Protect Yourself from Email Scams Targeting Parishes

Keeping our parish community safe extends beyond our physical church walls—it applies to our digital spaces as well. Below you will find general information about staying safe online in addition to current and active security advisories that circulate within our community.

Always keep in mind, your first line of defense to protect yourself and others is a strong password on all critical accounts along with multi-factor authentication. For passwords, our recommendation is 16 characters or more on anything of importance with those 16+ characters including upper/lower case, numbers, special characters, and non-readable (i.e. actual words). Password managers are a huge help for this.

Criminals often attempt to impersonate our pastor(s) and parish staff, in addition to friends and family, in emails, hoping parishioners’ goodwill and trust will lead them to send money or gift cards or simply click a link. This page will help you recognize and avoid these scams.

Important: Our Parish Staff Will Never Ask for Money or Gift Cards by Email

Neither our pastor nor any parish staff member will ever contact you by email or text to ask you to purchase gift cards, wire money, or send funds in an unconventional way. If you receive such a message, it is a scam. If you receive anything you are unsure of, it’s most likely a scam. TRUST YOUR INTUITION.
Do not reply to the email. Do not send or forward anything. DO NOT click any links, AND DO NOT open any attachments.
If you’re not 100% sure of where an email came from or what it is, be cautious and treat every unverified email as suspicious.

The Most Common Threat

The #1 Parish Scam: Staff Impersonation

This is the most frequently reported scam targeting Catholic and other Christian communities across the country. It is happening at parishes just like ours, and our parishioners need to be aware.

What This Scam Looks Like

A scammer creates a free fake email account (like Gmail, Outlook, or Yahoo) and sets the display name to be that of our pastor — for example, “Father Mat” — even though the actual email address is completely different and not from our parish. They then send emails to parishioners asking for a favor, usually involving gift cards.

  • The email display name looks like it’s from the pastor, but the address itself is fake
  • The message uses urgent, friendly language:
    “Are you free? I need a quick favor.“
  • Once you reply, they ask you to buy gift cards (Google Play, Apple, Amazon, etc.) and send the card numbers
  • They may say it’s for a charity, a surprise for staff, or to help someone in need
  • This same scam has targeted parishes throughout the United States in recent years, including current and former pastors’ names
How the Scam Unfolds
Step by Step

Understanding how scammers operate helps you stop it before it starts. Here is a typical step-by-step sequence:

  1. The Scammer Sets the Trap
    The criminal creates a free email account and sets the “display name” to match a parish staff member’s real name. They research your parish website, bulletin, or social media to find names and details.
  2. The First Contact — Friendly and Vague
    You receive an email that seems to be from the pastor or staff saying something like: “Hi, are you available right now? I need a small favor and I can’t talk on the phone at the moment.” This is a test to see if you will respond.
  3. The Ask — Urgent and Secretive
    After you reply, the scammer reveals their request: to purchase gift cards and send photos of the card numbers and PINs. They may include a “secrecy aspect” to the email to stop you from checking with others.
  4. The Theft — Instant and Irreversible
    The moment you send the gift card numbers and PINs, the scammer drains the card immediately. Gift cards cannot be refunded or recovered once the numbers are shared. Victims have lost hundreds of dollars this way.

Warning Signs

Red Flags to Watch For

These warning signs should immediately raise your suspicion that an email or text message is not legitimate.

The Email Address Doesn’t Match

The name matches that of our pastor or staff person but the actual email address is something like fathermat4354@gmail.com — not an official parish address.

Urgency and Time Pressure

Phrases like “I need this right away,” “Please respond immediately,” or “I’m in a meeting and can’t talk” are pressure tactics to stop you from pausing to verify.

A Request for Gift Cards

No legitimate person, business, organization, or government agency will ever ask you to pay using gift cards. This is universally a scam. Period.

Requests for Secrecy

Being told to keep the request “between us” or “don’t tell anyone yet” is a classic manipulation tactic. It is meant to prevent you from verifying the request with others who might catch the scam.

Take Action

What To Do if You Receive a Suspicious Email

If something doesn’t feel right, follow these steps. Your instincts are usually correct.

1

Don’t Reply — Don’t Click Anything

Do not reply to the email, click any links, or open any attachments. Even replying confirms your address is active, which can invite more scam attempts.

