Digital Safety

How a small club loses money through a fake treasurer email

Estimated Reading Time =

2 minutes

Technical Level =

Basic

Threat Level =

High

Attack Type =

Other

Editorial illustration for how a small club loses money through a fake treasurer email

What you will learn

What you will learn

A volunteer group can lose money through a plausible payment request, especially during a change of treasurer. Keep account ownership, payment verification, and a second review explicit.

A small club may depend on one volunteer to organize payments. That convenience can become a weakness when an email appears to come from the chair, treasurer, or supplier. A simple payment rule is easier to follow than asking volunteers to identify every possible scam.

Understand the idea

Decide who requests, verifies, and approves a payment. Check changed beneficiary details through a separately known contact method. The second approval should cover the final destination and amount, not just the general idea of paying the supplier. Keep the process short enough for real volunteers to use.

A simple way to follow the process
  1. Request

    Match the proposed payment to an agreed activity.

  2. Verify

    Check unusual instructions or destination changes independently.

  3. Release

    Have another authorized person review the final details.

A practical example

Imagine a club receiving an urgent venue invoice from a familiar-looking email address. The treasurer matches it to the event booking and calls the venue through the existing record. Another committee member checks the final account details before payment is released.

Visual guide: How a small club loses money through a fake treasurer email
Match the proposed payment to an agreed activity. Check unusual instructions or destination changes independently. Have another authorized person review the final details.

What to do next

  1. No beneficiary change from email alone. Verify changed bank details through a previously recorded contact.
  2. Separate important approvals. A second authorized person checks the destination and evidence before the payment is released.
  3. Use individual accounts. Protect club email and banking access with unique passwords and access keys and supported strong authentication.
  4. Keep an absence route. Record who substitutes for an unavailable approver without eliminating the verification step.

How to check the result

Keep the invoice, independent confirmation, and approval together. If the people responsible cannot explain the same process, clarify it before the next urgent request arrives.

The request appears to come from the club chair.

Verify the payment through the normal independent route. An email account or display name is not enough to authorize an unusual transfer.

Sources and useful guides

The following resources provide background and more detailed guidance. Use the sections that match your service and situation.

Scroll to Top