to come from someone in authority: the senior pastor, the executive director, the board chair. The message is short and urgent:

• "I need a favor — can you grab some gift cards today? I'll explain later."
• "Please pick up $400 in Google Play cards for the youth volunteers — keep it a surprise."
• "We have a vendor situation and I need this handled before end of day."

The sender's name looks right. Sometimes the actual email address is slightly off — "pastorbob@gmail.com" instead of "pastor.bob@churchname.org" — but display names are easy to fake, and many people never check the address behind the name.

In some cases the account really was broken into, and the email genuinely came from the leader's inbox. Either way, the same check stops it.

Why gift cards are the preferred target

It helps to understand the criminal's problem. After a successful scam, they need to convert whatever you sent into cash they can actually use — quickly, and without triggering a reversal. Gift cards solve every part of that problem. Unlike a wire transfer, there is no bank calling to verify the transaction. Unlike cash, the codes can be delivered in seconds from anywhere. And unlike cryptocurrency, gift cards require no technical setup on the victim's end.

The FBI's 2025 Internet Crime Complaint Center report found that Americans aged 60 and older lost $568 million to business email compromise that year — a 48 percent increase from the year before. Seniors and the staff of faith-based organizations are disproportionately targeted because these are high-trust communities: following an authority figure's request is normal, expected, and often a point of pride. Scammers understand that, and they write their emails accordingly.

What to do

1. Stop before you go to the store. The moment an email requests gift cards, treat it as unverified until you have spoken to the person by phone. The urgency in the message is part of the pressure tactic — it is designed to make you act before you think.
2. Call the person directly, using a number you already have. Do not use a phone number in the email. Look up the person in your existing contacts, your church directory, or your organization's phone list. Call and ask whether they sent the request. If they did, you can proceed. If they did not, you have just caught a fraud attempt — and possibly an account takeover worth reporting.
3. Check the sender address behind the display name. In Gmail, hover over the sender's name to reveal the actual address. In Outlook, click on the name to expand it. A display name of "Pastor Jim" with an address of "pastor.jim487@gmail.com" is a spoofed email, not a message from your pastor.
4. Set a written policy — one paragraph is enough. Ask your finance committee or board to adopt a simple rule: no gift card purchases without a verbal confirmation from the requester, made by phone using a known contact number. Post it where purchasing staff can see it. That policy, put in writing before an attack happens, protects everyone on the team.
5. Report the attempt. Even if no money was sent, forward the suspicious email to security@familysentinel.org and to your email provider's abuse address. Reporting the attempt helps protect other organizations receiving the same message.
6. Share this with your whole office team now. The person most likely to receive this email is whoever handles day-to-day purchasing — not the pastor, not the IT volunteer. Make sure the right people have read this before the request arrives.

Related reading

• Business email compromise prevention checklist for churches and nonprofits — a printable one-page protocol for verifying payment-change requests and executive impersonation attempts.
• Email security for nonprofits and faith-based organizations — the technical settings that reduce spoofing risk and the staff training that fills the remaining gap.
• Executive impersonation and invoice fraud — how attackers use a leader's name to move money, and the authentication controls that stop them.

Written by the Family Sentinel security desk — a working Security Architect and the team who watch organizational inboxes around the clock. Sources: Fortra BEC Global Insights Report, Q2 and July 2026 (fortra.com); FBI Internet Crime Complaint Center 2025 Annual Report (ic3.gov). Questions or a suspicious email to review? Reach us at security@familysentinel.org or (940) 281-6672 — no charge, no strings.