Cybersecurity basics for small charities

This guide is for small charities where "IT" means whoever is good with computers. Charities are targets for online criminals because they handle money and personal data, and often run on trust and shared logins. The good news: a few simple habits stop most attacks. After reading, you will be able to set up two-step login, use a password manager, spot common scams, keep backups, and manage who has access when people come and go.

Start with CISA's four steps

The Cybersecurity and Infrastructure Security Agency (CISA) is the federal agency that helps protect the country from cyber threats. Its free Secure Our World program boils safety down to four steps:

1. Use strong passwords and a password manager
2. Turn on multifactor authentication
3. Recognize and report phishing
4. Update your software

If your charity does only these four things well, you are ahead of many organizations.

Multifactor authentication (two-step login)

Multifactor authentication, or MFA, means using more than a password to sign in. After your password, you also confirm it is you, for example with a code from an app, a text message, a fingerprint, or a small security key you plug in.

Even if a criminal steals your password, MFA usually stops them getting in. CISA says that not all MFA methods are equally strong, but any MFA is better than no MFA. App-based codes or security keys are stronger than text messages. CISA calls "phishing-resistant" MFA, such as security keys using the FIDO standard, the strongest kind.

Turn on MFA first for:

• Email accounts (these can reset every other password)
• Online banking and payment platforms
• Donor database and accounting software
• Website, domain and social media accounts

Password managers

A password manager is an app that creates and stores strong, unique passwords for every account, locked behind one master password. You only need to remember one.

Why it matters: when people reuse one password everywhere, a leak from a single website can open all their accounts.

Good habits:

• Choose a password manager with a business or team plan so you can share specific logins safely.
• Use a long master password, like a short sentence, and protect it with MFA.
• Use a different, long password for every account.
• Share logins through the password manager, never by email, text or sticky notes.

Phishing and gift-card scams

Phishing is when a criminal sends a message pretending to be someone you trust, to trick you into clicking a link, opening a file, sharing a password, or sending money. It can come by email, text, phone or social media.

Warning signs:

• Urgency or pressure: "I need this in the next hour."
• A request to keep it secret or skip normal steps
• A sender address or link that looks slightly off
• Unexpected attachments or login pages
• A request for passwords, codes, or payment

A common scam targeting charities: someone pretends to be your executive director or board chair and asks a volunteer to buy gift cards "for a donor thank-you" and send the numbers on the back.

Also watch for payment change scams: an email that looks like it's from a supplier or partner, asking you to send money to "new bank details." Always confirm by phone using a number you already have.

If someone clicks or pays:

• Don't be ashamed and don't hide it. Speed matters more than blame.
• Change the affected passwords and sign out other sessions.
• Call your bank straight away if money was sent.
• Keep gift card receipts and contact the card company. The FTC advises reporting at ReportFraud.ftc.gov.
• Report online crime to the FBI's Internet Crime Complaint Center at ic3.gov.

Make it a rule that anyone can report a mistake without getting in trouble. People who fear blame stay quiet, and that gives attackers more time.

Updates

Software updates often fix security holes. CISA's advice is simple: don't delay them. Turn on automatic updates for phones, computers, browsers and apps. Replace devices that no longer get security updates.

Backups

A backup is a separate copy of your important files that you can restore if something is lost, broken, stolen or locked by ransomware (malicious software that locks your files and demands payment).

• Know what matters most: donor records, financial files, grant documents, policies, photos with consent forms.
• Keep at least one backup separate from your everyday files, so the same problem can't hit both.
• Check that backups run automatically.
• Test a restore at least twice a year. A backup you have never tested is a hope, not a plan.

Shared accounts

Many small charities share one login for social media or the bank portal. This is risky: you can't tell who did what, and you can't remove one person without changing it for everyone.

• Give each person their own account wherever the service allows.
• Where a shared login is unavoidable, store it in the password manager and change it when anyone leaves.
• Register important accounts to a role address (like admin@yourcharity.org), not someone's personal email.
• Keep a simple list of every account, who has access, and who owns it.

When people leave: offboarding

Offboarding means removing someone's access when they stop volunteering or working with you. It is the step most small charities forget.

Within a few days of someone leaving:

• Remove or disable their accounts.
• Change passwords for any shared logins they knew.
• Remove them as admins on social media, the website and the domain.
• Collect charity laptops, keys and devices.
• Move any charity files out of their personal storage.

Do this kindly. It is not a sign of distrust. It protects them as well as you.

Your cybersecurity checklist

• Turn on MFA for every email account
• Turn on MFA for banking, payments, donor and website accounts
• Set up a password manager and move shared logins into it
• Brief everyone on phishing and the gift-card scam
• Agree a "call to confirm" rule for any payment or bank change
• Turn on automatic updates on all devices
• Set up automatic backups and test a restore
• Make a list of all accounts and who has access
• Write a short offboarding checklist and use it every time

Security doesn't need to be perfect to be effective. Each step you take makes your charity a harder target, and criminals usually move on to easier ones.

If you want help setting any of this up, ask a member charity for help through the Exchange.