2

Check the Actual Email Address

Click, tap, or put your cursor on the sender’s name to reveal the full email address. If it does not end in an official parish domain (stagnesshepherdstown.org), it is almost certainly a scam regardless of the display name.

3

Mark It as Spam & Delete It

Mark the email as spam or junk and then delete it. This also helps your email provider block similar messages from reaching others in the future.

4

Warn Your Fellow Parishioners
Tell a friend at Mass, mention it to your prayer group or other friends at the parish to give them a warning. A quick heads-up can protect others in our community.

5

If You Already Sent Money — Act Fast

Contact your bank immediately. For gift cards, call the card issuer’s customer service. Report the fraud to the FTC at reportfraud.ftc.gov and to your local police.

6

Questions? Call Parish Staff

If you are unsure, call the parish office or the text/email St. Agnes Tech Admin using the information you already know. One quick call or text can prevent a costly mistake.

Be Aware

Other Common Scams & Current Advisories to Know About

Beyond parish impersonation, there are many other scams that commonly target everyday people — including parishioners. Below you will find both current/active scams that we’ve been made aware of and general ongoing scams.

DATE ISSUED: August 2026
Fake “Protected Invitation” Emails Sent from Member Accounts

An automated email phishing chain/worm targeted parishioners and was designed to steal email login credentials. It most likely initiated when the Scammer gained unauthorized access to a member’s email account and automatically sent fake “invitations” to people in their contact list. This scam was in “Invite” that encouraged receivers of the email to click a link to open the invitation. The link then directed people to a fake login page as an attempts to capture email address and passwords. If you typed your credentials, the scammers then used those credentials to send the same email to all of your contacts, continuing the chain.

  • Do NOT click any links or buttons inside these emails.
  • If you already clicked a link and entered your password: Change your email password immediately and turn on two-factor authentication.
  • When in doubt: Reach out to the sender via phone or in person to verify before opening any unexpected links or attachments.
Phishing Emails — Fake Banks, Government, or Companies

You receive an email that looks like it’s from your bank, the IRS, Social Security, Medicare, Amazon, or another trusted company. It warns of a problem with your account and asks you to click a link and “verify” your information or reset your password. The link leads to a fake website that steals your login, password, or credit card number.

Example message: “Your bank account has been suspended due to suspicious activity. Click here to restore access within 24 hours or your account will be closed.” or “We’ve updated our system which requires you to now reset your password.”

PC Tech Support Scams

A pop-up appears on your computer (or you receive a call) claiming your computer has a virus. You’re told to call a number or allow “support staff” remote access. They then steal your personal data, install real malware, or charge you for fake services. Microsoft, Apple, and Google never contact you this way.

Example: A loud alarm sounds from your computer with a message: “Call Microsoft Support immediately at 1-800-XXX-XXXX — your computer is infected and your data is at risk.”

Grandparent / Family Emergency Scam

A caller claims to be your grandchild (or another relative), saying they’ve been in an accident, arrested, or are in danger. They desperately need money right away — often via wire transfer or gift cards — and beg you not to tell anyone. Sometimes a fake “lawyer” or “police officer” gets on the phone to make it seem more real.

Example: “Grandma, it’s me — I was in an accident and I’m in jail. Please don’t tell mom or dad. I need $1,000 for bail. Can you go get some gift cards?“

Lottery and Prize Scams

You receive an email, text, or letter saying you’ve won a lottery, sweepstakes, or prize — but you must pay a fee first to “release” your winnings. There is no prize. Any winnings you were promised do not exist. You will simply lose whatever you send them.

Example: “Congratulations! You have been selected as a winner of $85,000 in the International Parish Lottery. To claim your prize, please send a $250 processing fee via wire transfer.“

Charity and Disaster Relief Scams

After a natural disaster, tragedy, or during the holiday season, scammers set up fake charities that sound similar to real organizations. They contact people by email, phone, or social media. Always verify charities through give.org (BBB Wise Giving Alliance) or charitynavigator.org before donating.

Example High Risk Emails

Below are a few example emails you may receive. Click each email to enlarge/zoom

This example shows how you can place your cursor over the link (image on the right) to see where you will be sent when you click. If it doesn’t correspond with the content of the email, DO NOT CLICK! Delete the email and consider it spam.